A modern hospital network carries traffic from infusion pumps, anesthesia machines, MRI consoles, lab automation, pharmacy robotics, building HVAC, security cameras, and patient-monitoring devices in addition to traditional IT. Most of those devices were not designed for the network they ended up on. Many are FDA-regulated as medical devices, with safety, availability, and patching constraints that ordinary IT controls do not respect.
For years, the operational gap between IoMT and IT cybersecurity was filled by hospital biomedical engineering on one side and IT security on the other, with predictably uneven results. That gap is closing. FDA’s 2026 cybersecurity guidance, section 524B of the Federal Food, Drug, and Cosmetic Act, NIST SP 800-82 Rev. 3 for OT security, and NIST SP 800-213 for IoT device cybersecurity capabilities now converge on a single operational expectation: connected medical devices must be inventoried, segmented, monitored, and patched in coordination with their clinical use, not as if they were ordinary IT.
This post walks through what each authority requires, how they overlap, and what a defensible IoMT segmentation program looks like in 2026.
Why Medical-Device Cybersecurity Has Its Own Logic
Three operational constraints make medical-device cybersecurity different from IT cybersecurity:
Patient safety is a first-class severity dimension. A vulnerability that would be patched on a hospital workstation overnight cannot be patched on an in-use ventilator or monitoring device the same way. Cybersecurity decisions must be coordinated with clinical operations to avoid creating safety incidents.
Device lifecycle exceeds support lifecycle. A 15-year-old infusion pump may still be in clinical use, running an OS that has not received security patches in a decade. The IT-style “decommission unsupported devices” approach often is not available.
Device identity is rarely under hospital control. Most medical devices are manufacturer-controlled. Patches, firmware, identity issuance, certificate management, and configuration are vendor-driven. Hospital security teams must negotiate with manufacturers more than they configure devices directly.
These constraints do not waive cybersecurity expectations. They reshape them. The federal authorities below reflect that reshaping.
What FDA’s 2026 Cybersecurity Guidance Requires
FDA’s 2026 medical-device cybersecurity guidance (a final guidance document) operationalizes section 524B of the Federal Food, Drug, and Cosmetic Act, which Congress added in late 2022. The guidance covers cyber-device premarket submissions and applies to devices with cybersecurity considerations.
The most operationally consequential expectations:
- Cybersecurity management plans that describe how the manufacturer will identify, communicate, and respond to vulnerabilities throughout the device’s market life.
- Software bills of materials identifying all third-party software components in the device.
- Threat modeling specific to the device’s clinical use and connected environment.
- Cybersecurity testing with results documented in the submission.
- Labeling that includes cybersecurity-relevant information for the operator.
- Plans for managing vulnerabilities and exploits including update and patch processes.
These are manufacturer-side requirements, not hospital-side requirements. But they shape what hospitals can ask for during procurement and what evidence they can collect for their own HIPAA risk analyses.
What NIST SP 800-82 Rev. 3 Adds for OT-Adjacent Medical Devices
NIST SP 800-82 Rev. 3 (Stouffer et al., 2023) is the federal OT security guide. Many medical devices are OT-adjacent: imaging systems with industrial control components, lab automation tied to building HVAC and pharmacy automation, patient-monitoring infrastructure with availability requirements that match SCADA more than enterprise IT.
SP 800-82 Rev. 3 brings four operational concepts into IoMT thinking:
- Safety, availability, and integrity priorities differ from confidentiality-first IT. Patching that creates an outage during clinical operations may produce more harm than the vulnerability it addresses.
- Network segmentation between IT and OT zones is a baseline expectation. Medical-device networks should be segmented from clinical workstation networks, which should be segmented from administrative networks.
- Change management requires coordination with clinical operations. Routine IT change windows do not work for devices in active patient use.
- Incident response treats clinical availability as a severity dimension. A ransomware incident that affects a patient-monitoring system is materially different from one that affects an email system, and the response should reflect that.
For hospitals operating both medical devices and OT-adjacent building systems, SP 800-82 Rev. 3 is the operational reference.
What NIST SP 800-213 Adds for Device Acquisition
NIST SP 800-213 (Fagan et al., 2021) identifies cybersecurity capabilities that organizations should consider when acquiring connected devices. The capability categories — device identification, configuration, data protection, logical access, software update, cybersecurity state awareness, and cybersecurity incident detection — give procurement a defensible question set rather than vendor-specific or ad hoc lists.
For IoMT acquisition specifically, SP 800-213 capabilities translate to procurement questions like:
- Can this device produce a unique identifier under hospital control?
- Can the device be configured securely from the hospital’s own configuration management?
- Is data at rest and in transit encrypted, and with what algorithms?
- Are administrative interfaces protected by phishing-resistant authentication?
- What is the manufacturer’s update cadence and emergency-patch process?
- What telemetry does the device emit for cybersecurity monitoring?
- What incident detection capabilities are built in?
These questions are also exactly what FDA’s section 524B and the 2026 guidance expect manufacturers to be able to answer.
A Defensible IoMT Segmentation Program
Three artifacts and three operational practices make up most of what an OCR investigation, an FDA-aligned procurement review, or a HIPAA Security Rule NPRM readiness assessment will look for.
The unified asset register. Every connected medical device, IoT device, OT device, and adjacent system in scope. Each record carries device identity, manufacturer, FDA cyber-device status, clinical use, network zone, segmentation context, vendor risk tier, patching status, SBOM availability, and clinical-availability impact tier. This is anchor artifact #2 in the single-artifact, multi-authority evidence engineering framing.
A segmentation diagram. A current network architecture diagram showing zones, between-zone controls, identity boundaries, and the placement of medical-device traffic. NIST SP 800-207 zero trust principles (Rose et al., 2020) inform the design even when implemented incrementally.
A clinical-safety-aware patching policy. Patching cadence by device class, with explicit coordination procedures for in-use clinical devices. Includes manufacturer-coordinated patches, emergency patches, and the documented rationale for any deferred patches.
The operational practices: vendor cybersecurity questionnaires aligned to NIST SP 800-213 capabilities, secure remote vendor access (no flat VPN tunnels into clinical networks), and incident handling that treats clinical availability as a first-class severity dimension.
How This Connects to the HIPAA NPRM and OCR Enforcement
The HIPAA Security Rule NPRM proposes asset-inventory, network-mapping, vulnerability-management, and segmentation requirements that apply directly to IoMT environments even though the NPRM does not separately classify medical devices (HHS, 2025). A hospital that has a unified IoMT asset register, a current segmentation diagram, and a clinical-safety-aware patching policy is materially aligned with the NPRM’s IoMT-relevant safeguards.
OCR’s Risk Analysis Initiative settlements have not yet centered specifically on IoMT, but the pattern is consistent with where the Initiative is going. Risk-analysis failures around IoMT are the kind of finding the NPRM would explicitly enable. See OCR’s Risk Analysis Initiative and the Cascade Eye Settlement for the broader enforcement pattern.
What to Ask Vendors
Four questions cover most of the procurement-side IoMT conversation:
- Is this device subject to section 524B cyber-device submission requirements? Where can we review your cybersecurity management plan and SBOM?
- What is your published vulnerability disclosure and patch cadence? What is the emergency patch process?
- What network architecture do you support? Can the device operate behind explicit-deny segmentation with controlled outbound access?
- What identity and authentication does the device support? Can it integrate with our IAM, or does it require a vendor-managed authenticator?
Vendors that cannot answer these questions are vendors that will produce the next IoMT-driven OCR finding.
What to Track
Three signals matter through 2027:
- FDA cyber-device submission patterns and any updates to the 2026 guidance.
- HIPAA Security Rule final rule provisions on asset inventory, segmentation, and vulnerability management for ePHI environments.
- OCR Risk Analysis Initiative settlements that specifically reference IoMT-related deficiencies.
IoMT cybersecurity is one of the few areas where federal authorities, peer-reviewed scholarship (Ali et al., 2024), and operational practice are converging on the same operational expectation. The convergence is making IoMT compliance more demanding and more defensible at the same time.
Sources
- FDA. (2026). Cybersecurity in medical devices: Quality management system considerations and content of premarket submissions (final guidance).
- Stouffer et al. (2023). NIST SP 800-82 Rev. 3, Guide to Operational Technology Security.
- Fagan et al. (2021). NIST SP 800-213, IoT Device Cybersecurity Guidance.
- Boyens et al. (2022). NIST SP 800-161 Rev. 1, C-SCRM.
- Rose et al. (2020). NIST SP 800-207, Zero Trust Architecture.
- HHS. (2025). HIPAA Security Rule NPRM. 90 Fed. Reg. 898.
- HHS. (2024). Healthcare and Public Health Cybersecurity Performance Goals.
- Ali, T. E., et al. (2024). Trends, prospects, challenges, and security in the healthcare Internet of Things. Computing, 107, Article 28.
Soft CTA
Need help putting this into practice?
We can help you turn the idea into an action plan, implementation checklist, or review of the controls that matter most.