The expansion of telehealth has fundamentally reshaped how patients access care. Video consultations, remote patient monitoring, and mobile health applications now serve as routine clinical pathways rather than experimental alternatives. Yet this digital transformation has introduced cybersecurity vulnerabilities that threaten both patient privacy and clinical safety. Healthcare organizations reported more than 700 large data breaches in 2024, affecting more than 289 million individuals.
As connected medical devices proliferate across clinical networks and into patients’ homes, the attack surface continues to expand. For device manufacturers, healthcare providers, and testing organizations seeking to address these risks, the IEEE Medical Device Cybersecurity Certification program offers a structured framework for demonstrating security compliance and reducing vulnerabilities before devices reach patients.
The Evolving Threat Landscape in Healthcare
Healthcare remains among the costliest sectors for data breaches, according to IBM’s 2025 Cost of a Data Breach Report. In telehealth, those costs can extend beyond technical recovery to include interrupted care, delayed payments, regulatory exposure, and damage to patient trust.
The 2024 ransomware attack on Change Healthcare shows how quickly a cyberattack against healthcare infrastructure can disrupt remote care. Change Healthcare supports claims processing, eligibility verification, pharmacy transactions, and other administrative workflows used by providers across the healthcare system. When its platforms were compromised, the effects reached hospitals, physician practices, pharmacies, and patients.
For telehealth providers, incidents of this kind expose a practical risk: remote care depends on systems that extend well beyond the video visit itself. Electronic payment flows, prescription processing, patient portals, remote access tools, and electronic health record integrations all create points of exposure. Phishing remains one common entry point. If an attacker compromises a clinician’s account, they may gain access to appointment schedules, patient contact information, internal telehealth links, and connected clinical systems.
Taken together, these risks show why telehealth cybersecurity must be treated as part of clinical operations, not simply as an IT support function.
Connected Medical Devices: A Growing Vulnerability
The Internet of Medical Things encompasses networked devices ranging from imaging systems and patient monitors to infusion pumps, implantable devices, and home-based wearables used for remote patient monitoring. These devices collect, transmit, and sometimes act upon clinical data, enabling continuous monitoring and more responsive care. However, the proliferation of connected devices has far outpaced the maturity of cybersecurity controls applied to them.
Recent analyses reveal the scope of the problem. The U.S. Government Accountability Office has warned that network-connected medical devices can expose patients and healthcare delivery organizations to cybersecurity risk, while the FBI has reported that more than half of connected medical devices in hospitals had known critical vulnerabilities.
Infusion pumps represent a particularly vulnerable category. A large-scale analysis of more than 200,000 infusion pumps found that 75% had one or more known security gaps, with many susceptible to critical vulnerabilities embedded in device firmware. Many pumps run legacy firmware and use hard-coded passwords, making them attractive targets for attackers seeking network access. Imaging equipment presents similar risks: PACS and DICOM systems can expose sensitive imaging data when poorly secured, and recent research has found thousands of internet-facing DICOM servers lacking basic protections.
The Contec CMS8000 patient monitor disclosure in early 2025 exemplifies how design flaws can create security gaps. The device was found to transmit patient data in plain text to a hard-coded public IP address by default, effectively creating a backdoor for data leakage. Such vulnerabilities not only expose confidential patient data but also provide remote attackers with footholds within clinical networks. Once inside, threat actors can scan for other vulnerable devices, credentials, or misconfigurations, pivoting toward higher-value targets including telehealth platforms and electronic health record databases.
Regulatory Responses and Emerging Standards
Recognizing the growing threat posed by insecure medical devices, regulators have begun strengthening cybersecurity requirements. The U.S. Congress enacted legislation in 2022 requiring that premarket medical devices with cybersecurity risk meet standards determined by the Food and Drug Administration. In response, the FDA issued updated guidance in June 2025 outlining expectations for device design, security risk management, software bill-of-materials transparency, and post-market maintenance including patching and updates.
The FDA guidance addresses Section 524B of the FD&C Act and requires manufacturers seeking clearance to demonstrate how they will maintain cybersecurity throughout the device lifecycle. This includes providing timely updates and monitoring for emerging vulnerabilities. However, critical gaps remain. The requirements apply robustly to new devices seeking premarket authorization but are not retroactively mandatory for devices certified before the 2022 law. As a result, large numbers of deployed devices, many of which are end-of-life, may harbor unaddressed cybersecurity flaws that manufacturers are not obliged to fix.
The Health Care Cybersecurity and Resiliency Act of 2025, introduced in Congress but not yet passed, seeks to strengthen cybersecurity across the healthcare sector by providing resources, incentives, and updated regulatory frameworks. The bill responds to a threat environment in which hacking-related healthcare data breaches and ransomware attacks have increased sharply in recent years. While the legislation’s final form remains to be determined, its introduction reflects growing consensus that healthcare cybersecurity requires coordinated policy interventions alongside organizational action.
Cybersecurity expectations are also maturing outside the United States. In the European Union, the Medical Device Regulation requires manufacturers to address software, IT security, and protection against unauthorized access where relevant to device safety and performance. Across Asia-Pacific markets, regulators have also issued or updated medical device cybersecurity guidance, reflecting a broader international shift toward lifecycle security, vulnerability management, and clearer cybersecurity documentation. For manufacturers operating globally, standards-based certification can help create a more consistent way to demonstrate security practices across regulatory environments.
Other IEEE standards also support this broader medical device cybersecurity landscape. IEEE/UL 2933-2024 addresses clinical IoT data and device interoperability through the TIPPSS framework: Trust, Identity, Privacy, Protection, Safety, and Security. IEEE 11073-40101-2020 focuses on cybersecurity processes for vulnerability assessment in health informatics device interoperability, while IEEE 11073-40102-2020 addresses capabilities for local-area-network-based device communication. Together, these standards show that medical device cybersecurity is not limited to a single regulation or market; it is part of a broader standards ecosystem for connected care.
Third-Party Risks and Supply Chain Vulnerabilities
Telehealth ecosystems depend heavily on external vendors for video conferencing platforms, billing services, analytics, remote monitoring devices, and mobile application development. This dependency has made third-party and supply chain risks a dominant source of healthcare breaches. Studies indicate that a significant share of healthcare data breaches originate in vendor systems or supply chains, including incidents involving business associates and third-party service providers.
The concentration of risk in third-party vendors creates cascading effects when breaches occur. A single compromised business associate can expose the records of millions of patients covered by multiple health plans and providers. In 2025, ransomware attacks on healthcare businesses — including medical billing providers, technology companies, and service partners — increased even as attacks on direct care providers slightly declined. This shift indicates that adversaries increasingly recognize that compromising a vendor serving many telehealth programs yields broader access and leverage than attacking individual hospitals.
Software supply chain attacks also surged during 2025, with threat actors compromising components, libraries, or upstream providers used by many applications. When such providers are compromised, malicious updates or backdoored components can propagate into telehealth applications and IoMT management consoles, often bypassing traditional perimeter defenses because the traffic appears to originate from trusted sources.
Protecting Telehealth Through Certification and Standards
Addressing telehealth cybersecurity requires a multi-layered approach integrating technical controls, organizational practices, and industry standards. For connected medical devices, certification programs provide a structured pathway for demonstrating security compliance and differentiating products in an increasingly security-conscious market.
The IEEE 2621 series of standards, developed by a conformity assessment committee comprising manufacturers, clinicians, FDA representatives, test laboratories, and cybersecurity solutions providers, establishes security requirements and evaluation frameworks for connected medical devices. The FDA has designated IEEE 2621.2 as a Recognized Consensus Standard, and the IEEE 2621 test and evaluation process addresses the FDA’s most recent cybersecurity considerations. Certification to IEEE 2621 is intended to support device manufacturers’ premarket submissions, potentially decreasing time to approval while demonstrating adherence to security best practices.
Beyond device certification, healthcare organizations must implement comprehensive security programs. This includes conducting regular risk analyses that explicitly consider telehealth workflows, enforcing strong identity and access management with multi-factor authentication, and maintaining robust vendor risk management practices. Network segmentation and zero-trust architectures reduce the potential for lateral movement from compromised IoMT devices into telehealth platforms and electronic health records. Given the high prevalence of end-of-life devices, compensating controls such as network isolation, access restrictions, and enhanced monitoring become essential.
Building Resilience in Remote Care
The promise of telehealth depends on sustaining patient trust in the privacy, reliability, and continuity of remote care. As telehealth programs become more connected to devices, platforms, vendors, and clinical workflows, cybersecurity becomes part of the infrastructure that supports safe and dependable care.
For device manufacturers navigating this landscape, the IEEE medical device cybersecurity certification program provides a pathway for demonstrating security practices that align with recognized requirements and evaluation criteria. As medical device cybersecurity expectations continue to mature, certification can help manufacturers communicate readiness to healthcare providers, regulators, and other stakeholders.
Building resilient remote care will require sustained attention across the healthcare ecosystem. Providers, vendors, manufacturers, and regulators each have a role in reducing risk, strengthening oversight, and supporting secure connected care.
