--- title: How Do Hospitals Protect Medical Devices They Can't Patch? description: Can't patch an infusion pump? Five Nines Technology Group explains how hospitals contain legacy medical devices with segmentation and monitoring. image: https://blog.fivenines.com/hubfs/Blog%20banner%20The%20Oldest%20Computer%20in%20the%20Building@1x.png --- [Skip to the main content.](https://blog.fivenines.com/how-do-hospitals-protect-medical-devices-they-cant-patch#main-content) 1-855-817-5959    [help@fivenines.com](mailto:help@fivenines.com) [![FN\_Reverse\_Logo](https://blog.fivenines.com/hs-fs/hubfs/FN_Reverse_Logo.png?width=3022&height=849&name=FN_Reverse_Logo.png "FN_Reverse_Logo")](https://fivenines.com/) [![FiveNinesPrimaryLogo](https://blog.fivenines.com/hs-fs/hubfs/FiveNinesPrimaryLogo.png?width=3022&height=849&name=FiveNinesPrimaryLogo.png "FiveNinesPrimaryLogo")](https://fivenines.com/) - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) Let's Talk Get Support Toggle Menu Toggle Menu Let's Talk Get Support - [Solutions](https://fivenines.com/solutions/) - [Managed IT Services](https://fivenines.com/solutions/managed-it-services/) - [Cybersecurity Services](https://fivenines.com/solutions/cybersecurity/) - [Cloud & Productivity](https://fivenines.com/solutions/cloud-productivity/) - [Projects & Enhancements](https://fivenines.com/solutions/it-projects/) - [Placement Services](https://fivenines.com/solutions/onsite-it/) - Industries - [Finance & Banking](https://fivenines.com/industries/banking/) - [Healthcare](https://fivenines.com/industries/healthcare/) - [Legal](https://fivenines.com/industries/legal/) - [Nonprofit](https://fivenines.com/industries/non-profit/) - [Manufacturing & Logistics](https://fivenines.com/industries/manufacturing-logistics/) - [Small & Mid-Sized Businesses](https://fivenines.com/industries/smb/) - [Insights](https://fivenines.com/resources/) - [Resource Library](https://fivenines.com/resources/) - [Blog](https://blog.fivenines.com) - [About](https://fivenines.com/about/) - [About Five Nines](https://fivenines.com/about/) - [Leadership Team](https://fivenines.com/our-team/) - [Community Impact](https://fivenines.com/community/) - [Partnerships](https://fivenines.com/partnerships/) - [Careers](https://fivenines.com/careers/) - [Company News](https://fivenines.com/news/) # How Do Hospitals Protect Medical Devices They Can't Patch? [Five Nines Team](https://blog.fivenines.com/author/five-nines) : Oct 30, 2026, 6:00:00 AM 7 min read [Cybersecurity](https://blog.fivenines.com/topic/cybersecurity) [Healthcare](https://blog.fivenines.com/topic/healthcare) [Compliance](https://blog.fivenines.com/topic/compliance) ![How Do Hospitals Protect Medical Devices They Can't Patch?](https://blog.fivenines.com/hubfs/Blog%20banner%20The%20Oldest%20Computer%20in%20the%20Building@1x.png) *TL;DR* - **Unpatched is not the same as unpatchable.** Many device vulnerabilities have vendor fixes that never got applied because nobody owned the job. - **Segmentation is the patch you control.** When the device can't change, the network around it can. - **New FDA rules don't reach your installed base.** Security requirements for new device submissions do nothing for the pump already on the floor. - **IT and biomed have to share one list.** A device nobody fully owns is a device nobody fully protects. Hospitals protect medical devices they can't patch by containing them instead of fixing them. That means knowing exactly which devices are on the network, isolating them in their own network segments, allowing only the connections each device needs for care, watching their traffic for anything unusual, and tightly controlling vendor remote access. Walk any med-surg floor and count the computers. The nurse workstation is obvious. The infusion pump on the IV pole is not. Neither is the patient monitor, the medication cabinet, or the imaging workstation down the hall. Each one runs an operating system, holds a network address, and was cleared by the FDA with software that may be a decade old. ***The infusion pump may be the oldest computer in the building.*** That is not a hypothetical. When [Unit 42, the threat research team at Palo Alto Networks](https://unit42.paloaltonetworks.com/infusion-pump-vulnerabilities/), analyzed scan data from more than 200,000 infusion pumps on hospital networks, 75% carried known security gaps. The same research noted that the average infusion pump stays in service eight to 10 years. Replacement will not outrun that math. Containment has to.   ## Why Can't Hospitals Just Patch Their Medical Devices? > **Short answer:** Hospitals often can't patch medical devices because the manufacturer controls the software. Changing it without vendor validation can void support or alter how a cleared device behaves. Five Nines Technology Group sees the result in every hospital network: devices that run for eight to 10 years on software the hospital is not allowed to touch. A laptop gets patched on Tuesday night and nobody notices. A patient monitor is different. The software is part of what the FDA cleared, so updates come from the manufacturer, on the manufacturer's schedule, after the manufacturer tests them. Then there is the clinical calendar. Taking a pump fleet offline for updates means pulling devices off patients, which means coordination with nursing, biomed, and pharmacy. Updates slip. Some never come at all, because the vendor ended support for that model. Regulation is catching up, but only at the front door. Since March 29, 2023, Section 524B of the Federal Food, Drug, and Cosmetic Act has required manufacturers submitting new "cyber devices" to include cybersecurity plans and a software bill of materials, as laid out in the FDA's [final premarket cybersecurity guidance](https://www.fda.gov/media/119933/download). That helps the next device you buy. It does nothing for the one already on the IV pole.   ## Is an Unpatched Medical Device the Same as an Unpatchable One? > **Short answer:** No. Many vulnerable medical devices have vendor fixes available that were never applied. In the Unit 42 infusion pump study, the two most common vulnerabilities affected about 52% of pumps scanned, and the manufacturer had already released updates for the affected models. Five Nines treats "unpatchable" as three separate problems with three separate answers. The Unit 42 research is useful here precisely because of what it shows about fixes. Five of its top 10 vulnerabilities traced to one manufacturer's pump line, and that manufacturer had published bulletins and software updates. The gap was not a missing patch. It was a missing process. That changes the conversation. Before a hospital accepts a device as unpatchable, it should know which kind of unpatchable it is dealing with. | What you hear | What is actually happening | The right response | | --- | --- | --- | | "The vendor won't fix it" | Model is end of support, or the vendor has no update | Contain it permanently and budget its replacement | | "We can't patch it yet" | Vendor has a fix but hasn't validated it, or clinical scheduling is blocking it | Contain it now, schedule the update with nursing and biomed | | "Nobody has patched it" | A fix exists and is approved, but no one owns applying it | Assign an owner. This is the cheapest risk in the building to close | > ### The Hidden Risk > > The most dangerous device on a hospital network is often not the unpatchable one. It is the patchable one that everyone assumes someone else is handling.   ## What Does Network Segmentation for Medical Devices Actually Look Like? > **Short answer:** Medical device segmentation places clinical devices in their own network zones, grouped by device type, and blocks every connection except the ones each device needs for care. An infusion pump should reach its pump server and nothing else. Five Nines builds these rules from observed traffic, not from vendor assumptions. The [HHS 405(d) Health Industry Cybersecurity Practices (HICP) 2023 Edition](https://405d.hhs.gov/Documents/405d-hicp-highlight.pdf) names attacks against network connected medical devices as one of the five top threats to healthcare and dedicates Cybersecurity Practice #9 to protecting them. In practice, that work tends to follow a consistent pattern.  1. **Separate zones by device class.** Infusion pumps, patient monitors, imaging, and lab analyzers each get their own segment, apart from staff workstations, guest Wi-Fi, and building systems. 2. **Deny by default between zones.** Traffic between segments is blocked unless a rule allows it, and every rule names a specific destination and port. 3. **Allow only clinical flows.** A pump talks to its pump server. A modality talks to PACS. A monitor talks to its central station and the interface engine that feeds the EHR. 4. **Block internet access.** Almost no bedside device needs to reach the open internet. Outbound traffic from a clinical segment should be treated as an alert, not a default. 5. **Broker vendor remote access.** Vendor support connects through a single gateway with multifactor authentication, time-limited sessions, and logging, never through an always-on tunnel. 6. **Watch passively.** Monitoring reads network traffic rather than actively scanning devices, because aggressive scans can disrupt some older clinical equipment. ![Graphic 3 Never-Fix Playbook@1x](https://blog.fivenines.com/hs-fs/hubfs/Graphic%203%20Never-Fix%20Playbook@1x.png?width=1200&height=1320&name=Graphic%203%20Never-Fix%20Playbook@1x.png) Segmentation done this way does not depend on the device behaving well. It limits how far a compromised device can reach and how far an attacker can travel to reach it. > ### Five Nines Insight > > When the device can't change, the network around it has to. Segmentation is the one patch a hospital can apply on its own schedule.   ## How Do You Protect a Medical Device the Vendor Will Never Fix? > **Short answer:** You contain it permanently, monitor it closely, and plan its exit. In January 2025, CISA and the FDA advised hospitals to disconnect Contec CMS8000 patient monitors from their networks because the firmware contained hidden functionality and no effective fix existed. Five Nines treats that advisory as the template for any device without a vendor path forward. The [CISA advisory on the Contec CMS8000](https://cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01) is the clearest recent case. The monitor sent remote access requests to a hard-coded IP address and, in its default configuration, transmitted plain-text patient data. The guidance was blunt: remove the devices from the network. Most unsupported devices are not that extreme. But the playbook scales down cleanly: - **Isolate it.** A device with no vendor path gets the tightest segment on the network, with only local or required clinical connections. - **Baseline it.** Record what normal traffic looks like so any change stands out immediately. - **Compensate around it.** Restrict physical access to USB and service ports, change default credentials where the vendor allows it, and remove unused services. - **Retire it on purpose.** Put the replacement in the capital plan with a date, rather than waiting for a failure or an advisory to force the decision.   ## Who Should Own Medical Device Security, IT or Biomed? > **Short answer:** Both, working from one shared inventory. Biomed knows the device, the manufacturer, and the clinical impact of downtime. IT knows the network, the firewall rules, and the threat. Five Nines works with hospitals to put both teams on the same device list with named owners for patching, segmentation, and replacement decisions. The ownership gap is where the third kind of unpatchable lives. Biomed may assume IT is watching the network. IT may assume biomed is tracking vendor bulletins. The device sits in between, fully supported on paper and unprotected in practice. Procurement is the earliest place to close that gap. Before the purchase order is signed, ask for the manufacturer's Manufacturer Disclosure Statement for Medical Device Security (MDS2), the software bill of materials, the support end date, and the patching process. A device bought with those answers is a device you can plan around. > ### What Leadership Misses > > A medical device is a 10-year IT commitment that usually gets approved as a clinical equipment purchase. If IT is not in the buying decision, the security plan starts the day the device is already on the floor.   ## Where Does Your Hospital Stand on Medical Device Protection? > **Short answer:** Most hospitals fall somewhere on a five-stage path from not knowing what devices they have to governing every device from purchase to retirement. The Five Nines Medical Device Containment Model lets an IT Director or biomed lead place their hospital on that path in about five minutes and see the next step. **The Five Nines Medical Device Containment Model** | Stage | What it means | What it looks like on the floor | What moves you up | | --- | --- | --- | --- | | 1. Unknown | No reliable list of connected clinical devices | Nobody can say how many pumps are on Wi-Fi right now | A passive discovery of every device on the clinical network | | 2. Listed | Inventory exists, but devices share the network with everything else | The pump and the front desk PC sit on the same VLAN | Device-class segments with deny-by-default rules | | 3. Fenced | Devices are segmented and internet access is blocked | Vendor support still connects through an always-on tunnel | Brokered, logged, time-limited vendor access | | 4. Watched | Device traffic is baselined and monitored around the clock | An unusual outbound connection from a monitor triggers an alert in minutes | Shared IT and biomed ownership of patch and retirement decisions | | 5. Governed | Security requirements start at procurement and end at retirement | MDS2, SBOM, and support end date are reviewed before a device is bought | Annual review of the model against new advisories |   ![Graphic 1 Device Containment Model@1x](https://blog.fivenines.com/hs-fs/hubfs/Graphic%201%20Device%20Containment%20Model@1x.png?width=1200&height=1460&name=Graphic%201%20Device%20Containment%20Model@1x.png) The stages are cumulative. A hospital can't watch traffic it hasn't fenced, and it can't fence devices it hasn't listed. That is why the first step is almost always discovery, even for hospitals that believe their inventory is current. > ### The Rule of Two > > Every connected clinical device should have exactly two owners on paper: one in biomed who knows the device, one in IT who knows the network. One owner means a blind spot. Zero means a target.   ## What Does Five Nines Look for in a Hospital Medical Device Assessment? > **Short answer:** Five Nines looks first for the gaps between teams, because that is where unprotected devices hide. The patterns below are the ones that most often separate a hospital's documented device security from what is actually happening on the network. - **The flat clinical network.** Pumps, monitors, workstations, and printers share one VLAN because the original network was built before the device count grew. - **The forgotten vendor tunnel.** A remote support connection set up for one service call years ago is still open, with no MFA and no logging. - **The two inventories.** Biomed's equipment list and IT's network list disagree, and the devices on only one of them are the ones nobody is patching. - **The imaging workstation on an old Windows build.** The modality vendor supports only one operating system version, so the workstation stays there and nobody revisits the risk. - **Default credentials still active.** Service accounts ship with documented passwords and stay that way because changing them was never in anyone's checklist.   ## What Should You Ask an IT Provider About Medical Device Security? > **Short answer:** Ask how they discover devices without disrupting them, how they segment by device class, how they handle vendor remote access, and who on their team speaks biomed. A provider that answers only with a product name has not done this work in a hospital. 1. How do you discover clinical devices without active scans that could disrupt them? 2. How do you build segmentation rules, and who validates them with clinical staff before enforcement? 3. How is vendor remote access brokered, logged, and shut off after a session? 4. Who watches clinical device traffic at 2 a.m., and what happens when something looks wrong? 5. How do you coordinate with our biomed team and the device manufacturer when an advisory drops? 6. What does a device replacement recommendation look like in your capital planning reports?   ## How Many Devices on Your Clinical Network Can Reach the Internet Right Now? If you can't answer that in one sentence, you are not alone, and it is the right place to start. A Five Nines medical device exposure assessment identifies:  - Every connected clinical device on the network, discovered passively - Which devices share network space with workstations, guests, or building systems - Which devices can reach the internet, and which vendor connections are still open - Which vulnerabilities have vendor fixes that were never applied - Where your hospital sits on the Five Nines Medical Device Containment Model You leave with a device exposure map and a prioritized containment plan your IT and biomed teams can work from together. ***You can't patch every device in the building. You can decide what every device is allowed to reach.*** ![Graphic 2 Three Kinds of Unpatchable@1x](https://blog.fivenines.com/hs-fs/hubfs/Graphic%202%20Three%20Kinds%20of%20Unpatchable@1x.png?width=1200&height=1210&name=Graphic%202%20Three%20Kinds%20of%20Unpatchable@1x.png) ## Frequently Asked Questions Can you install antivirus or EDR on a medical device? Usually not. Most manufacturers do not allow third-party security agents on cleared devices, because added software can affect how the device performs. That is why protection for medical devices typically moves to the network: segmentation, traffic monitoring, and controlled vendor access. Does HIPAA require network segmentation for medical devices? The current HIPAA Security Rule requires a risk analysis and safeguards proportionate to the risk, and an unsegmented clinical network is a hard finding to defend. HHS has also proposed updates to the Security Rule that address network segmentation directly. Will segmenting medical devices interrupt patient care? It can if rules are enforced before every clinical connection is mapped. The safer sequence is to observe device traffic first, build rules from what devices actually need, validate them with nursing and biomed, and enforce in phases, starting with the device classes that carry the most risk. Do the new FDA cybersecurity rules make older medical devices safer? Not directly. Section 524B of the FD&C Act applies to new premarket submissions for cyber devices made on or after March 29, 2023. Devices already in service keep their original design, so hospitals still need to contain the installed base themselves. What should a hospital do when CISA or the FDA issues a medical device advisory? Start with the inventory: find every affected model and firmware version on the network. Then apply the manufacturer's mitigation, tighten that device's segment, and watch its traffic until a fix is applied. If no fix exists, follow the agency guidance, which may mean disconnecting the device. ## Related Blog Posts ## Let's get in touch   [**(402) 817-2630**](tel:402-817-2630) [help@fivenines.com](mailto:help@fivenines.com) [Lincoln, NE](https://fivenines.com/contact/lincoln) [Omaha, NE](https://fivenines.com/contact/omaha) [Kearney, NE](https://fivenines.com/contact/kearney) [Central City, NE](https://fivenines.com/contact/central-city) [St. Louis, MO](https://fivenines.com/st-louis) ![cyberverify-1](https://blog.fivenines.com/hs-fs/hubfs/cyberverify-1.png?width=110&height=110&name=cyberverify-1.png)![aicpa](https://blog.fivenines.com/hs-fs/hubfs/aicpa.png?width=110&height=110&name=aicpa.png) ### Are we a good fit? [![Schedule Consultation](https://no-cache.hubspot.com/cta/default/1857420/interactive-196258273705.png)](https://blog.fivenines.com/hs/cta/wi/redirect?encryptedPayload=AVxigLLM%2BFMcL7VwjqbzQGqwV%2F0SP8joCtiJ%2BzPUIpZF%2FHL%2BHop2Xys%2Bh4gMKXmY6W9vXUdgXhkwHVwSHO3W5qzouSMKav%2BLdZvr5Hc%2FuHarEHjFjiWWjTizo2jXfKMRxpx8euYUmIypnbeUkikb%2Fad5XQWLNOO5ahd7MgTmiM0Y%2FO4HfWmTLN%2BTVkpjowvmbsYZC4oCfQ%3D%3D&webInteractiveContentId=196258273705&portalId=1857420)   - [Privacy Policy](https://fivenines.com/privacy-policy/) - [HTML Sitemap](https://fivenines.com/html-sitemap/) © 2026 Five Nines Technology Group | 5617 Thompson Creek Blvd Lincoln, NE 68516 [Facebook](https://www.facebook.com/gonines)[Linkedin](https://www.linkedin.com/company/five-nines-technology-group/) [Blog](https://blog.gonines.com/?__hstc=143714730.45718742b0726c421d8592d7ea71f58b.1757514685996.1758029308186.1758134756251.4&__hssc=143714730.31.1758134756251&__hsfp=1745665186)   [Client Support](https://fivenines.com/client-login/) Return to top ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Usually not. Most manufacturers do not allow third-party security agents on cleared devices, because added software can affect how the device performs. That is why protection for medical devices typically moves to the network: segmentation, traffic monitoring, and controlled vendor access." }, "name" : "Can you install antivirus or EDR on a medical device?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The current HIPAA Security Rule requires a risk analysis and safeguards proportionate to the risk, and an unsegmented clinical network is a hard finding to defend. HHS has also proposed updates to the Security Rule that address network segmentation directly." }, "name" : "Does HIPAA require network segmentation for medical devices?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It can if rules are enforced before every clinical connection is mapped. The safer sequence is to observe device traffic first, build rules from what devices actually need, validate them with nursing and biomed, and enforce in phases, starting with the device classes that carry the most risk." }, "name" : "Will segmenting medical devices interrupt patient care?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not directly. Section 524B of the FD&C Act applies to new premarket submissions for cyber devices made on or after March 29, 2023. Devices already in service keep their original design, so hospitals still need to contain the installed base themselves." }, "name" : "Do the new FDA cybersecurity rules make older medical devices safer?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Start with the inventory: find every affected model and firmware version on the network. Then apply the manufacturer's mitigation, tighten that device's segment, and watch its traffic until a fix is applied. If no fix exists, follow the agency guidance, which may mean disconnecting the device." }, "name" : "What should a hospital do when CISA or the FDA issues a medical device advisory?" } ] } ```