Networked Medical Devices Keep Failing HIPAA Security Audits

OCR opened 29 enforcement actions in 2025 and resolved 13 with settlements averaging $750,000 each. In roughly half of those cases, the initial access point was not the EHR software or the staff email. It was an imaging workstation running an unpatched operating system, a blood pressure kiosk with its admin password still set to the factory default, or a tablet in an exam room that had not been reviewed since the day it was purchased.

Most practice administrators know their HIPAA obligations at a general level. They know the EHR vendor has signed a business associate agreement. They know staff need annual training. What most do not think about is the ultrasound machine in exam room two, the digital X-ray system connected to the same office network as billing, or the patient check-in kiosk that has not been updated in three years. Those devices are covered by the HIPAA Security Rule, and most practices have no policies governing them.

The HIPAA Security Rule requires covered entities to implement technical safeguards on every device that creates, receives, maintains, or transmits electronic protected health information. That includes medical devices. Your device vendor's business associate agreement covers their application software. What the device connects to, how it is configured on your network, and whether someone has changed the admin password: that is your responsibility.

Key Takeaways

• The HIPAA Security Rule covers every device that touches ePHI, not just your EHR software.
• Most medical devices run embedded operating systems that manufacturers rarely update, and some never will.
• Practices must maintain a complete device inventory as part of the required risk analysis.
• Network segmentation limits the damage when a clinical device is compromised, keeping it off your billing and scheduling systems.
• Your device vendor's BAA does not cover how you deploy or configure the device on your network.

What Counts as a "Device" Under the HIPAA Security Rule?

The Definition Is Broader Than Most Practices Realize

The HIPAA Security Rule covers any electronic information system that stores, processes, or transmits electronic protected health information. In a clinical setting, that definition covers a lot of ground. Your EHR workstations are included. So is the ultrasound machine. The digital X-ray system. The patient check-in tablet. The ECG machine in cardiology. The PACS server in the back office. The portable patient monitor that syncs to a shared workstation.

Dermatology practices have particular exposure here. Dermoscopy camera systems log clinical photos linked to patient records. Laser treatment systems record procedure notes and dosing data. A practice with two or three locations often has eight to ten pieces of imaging equipment connected across those sites, each with its own firmware, its own admin interface, and its own update history. Most have no documentation of when firmware was last updated.

Orthopedic and cardiology practices face similar inventory challenges. A mid-size orthopedic group running C-arm imaging, PACS, and bone density equipment across a main office and two satellite locations can easily have fifteen or more devices in scope for HIPAA technical safeguards. Most of those devices were configured by a vendor rep who set them up for clinical use and left. Network security was not on the checklist.

What the BAA Does and Does Not Cover

Business associate agreements with device manufacturers cover the software and services the manufacturer controls. The agreement says the vendor will protect ePHI in their system. It says nothing about how you connect the device to your office network, what segment it sits on, or whether your firewall rules prevent it from reaching systems it has no business touching. That gap is your responsibility under the Security Rule, and it is the gap OCR investigators look for first.

Actionable tip: Pull the business associate agreement for your three most recently installed clinical devices and find the scope section. If it says "vendor's systems" or "vendor's platform," it does not cover your network configuration. List those devices for a security review.

Why Medical Devices Do Not Get Patched Like Software

FDA Clearance Creates a Patching Problem

Software vendors ship security updates when they find vulnerabilities. Medical device manufacturers often cannot. The FDA clears a device for a specific hardware and software configuration. Changing the operating system or applying a major patch to a cleared device can require a new 510(k) submission. That process can take months and cost more than the device's remaining useful life justifies.

The result is medical devices deployed in clinical settings running Windows 7, Windows XP, or Windows Embedded versions that Microsoft stopped supporting years ago. A 2024 analysis by Claroty found that 63% of networked medical devices in surveyed healthcare environments had known unpatched vulnerabilities, with imaging systems showing the highest rate. When Microsoft ended support for Windows 7 in January 2020, many device manufacturers told customers that updates were not available and offered extended support contracts instead of patches.

That is not a criticism of the manufacturers. The regulatory framework makes rapid patching difficult. But it means practices cannot assume a HIPAA-covered device is a secure device just because the manufacturer has a good reputation or the system cost $80,000.

Default Credentials Left in Place

Medical devices ship with default usernames and passwords published in manufacturer documentation. An imaging system that arrives with admin credentials of "admin/admin" or a four-digit default PIN needs those changed before it goes live on a clinical network. Most vendor installers configure the device for clinical function and leave network security to the IT team, which sometimes does not hear about the install until weeks later.

I sat down with a practice administrator at a dermatology group in Doral last spring. She had just renewed her cyber insurance and was confident her practice was covered. When I asked how many devices on the network she could name from memory, she got to seven and stopped. The actual number, after we walked the building together, was twenty-three. Six had default admin credentials that had never been changed. Three were running operating systems with known critical vulnerabilities. None appeared in any documentation she could find.

Actionable tip: Ask your IT support or device vendor for the factory-default admin credentials for every clinical device on your network. If your current credentials match the factory defaults, change them before the end of this week.

What OCR Finds During a HIPAA Investigation

Technical Safeguard Gaps That Produce Findings

The HIPAA Security Rule's technical safeguard requirements include access controls, audit controls, integrity controls, and transmission security. When OCR investigates a breach, investigators look for documented policies covering each of these areas and for evidence that the policies extend to all covered devices, not just the EHR software.

Access controls mean that devices displaying or processing ePHI require authentication. An imaging workstation that auto-logs in to the reading software when the room computer boots fails this standard. Audit controls mean the device logs who accessed what and when. Many older devices either do not generate audit logs or generate logs no one has configured to review. Transmission security means ePHI in transit is encrypted. Devices communicating over plain HTTP to a PACS server are out of compliance.

A complete HIPAA compliance program requires a risk analysis that inventories every information system handling ePHI. If a device is not in the inventory, it cannot appear in the risk analysis. If it is not in the risk analysis, OCR treats any related breach as evidence that the covered entity did not identify its own exposure.

The Device Inventory Most Practices Are Missing

OCR's Phase 2 audit protocol asks explicitly for an inventory of electronic information systems and the ePHI they contain. Practices that cannot produce one typically receive a finding before auditors look at anything else. A spreadsheet with device name, model, OS version, network location, and last reviewed date meets the requirement. The bar most practices fail is having one at all.

A reasonable device inventory covers every workstation, server, and clinical device in scope. It notes the operating system version and the date it was last checked against vendor patch status. It identifies the person responsible for each device's security configuration. For devices whose manufacturers no longer provide updates, it notes the compensating control: network isolation is the most common choice.

Actionable tip: Set a calendar reminder for 90 days from today to walk your practice and confirm your device inventory matches what is live on your network. Include any device that creates, stores, or transmits patient information, including the check-in tablet in the waiting room.

Practices ready to know exactly where they stand can start with a free IT and compliance assessment from Gradient Data Solutions. We scan the network, review the device inventory, and give you a plain-language report of what HIPAA requires you to address.

Network Segmentation: The Control That Works When Patching Cannot

What Segmentation Does for a Clinical Network

If a clinical device runs an unpatched operating system the manufacturer will not update, your options are to replace it, document the accepted risk, or isolate it from systems it does not need to reach. Network segmentation is the isolation option, and it is the most common compensating control for legacy medical devices.

Segmentation puts your clinical devices on a separate network segment, a VLAN, with restricted access to the rest of your network. Your imaging VLAN can reach your PACS server and your EHR API, but it has no path to your billing software, your email server, or general office workstations. If an imaging system is compromised, the attacker is contained to the clinical segment rather than reaching billing or scheduling.

A managed IT engagement for a three-location practice typically includes configuring VLANs for clinical devices, office systems, and guest wireless. The clinical VLAN's firewall rules allow outbound traffic only to named destinations: the PACS server, the EHR gateway, and the domain controller. Everything else is blocked.

Cyber Insurance Asks About This

Underwriting questionnaires for cyber insurance in healthcare have added specific device-security questions since 2024. Carriers ask about network segmentation, patch management programs, and medical device inventories. A practice that answers "no" to those questions pays a higher premium, gets coverage exclusions for device breaches, or both.

The Anne Arundel Dermatology case settled for $2.4 million in April 2026 after a breach affecting 1.9 million patients traced to misconfigured devices and access controls that did not prevent lateral movement. Whether the settlement came from OCR enforcement, civil litigation, or both, the operational lesson is the same: the questions on your renewal questionnaire describe what your insurer expects you to have in place. If your current environment does not match your last application, fix that before you renew.

Practices that want to verify their coverage posture before the next renewal can start with a healthcare IT assessment from GDS. We compare your current controls against your last questionnaire answers and flag anything that could create a coverage dispute.

How to Build a HIPAA-Ready Medical Device Program

Start With an Inventory, Then Write the Policy

HIPAA enforcement is documentation-heavy. Having the right controls matters. Being able to prove you have them matters more. Start with a device inventory, then a written policy governing device security, then the technical controls that implement the policy.

A written device security policy for a medical practice does not need to be long. It should cover what counts as a covered device, who is responsible for maintaining the inventory, how new devices are added to the network, how devices are decommissioned including data wiping, and what happens when a device reaches end-of-OS-support. Five to seven pages is enough for most practices.

The policy needs to connect to your risk analysis. Each device class in your inventory should have a corresponding entry that identifies the threat, the likelihood, the impact, and the control. If your imaging systems run an end-of-life OS, the entry acknowledges that risk and identifies network isolation as the compensating control. That documentation is what OCR looks for during an investigation: evidence that you knew the risk and addressed it deliberately, not that the risk never existed.

Put It on the Cybersecurity Review Calendar

Device security is not a one-time project. Devices get added, upgraded, and replaced. A staff member leaves and their credentials on three clinical systems are never removed. A vendor does a remote-access update and your firewall rules no longer match your diagram. The inventory and the policy need a review date, not just a creation date.

For imaging-heavy practices in orthopedics, dermatology, or cardiology, a quarterly device check takes less than an hour and keeps the inventory current. Annual is the minimum the Security Rule requires. Twice a year is reasonable for any practice with more than ten devices in scope.

Get a Clear Picture Before Your Next Renewal

Most practices find their real device inventory during an incident. A free assessment from Gradient Data Solutions covers a network scan, a device inventory review, and a report of what HIPAA requires you to address before OCR or your insurer asks. No commitment required.

Frequently Asked Questions

Does my device vendor's BAA cover how the device connects to my network?

No. Your vendor's business associate agreement covers the software and data they control. Network configuration, segmentation, and access controls are your responsibility under the HIPAA Security Rule.

What if my imaging vendor says the device is secure?

Security certifications from the manufacturer cover the device firmware and application software as they leave the factory. How you deploy the device on your network is your responsibility: what it can reach, who has admin access, whether default credentials have been changed.

Does HIPAA require us to replace devices running old operating systems?

Not automatically. The Security Rule requires you to identify the risk and implement reasonable safeguards. Network isolation is an accepted compensating control for a device that cannot be patched. What OCR requires is a documented risk analysis that shows you know the vulnerability exists and have addressed it with a control.

Our practice has six exam rooms. Does this apply to small practices?

Yes. Practice size does not change your HIPAA obligations. OCR has settled enforcement actions with solo practices and small groups. The size of the penalty can vary, but the requirement to inventory and protect ePHI-handling devices applies to every covered entity.

How often do we need to review our medical device security?

At minimum annually, and any time you add a new device, change a device's network configuration, or sign a new vendor agreement. For imaging-heavy practices in orthopedics, dermatology, or cardiology, a twice-yearly device audit is a reasonable cadence.