Digital Health Podcast: From cyber risks to hospitals and medical devices

An open wireless network at a German hospital allowed unauthorized access to critical infrastructure, including doors leading to operating rooms and emergency departments. A whistleblower alerted media outlet heise online to the vulnerability, which was subsequently verified on site. The system relied on default credentials, with both the username and password set to “admin,” a configuration explicitly documented in the device manual. Although the hospital had been notified of the flaw earlier, staff initially ignored the warning. Action was taken only after media inquiry, though holiday schedules delayed the immediate closure of the security gap. A statement from the hospital regarding the incident has yet to be released. Martin Tettke, a former head of certification for medical devices at Berlin Cert GmbH who currently works in the network and security division of the Federal Institute for Risk Assessment, discussed the case in a digital health podcast. He described the situation as a failure across multiple levels of responsibility. Service providers should never hand over systems with standard access data intact. Hospitals, in turn, must verify that basic security requirements are met during acceptance testing. Tettke labeled this specific instance a clear organizational failure. He noted that networks for administration, medical technology, and access control require strict separation. Hospital leadership bears liability in such cases. Additional risks arise from shadow IT, where employees connect personal wireless access points to institutional networks. Representatives of the Association of Hospital IT complained in spring that many clinics lack the funds and personnel necessary to prioritize these risks effectively. Clinics need to understand which operational processes depend on specific systems. For example, the failure of an email server carries different consequences than the outage of a connected heart-lung machine. Manufacturers and service providers must consider operators’ needs, potentially using software bills of materials similar to those used in medical product development. Reports indicate that IT compliance complexity for hospitals is increasing. Information technology teams should be involved early in the procurement process for new devices. The threat landscape has shifted significantly, according to Tettke. Previously, there was sufficient time to patch vulnerabilities after disclosure. Today, organizations must immediately assess whether they have already been compromised. Patching two or three days later is likely too late. While artificial intelligence models assist attackers, they can also be utilized to audit internal networks. A recent crisis simulation by Fraunhofer researchers demonstrated the unpredictable dynamics of cyberattacks on hospitals. Rapid response requires trained personnel. Tettke argued that the high cost and scarcity of skilled workers are weak justifications for neglecting security, noting that a single security incident costs multiples of hiring one to three new employees. He recalled an experience where radiology services were down for a week at a hospital due to a technical issue.