Smart Security: Protecting Embedded Medical Devices For A Safer Tomorrow

Healthcare IoT Panel Introduction

Health-ISAC moderator Phil Angler hosts practitioners from Intuitive Surgical, Insulet, Somerset Recon, and Kaiser Permanente on securing embedded medical devices where patients—not just data—are in the threat path. Panelists span surgical robotics, insulin pumps, penetration testing, and health-system deployment.

Patient-Researcher Origins

Jay Radcliffe describes reverse-engineering his own Medtronic and Animas insulin pumps, talks that helped push FDA attention toward device cybersecurity. As a lifelong type-1 diabetic and now Insulet product security officer, he emphasizes life-safety stakes for devices keeping family members alive.

Hospital Defender Challenges

Kaiser Permanente's Michael Nguyen explains tailoring security controls per device type, partnering with manufacturers, validating implementations in limited test environments, and carefully deploying changes without disrupting clinical workflows. Costly devices and constant clinical use make comprehensive lab replicas difficult.

FDA Authority and Manufacturer Response

Congress granted FDA statutory cybersecurity authority in 2022 beyond traditional safety reviews. Intuitive's Melton Osoy details how Da Vinci surgical robot teams map FDA guidance to authentication, authorization, secure firmware update, and logging requirements for submissions, while hospitals increasingly demand SBOMs and documented controls from vendors.