Cybersecurity and Connected Medical Devices: What NHS Clinicians Need to Know

Summary: Cybersecurity for connected medical devices is now a core clinical governance issue, with vulnerabilities potentially disrupting patient care and safety. Post-WannaCry, new MHRA regulations mandate 'security by design' and stricter post-market surveillance. Clinicians must actively contribute to safety by reporting device anomalies and adhering to secure authentication practices to mitigate these risks.

Walk through any NHS hospital today and you will find medical devices that would have been unrecognisable to clinicians 20 years ago. Infusion pumps receive drug library updates over a wireless network. Ventilators transmit patient data to central monitoring systems. MRI…

Frequently asked questions

What is the connection between Cybersecurity and Connected Medical Devices in an NHS setting?

Connected medical devices, like infusion pumps and ventilators, transmit patient data across NHS networks. This enhances care but also introduces risks. Cybersecurity is the practice of protecting these networked devices from digital threats. A failure in cybersecurity can lead to data breaches, disruption of clinical services, and potential patient harm, making it a critical clinical governance issue for every trust.

What are the real-world risks to patient care from a cyberattack on hospital devices?

A cyberattack can have direct clinical consequences. The 2017 WannaCry attack led to thousands of cancelled NHS appointments as staff were locked out of essential systems and devices like MRI scanners. Beyond service disruption, a successful attack could breach patient confidentiality, lead to incorrect data, or cause a device to malfunction, directly impacting patient safety and the delivery of care.

Why is it so difficult to keep medical device software updated against cyber threats?

Unlike a standard computer, medical device software is often certified for a specific operating system. Applying a security patch can invalidate this regulatory certification, requiring a new conformity assessment by the manufacturer. Additionally, devices may remain in service for 10-15 years, meaning the underlying software can become outdated and unsupported, making it highly vulnerable to new threats if not carefully managed.

As an NHS clinician, what is my role in preventing cybersecurity incidents?

Clinicians are the first line of defence. Your role includes promptly reporting any unusual device behaviour, such as crashes or slow performance, through your organisation's incident reporting system. It is also vital to never connect unauthorised devices, like personal USB sticks, to medical equipment. Cooperating with IT and clinical engineering teams during software updates and security checks is another key responsibility.