Segmenting medical devices without breaking clinical workflow

A significant proportion of connected medical equipment runs operating systems that stopped receiving security updates years ago, and cannot be updated without invalidating regulatory certification. This is not negligence; it is how medical device approval works.

Any security model that depends on patching these devices is therefore not a model. The realistic goal is containment: assume the device is compromisable and design so that compromise does not propagate.

The first obstacle is that nobody has an accurate inventory. Biomedical engineering holds one list, IT holds another, and neither includes the infusion pump that estates installed in 2019.

Passive network discovery over a full clinical cycle — including weekends and night shifts — reliably finds devices that appear on no register. Four weeks of passive observation before any design work is the highest-value phase of the project.

The instinctive design segments by device category — all infusion pumps here, all imaging there. In practice this cuts across clinical workflows and generates rule exceptions until the segmentation is meaningless.

Segmenting by clinical function instead, so that a care pathway's devices and the systems they talk to sit in the same zone, produces far fewer cross-zone flows and a rule base a human can still read in two years.

In a hospital, a security control that blocks clinical traffic during an incident is itself a clinical incident. Segmentation must be designed to fail open, with monitoring and alerting rather than automated blocking on the clinical path.

This is an uncomfortable conversation with a security team used to automated containment, and it needs to happen at design stage with clinical leadership present rather than being discovered at 3am.