Medical Devices and IoT: The Forgotten Computers on Your Network

The Devices Nobody Thinks About

Count the computers in your practice and you will probably count the desktops and laptops. Now count again, and include everything with a processor and a network cable. The digital X-ray or pano machine. The ultrasound. The multifunction printer that scans, copies, and faxes. The smart TV looping a slideshow in the waiting room. The thermostat you adjust from your phone. The security cameras. The VoIP desk phones. The tablet signed in as a guest at the front.

A typical small clinic in Rockport or Portland has a dozen or more of these, and almost nobody inventories them — which means nobody updates them, nobody changed their passwords, and nobody thought about what happens if one of them gets compromised. If a device stores or transmits patient information, HIPAA’s Security Rule covers it just like a workstation. And even the ones that do not touch patient data can be a doorway: a compromised camera or TV on the same network as your EHR is a foothold an attacker can use to move sideways.

Why These Devices Are Risky

Three traits make medical and IoT devices different from a normal office computer, and all three work against you.

First, they run old software for a long time. An imaging workstation might run an operating system the vendor certified a decade ago, and the vendor forbids you from updating it yourself because that would void the service contract. Second, they ship with default passwords — admin/admin, or a vendor-wide service password — and those defaults often survive installation because changing them is nobody’s assigned job. Third, vendors remote into them. Your imaging company, your phone vendor, your camera installer may all have remote access for support, which is convenient until you ask who else could use that same door.

You also cannot protect them the way you protect a laptop. There is no antivirus to install on a thermostat. Nobody is patching the waiting-room TV. That is normal — the answer is not to treat them like workstations, it is to contain them, which brings us to the fix.

Segmentation in Plain English: Separate Lanes

Think of your network like a road. Right now, most small clinics have one road: the EHR server, the front-desk computers, the X-ray machine, the smart TV, and the patient Wi-Fi are all driving in the same lane. If one vehicle crashes, everything behind it piles up.

Segmentation just means building separate lanes. One lane for staff computers and the EHR. One lane for medical devices and equipment. One lane for guests — patients on their phones in the waiting room should never be on the same network as your charts, full stop. A compromised TV in the guest lane cannot reach the EHR in the staff lane, because the lanes do not connect.

This is not exotic equipment. Any competent business-grade router or firewall can do it, and most clinics already own hardware capable of it — it was just never configured. If your “guest Wi-Fi” is the same Wi-Fi your staff uses, that is the first lane to split, and it is usually an afternoon’s work.

What to Ask Your Equipment Vendors

You bought the imaging machine; the vendor installed it and left. Somewhere in between, security fell through the cracks. These questions put it back on the table — in writing, by email:

• Was the default administrator password changed at installation, and what is our current admin login?
• Who is responsible for software updates on this device — us or you — and how often do they happen?
• Do you have remote access to this device for support? How is that access secured, and can we turn it off when you are not using it?
• Is this device still supported, or is it end-of-life? What is the plan if a security flaw is found in it?
• Does the device store patient images or data locally, and is that storage encrypted?

Ask the same of your printer/copier vendor — especially about the hard drive inside the machine and what happens to it when the lease ends and the machine goes back. That drive may hold years of scanned intake forms.

What to Do Monday Morning

Walk the office and list every device with a screen, a network cable, or a Wi-Fi connection — medical or not. Then do three quick things: change any password still set to the factory default (check the TV, the thermostat, the cameras, the printer’s web page), confirm patients’ phones are on an isolated guest network and not your staff Wi-Fi, and email your imaging vendor the five questions above.

You will not fix every device in a morning. But you will know what you have, you will have closed the default-password door, and your guests will be in their own lane. That is more device security than most clinics your size have ever had.

Frequently asked questions