4 Types of Medical Device Implants and Their Biggest Security Risks

Medical device implants provide cost-effective prevention, diagnostic, and treatment capabilities. Implantable medical devices (IMDs) often combine human tissue with technology, relying on external electrical energy sources and network connectivity to:

• Support organ functions
• Monitor physiological activities
• Deliver medication

Some examples of medical device implants include:

• Cardiac implants, like pacemakers that regulate heart rhythms
• Neurostimulators to help manage chronic pain or neurological disorders
• Drug delivery systems to control medication release to specific locations
• Biosensors for real-time health assessments

As more healthcare teams incorporate IMDs into their patient care processes, they should understand the various risks associated with them. Many of these devices have limited security protocols that create cybersecurity and health risks for patients and healthcare delivery organizations. When these medical devices are connected to hospital networks, the risk escalates. Exploitation of these vulnerabilities can result in unauthorized access to sensitive personal health information, compromising both patient privacy and healthcare integrity.

To help protect patient health and sensitive data, healthcare delivery organizations should work to mitigate the biggest cybersecurity risks arising from these seven types of medical device implants. 

What are Attacker Motivations for Targeting IMDs?

Threat actors typically look for low-effort, high-reward targets since those offer the greatest return on time and financial investment. Since IMDs often lack the inherent security functionalities of traditional devices, threat actors increasingly target them for various reasons. 

Physical Harm

Some IMDs control people’s bodily functions. For example, pacemakers help regulate patients’ heart rhythms as part of cardiac care. The ability to gain unauthorized access to these devices and cause physical harm to patients can motivate various attackers:

• Financial: holding patient lives for ransom unless healthcare organizations provide payments
• Political: targeting high-profile patients as part of larger geopolitical objectives
• Criminal: seeking to harm people as part of other physical-world criminal objectives

Financial Benefit

Beyond the financial benefits of holding people’s lives for ransom, attackers may be motivated to target devices connected to a specific company. A successful attack against a medical device can impact the manufacturer’s stock prices. 

Sensitive Data

Medical device implants collect electronic protected health information (ePHI) and share it with care providers. Attackers target these devices for two reasons:

• information stored on the devices 
• using the devices as an entryway for unauthorized access to the system containing additional ePHI or other sensitive data

Tracking

As IMDs transmit data using wireless networks, the devices also share information about the patient’s physical location. As with the physical harm motivation, threat actors can use these communications as part of political or other criminal activities. 

Four Common Medical Device Implants and Their Cybersecurity Risks

The risks IMDs present have been studied for several years. In 2016, researchers identified IMD risks to enable medical device regulation. In 2020, researchers reviewed the viability of these risks. As part of their work, the researchers reviewed several common medical device implants. 

Implantable Cardioverter Defibrillators (ICD) and Cardiac Pacemakers

ICDs provide an electric shock to the heart when they detect an irregularity. They are often used for people at risk of death from arrhythmias, including those who have:

• History of cardiac arrest
• Tachycardia (heart beating too quickly)
• Bradycardia (heart beating to slowly)
• Cardiomyopathy (diseased heart muscle)
• Reduced heart pumping function

Unlike ICDs, pacemakers focus on sending the heart electrical impulses when it needs help pumping blood. Typically, these are used for patients with bradycardia. Pacemakers store and transmit sensitive information. 

An attack against these devices could lead to heart failure. 

Bio-NanoThings 

Bio-nano Things are non-intrusive, concealable devices used for intra-body sensing and actuation networks for:

• Health monitoring
• Targeted drug delivery
• Nano-surgeries

Deep Brain Stimulators (DBS)

A DBS system consists of implanted electrodes that connect to an implantable pulse generator (IPG) to retrain a patient’s brain to help with:

• Motor impairments or movement disorders
• Patient’s emotional state

These technologies can treat conditions like:

• Parkinson’s Disease
• Dystonia
• Chronic pain

These invasive systems are considered a subset of brain-computer interfaces (BCI). 

An attack against these devices could lead to:

• Increased patient pain
• Reduced motor function
• Change in emotional state

Implantable Drug Delivery Systems

Implantable drug delivery systems are battery-powered control systems that enable healthcare providers to target medication delivery more precisely. Often used with diseases requiring long-term therapy, they allow:

• Local or systemic circulation delivery
• Optimal dowsing
• Constant delivery at a predetermined rate

Healthcare providers may use them as part of therapy for:

• Heart disease
• Diabetes
• Cancer
• Chronic pain management

Implantable insulin pump systems are a commonly found subtype that mimic pancreatic activity by:

• Slowly releasing insulin throughout the day
• Releasing insulin at mealtime

An attack against these systems could lead to either a medication overdose or underdose that undermines patient care. 

Understanding the Risk Profile for Medical Device Implants

While the devices offer different health benefits, they create new risks that healthcare providers should understand. 

Network Connectivity

Many IMDs use wireless network connectivity to periodically log and share data as part of their remote patient monitoring capabilities. However, these devices may lack appropriate:

• Authentication and authorization mechanisms
• Encryption and cryptography protections

These can leave the devices at risk of:

• Man-in-the-middle attacks
• Message replay attacks
• Impersonation attacks
• Modifications, like changing treatment or dosage patterns
• Remote shutdown
• Manipulation as part of Denial of Service (DoS) attacks, draining the device’s battery

Operating System, Software, Firmware Vulnerabilities

As with any technology, attackers seek to exploit vulnerabilities in device operating systems, software, and firmware. While installing security patches is a critical risk mitigation strategy, the updates can lead to:

• Battery depletion
• Device shutdown
• Potentially new vulnerabilities
• Device malfunctions

Whenever updating these devices, those responsible should balance continued device availability with device security, prioritizing updates that respond to meaningful threats. 

Radio Frequency Identification (RFID)

Bio-nano Things often incorporate RFID sensors for:

• Real-time patient tracking
• Safety
• Facility medical supply management

However, the RFID sensors are sensitive to risks like:

• Hardware trojans that modify the tags and allow attacker access to software
• Side channel attacks that intercept information exchanges
• Tag cloning to steal sensitive information or impersonate the tag
• Tag counterfeiting by gaining access to the tag and modifying its identity

Third-party Vendor Risk

The third-party vendor risk management concerns for IMDs fall into two categories:

• Connected applications that care teams use for modifying service delivery
• Manufacturer data protection risks

For example, in January 2023, the Insulet Corporation experienced a data privacy incident impacting the Omnipod DASH customers when a web page was used to verify receipt of a Medical Device Correction (MDC) later. When customers clicked the verification page on the Omnipod website, the web page’s cookies shared the following information with Insulet website performance and marketing partners, including:

• Customer IP address
• Whether customers used Omnipod DASH
• Whether the customer had a Personal Diabetes Manager

While these devices present new risks, healthcare providers can work in tandem with HTM teams to understand the risks and work to prevent data breaches holistically.

Medical Device Monitoring for Risk Mitigation

IMDs offer various patient care benefits, but like many Internet of Medical Things (IoMT) devices, they come with new cybersecurity and data privacy risks. As healthcare organizations adopt these new technologies, they need to implement purpose-built security monitoring. Technologies such as Asimily work to protect connected medical devices within a hospital’s ecosystem, ensuring that devices directly responsible for patient care remain safe and operational.

To learn more about Asimily, download our IoT Device Security in 2024: The High Cost of Doing Nothing whitepaper or contact us today.