Hospitals have spent years securing the obvious targets — front desk computers, billing systems, email. Meanwhile, the device quietly running in the background of nearly every clinical area has become the softest target in the building: the connected medical device.

The Internet of Medical Things (IoMT) — infusion pumps, MRI machines, heart monitors, and dozens of other systems — is now standard in modern healthcare. The problem is that most of these devices were engineered to save lives, not to withstand a modern ransomware attack. Many run on operating systems too outdated to accept current security patches, which means a known vulnerability can sit open indefinitely because patching isn't technically possible without replacing the hardware.

Attackers don't need to breach the hospital's core network directly. A vulnerable device becomes the entry point — a foothold that lets them move laterally until they reach the electronic health records database, encrypt it, and demand payment. When hospitals refuse, some attackers escalate to threatening patients directly with the release of sensitive diagnoses.

The fix isn't replacing every device overnight — that's not realistic for most budgets. It's network segmentation: keeping connected medical devices, guest Wi-Fi, and core administrative systems on separate virtual networks so a compromised device hits a wall instead of a straight path to patient records. If ransomware lands on an infected smart-TV in a waiting room, segmentation is what stops it from ever reaching the EHR database.

For facilities auditing IoMT risk, the starting questions are simple but often unanswered: What's actually on the network? Which devices can't be patched? And is there a segmentation boundary between those devices and anything holding patient data?

The broader regulatory context — including HHS and CERT-In requirements around asset inventory and vendor risk — is covered in full here: [read the complete healthcare cyber security regulatory guide].