By Nadia ElKaissi
Picture this: It’s 2 a.m. in a busy emergency department. Trauma bays are full; you hear infusion pumps alarming and then the pumps begin losing their network connection one by one. Clinicians look around and ask, “How do we treat patients when everything is going down?” What they don’t realize yet is that this is not a routine network glitch. It’s the beginning of a cybersecurity attack.
This is exactly the kind of scenario the Cybersecurity and Infrastructure Security Agency (CISA) is urging healthcare delivery organizations (HDOs) to prepare for. CISA’s latest guidance on vendor outage preparedness is a reminder that cybersecurity outages aren’t just possible, they are now expected. The agency is encouraging hospitals to be ready to continue caring for patients even when key systems go dark. It’s a timely nudge that healthcare must remain safe and functional, even when the digital world gets messy. And for healthcare technology management (HTM) professionals, the message is clear: failing to prepare for cybersecurity threats is a direct patient safety risk.
CYBERSECURITY EMERGENCIES ARE CLINICAL EMERGENCIES
For years, HDOs treated cybersecurity primarily as an information protection problem. Today, however, medical devices, such as patient monitors, imaging equipment, and infusion pumps, are more dependent on clinical networks, cloud environments, remote vendor platforms and electronic health records. When a cybersecurity incident occurs, the impact can cascade from the server room to the patient’s bedside within minutes.
All it takes is a ransomware attack, a misconfigured firewall or even a compromised vendor platform, to interrupt critical workflows. HDOs must prepare not only for the attack itself, but also for how they will keep essential clinical systems operational and safe during the attack.
HTM IS EVOLVING
HTM departments typically focus on preventative maintenance, device/system uptime and device life cycle management. Those responsibilities still are essential, but now they must add cybersecurity. HTM should be able to answer the following questions:
• Which devices are mission critical?
• Which systems require cloud or Internet connectivity to function?
• Which workflows can continue during downtime?
• Which cybersecurity controls could inadvertently disrupt clinical care?
BE PREPARED
1. Identify Your High-Risk Clinical Systems: Not all medical devices carry the same level of clinical or operational risk. A smart refrigerator or a temperature monitor is not the same thing as an ICU ventilator or physiologic monitor. HTM should work with cybersecurity, clinical engineering and clinical teams to prioritize systems and determine which items are required during an outage. Once these systems are evaluated, each system should have appropriate monitoring, network segmentation, backup strategies and a defined downtime preparedness plan.
2. Understand “Degraded Mode” Operations: A major gap in cybersecurity preparedness is understanding how devices behave when the network is down. HTM should have a strong understanding of how the medical devices/systems function and whether they can function safely offline. HTM should evaluate how devices/systems react during an outage.
• Does it lose features or interoperability?
• Does it stop alarming remotely?
• Does it require cloud authentication?
• Does it depend on middleware?
• Does it require vendor connectivity for operation or troubleshooting?
A device may still power on during a cybersecurity event yet be clinically unsafe or significantly impaired. This is why HDOs should conduct tabletop exercises and technical testing to understand exactly how their systems behave under degraded network conditions.
3. Strengthening Medical Device Segmentation: Flat networks are still one of healthcare’s greatest cybersecurity weaknesses. Proper segmentation prevents a compromise in one area from spreading into critical clinical systems. HTM should partner with cybersecurity teams to:
• Isolate high-risk medical devices
• Limit Internet access
• Control vendor remote access pathways
• Validate firewall rules
• Monitor anomalous traffic patterns
• Implement least-privilege network access
4. Prepare for Vendor Outages: Many HDOs assume that vendors will always be reachable during an emergency. However, recent industry events have shown that this isn’t always the case. HTM teams must be prepared to respond even when vendor support is unavailable. To do this effectively, they should be asking questions such as:
• What happens if the vendor Virtual Private Network (VPN) goes offline?
• Can the device safely operate without cloud connectivity?
• In the event of a cybersecurity breach, how are software updates delivered during an outage?
• Is there a local support mode?
• Are backup procedures documented?
• Who has administrative access to servers/workstations/systems? Are you able to access these systems during an outage?
• How long can operations continue independently.
Every vendor dependency becomes a potential operational dependency during a cybersecurity emergency.
5. Build and Practice Downtime Procedures: A binder sitting on a shelf does not mean an HDO is prepared for a cybersecurity event. Effective downtime readiness includes realistic workflows, clear responsibilities, printed procedures, recovery checklists, escalation pathways and secure local credentials. More importantly, these procedures must be practiced regularly. If staff have never operated without networked systems, the first cybersecurity emergency becomes the training exercise, and that is not where any hospital wants to be.
6. Know Your Asset Inventory Before a Crisis: During cybersecurity incidents, one of the first questions that is asked is, “What systems are affected?” HDOs without accurate medical device inventory lose valuable time trying to identify impacted systems, operating systems, software versions, locations and communication pathways. HTM should maintain:
• Accurate inventories
• Device ownership
• Software/firmware version
• Network communication requirements
• Vendor contact information
• Remote access methods
• Known vulnerabilities
THE CYBERSECURITY FIRE DRILL ERA IS HERE
Healthcare is entering a new phase where cybersecurity preparedness must be treated with the same urgency as fire drills, emergency power testing and disaster response planning. CISA’s warning isn’t theoretical, hospitals should fully expect cybersecurity disruptions. The organizations that recover the fastest won’t be the ones with the most advanced technology, but the ones that have practiced and planned for operational continuity. And in that preparation, HTM belongs at the frontline, ensuring that critical clinical systems stay safe and functional when the unexpected happens.
