When the device is the patient's weak point: healthcare's cyber risk has become a liability question
In 2015 two security researchers, Charlie Miller and Chris Valasek, took control of a Jeep Cherokee from a laptop miles away. They got in through the entertainment system and, once inside, could work the engine, the transmission and the brakes. Chrysler recalled 1.4 million vehicles. The lesson was not about cars. It was that anything connected to a network can be reached through its least important part, and that the least important part is usually the one nobody secured.
Healthcare has been learning the same lesson since, at a cost that keeps rising. This article is about what the attacks of the past decade have in common, why connected medical equipment is the exposure most providers underestimate, and why the question has moved from the IT department to the insurance file.
The attacks that changed the conversation
WannaCry, May 2017. A ransomware worm spread through unpatched Windows machines in more than 150 countries. Britain's National Health Service was one of the largest victims: around 19,000 appointments and operations were cancelled, ambulances were diverted, and some hospitals went back to pen and paper for days. The patch that would have stopped it had been available for two months.
The St. Jude Medical pacemakers, 2017. The FDA confirmed that a line of implanted pacemakers could be reached wirelessly and, in theory, made to run the battery down or deliver the wrong pacing. Abbott, which had bought St. Jude, issued a firmware update for roughly 465,000 devices already in patients' chests. Nobody was harmed, but a medical device had been recalled for a software vulnerability, and that had not happened before.
Change Healthcare, February 2024. A ransomware attack on the clearing house that processes a large share of U.S. medical claims stopped payments to pharmacies, practices and hospitals across the country for weeks. UnitedHealth later said the personal data of about 190 million people had been exposed, the largest healthcare breach on record, and that the attackers got in through a remote access portal with no multi-factor authentication.
Ascension, May 2024. A ransomware attack on one of the largest hospital systems in the country took electronic health records offline at about 140 hospitals. Ambulances were diverted, procedures were postponed, and clinicians charted on paper for weeks.
Four incidents, one pattern: the attackers did not need to defeat the hospital's best defences. They needed one unpatched machine, one portal without a second factor, one device whose maker had not thought about an adversary.
Why connected devices are the exposure providers underestimate
A modern facility runs on equipment that talks to the network: infusion pumps, bedside monitors, imaging systems, ventilators, the badge readers on the doors, the HVAC. Each one is a computer. Most were designed to be reliable for a decade, not to be patched every month, and many run operating systems their makers no longer support.
That creates two separate problems:
- Data. Every connected device is a route to the records system, and the records system is what the attackers want. Patient data sells, and a hospital that cannot see its own records will pay to get them back.
- Safety. A compromised pump or monitor is not a privacy incident. It is a patient-safety incident, and a claim arising from it looks like a malpractice claim, not a data-breach claim.
The IT department sits in the middle of this with a job that has grown faster than its budget: securing the records system, keeping hundreds of devices from a dozen manufacturers patched, and defending against attackers who are, increasingly, organised businesses or state-backed groups rather than hobbyists. In most organisations we insure, that department is smaller than the exposure it is holding.
What has actually helped
The incidents above point to the same short list, and it is not exotic:
- Multi-factor authentication on every remote access point. The Change Healthcare attack came through a portal that did not have it.
- Patching on a schedule, with a plan for the devices that cannot be patched. WannaCry ran on machines two months behind. Equipment that cannot be updated gets isolated on its own network segment.
- An inventory of connected equipment. You cannot secure a device you do not know you have, and most facilities find more on the network than they expected the first time they look.
- Backups that are offline and tested. Ransomware is a business model; the organisations that recover quickly are the ones that could restore without paying.
- A rehearsed plan for running on paper. Ascension's clinicians did it for weeks. The question is whether yours could do it for a day.
A note on blockchain, which was being proposed as a fix for healthcare data integrity a few years ago: it has not arrived. Tamper-evident records are a real idea, but no mainstream health system runs on a distributed ledger, and the breaches above would not have been prevented by one. The list above is where the money goes.
Why this is now an insurance question
When a connected device fails or an algorithm gets it wrong, the first question after the patient's welfare is who answers for it: the hospital that deployed the device, the manufacturer that wrote the firmware, the software vendor whose update introduced the fault, the IT contractor who configured the network, or the clinician who relied on the output. The honest answer is that the claim will name all of them and let the courts sort it out.
For a provider, that means two policies have to work together:
- Cyber liability responds to the breach itself: the forensic investigation, the notification of patients, the regulatory response, the ransom negotiation if it comes to that, and the business interruption while systems are down. Cyber carriers now ask about multi-factor authentication, backups and endpoint protection before they quote, and decline or surcharge when the answers are weak.
- Professional liability responds to the patient who was harmed when the systems failed. A claim that a diagnosis was missed because the records were unavailable, or that a device delivered the wrong dose, is a malpractice claim whatever its cause.
The gap between the two is where the arguments happen. A cyber policy may exclude bodily injury; a malpractice policy may exclude losses arising from a cyber event. Read both for the words "bodily injury" and "cyber" and see which way each one points. Where a facility relies on outside IT contractors or software vendors, their errors and omissions cover and the indemnities in their contracts are part of the same picture.
The future of healthcare is connected, and the future of its liability is connected with it. That is not a reason to slow down. It is a reason to know, before the incident, which policy will answer for which failure.
