The Future of Healthcare: Connected medical devices and healthcare resilience

Connected medical devices are now a fundamental part of healthcare delivery. The World Health Organisation estimates there are 2 million categories of medical devices globally. From diagnostic imaging and patient monitoring technologies to other network-connected clinical systems, these devices support increasingly digital and data-driven models of care. However, greater connectivity also introduces additional cyber security challenges for healthcare organisations.

Key Challenges

NHS guidance recognises that connected medical devices often cannot be managed in the same way as traditional IT assets. Devices may have long operational lifecycles, rely on legacy operating systems and be subject to restrictions on patching and updates. Security updates which involve software modifications require thorough manufacturer assessment, validation and approval in line with regulatory requirements before deployment, and some devices may remain in use after manufacturer support has ended. 

As a result, healthcare organisations often need to consider alternative mitigations where vulnerabilities cannot be addressed through routine patching, such as minimising device access to high-risk entry points including email or web browsing or segmenting the organisation’s network. Medical device manufacturers may see more robust cyber security provisions in service contracts around periodic software updates, ongoing monitoring and logs, and rapid incident response action.

The consequences of these risks extend beyond information security. NHS England notes that “Security incidents affecting connected medical devices can result in significant disruption to healthcare services.” For healthcare providers, it is therefore important to understand not only which devices are connected to their networks, but also the clinical services that depend on them. Medical device manufacturers, local distributors and third-party service providers are also a key part of the picture, particularly where organisations rely on them for updates, support and ongoing device management.

Wider Implications

This is particularly relevant as the NHS continues its transition to a Cyber Assessment Framework (CAF)-aligned Data Security and Protection Toolkit (DSPT). The emphasis is increasingly on understanding critical assets, dependencies and risks, and on maintaining resilient services. Connected medical devices are an important part of that picture, particularly where they support critical clinical functions.

Many connected medical devices will process personal data, including special category health data, bringing data protection considerations alongside cyber security and resilience requirements. Where they do, organisations must implement appropriate technical and organisational measures to protect that data and comply with their obligations under data protection law. However, the challenge is broader than data protection compliance alone. Effective oversight of connected medical devices requires collaboration between clinical, engineering, cyber security, procurement and information governance teams, as well as suppliers and maintainers who may have access to devices and supporting systems.

As healthcare continues to embrace connected technologies, organisations that maintain visibility of connected devices, understand associated dependencies and manage risks throughout the device lifecycle will be better placed to maintain secure and reliable healthcare services. NHS trusts, foundation trusts, integrated care boards as well as private healthcare providers and upstream global medical device manufacturers will all come under pressure to meet a higher industry standard of cyber security resilience as the industry matures.

Key takeaways

• Healthcare organisations need a clear understanding of which medical devices are connected to their networks, who supports them and the services that depend on them. Asset visibility is a key theme running through the NHS guidance.

• Connected medical devices often cannot be managed in the same way as traditional IT assets. Long device lifecycles, legacy operating systems and manufacturer-controlled updates can mean that cyber risks need to be managed through a combination of patching and other mitigating controls.

• Security incidents affecting connected medical devices can cause significant disruption to healthcare services, making them an important consideration for operational resilience as well as cyber security.

• The move towards a CAF-aligned approach across the NHS reflects an increasing emphasis on understanding critical assets, dependencies and risks, and on maintaining resilient services.

• Effective management of connected medical devices requires input from clinical, engineering, procurement, cyber security and information governance teams, as well as suppliers and maintainers where appropriate. This reflects the NHS guidance's focus on managing security throughout the device lifecycle.

As part of this series, Burges Salmon, KPMG and techUK will bring together senior leaders from across the healthcare sector on 4 November 2026 to discuss these challenges in an interactive workshop covering cyber and AI, supply chain assurance, the legislative landscape, recovery planning and clinical safety.

For queries about the event, or advice on the content of this article, please contact Hamish Corner, Lucy Pegler, Amanda Leiu or another member of the Commercial & Technology team.