Understanding HHS Section 405(d) & Medical Device Security

Section 405(d) presents 10 practices, tailored to healthcare delivery organizations of all sizes, to help mitigate these threats. This White Paper focuses on how Claroty supports one of those ten practices: Cybersecurity Practice #9: Network Connected Medical Devices.

Healthcare delivery organizations use many diagnostic and therapeutic devices for patient treatment as well as building management systems (BMS) that control the healthcare environment itself, such as HVAC systems, connected thermostats, and elevator controls. These devices range from straightforward monitors that provide crucial information for healthcare providers to complex, multi-function machines that provide critical life-supporting care such as infusion pumps or respirators. Medical and BMS have similar cybersecurity deficiencies, create massive amounts of data that affect patient safety, well-being, and privacy, and their interconnection with traditional IT systems broadens the attack surface of healthcare networks.