By Frank Andrus

The number of IoT devices used in the healthcare industry is exploding.

These interconnected devices can streamline healthcare processes, add safety measures, and improve patient outcomes. IoT adoption rates are rising so quickly that analysts predict that the healthcare IoT market will experience a 30 percent compound annual growth rate from 2017 to 2022.



Everything from insulin pumps to MR machines is now collecting, storing and transmitting data. To fully realize the benefits from IoT devices, healthcare companies face the challenge of securing these devices, as well as the HIPAA information these devices collect.

Why are IoT devices difficult to secure?
Organizations are struggling to locate and lock down IoT devices because most current firewalls and security solutions cannot see and secure these types of technology. Why is IoT security so much more challenging? IoT devices are designed differently than laptops or mobile phones. Many of these devices are “headless”, which means they do not have a specific user or input device. Hackers scan networks looking for security gaps, and many IoT devices are an easy target because:

• IoT devices automatically connect to the internet to send information to manufacturers and/or share information with other devices – sometimes without owners even realizing these devices are connecting outside the internal network
• Many IoT devices have no “user”, so most firewalls – the first line of defense – cannot “see” or protect these products because they can’t authenticate headless devices
• There is no common platform and operating system for these devices, and most IoT devices lack the memory and processing power for meaningful security
• Many IoT devices have no inherent security built in, or have weak IoT authentication and authorization protocols that cause a security gap
• Some IoT devices have hardcoded PINs in the firmware that cannot be patched or updated, so once the PIN is discovered, it is a permanent security gap

Unsecured or poorly secured endpoint devices, such as IoT applications, are one of the weakest points in the network. Without good network segmentation, a hacker that infiltrates one of these endpoints can move laterally within a healthcare organization’s network to steal data resulting in HIPAA violations and fines, or worse, impacting the very lives organizations are trying to protect

Solving the IoT challenge
Securing IoT devices is a challenge that needs to be on every healthcare organization’s priority list. A recent Ponemon Institute survey found that 46 percent of organizations (likely, most likely or definitely) have already experienced an attack due to insecure IoT devices. Healthcare organizations can close the gap with three key steps:

Health IT Homepage