How Are Health Systems Managing Thousands of Devices on Their Networks?

Main Line Health Shares a Microsegmentation Strategy

Main Line Health’s microsegmentation process began in 2024 and has taken about a year and a half, including a few months to get the right policies in place, Weismann says.

“I think it's a foregone conclusion that organizations have to implement network segmentation in some form, and they have to protect their devices in ways that simple patching won't be able to address,” he adds.  

Many medical devices, such as infusion pumps, are small Linux boxes that can be compromised. These pumps, along with devices such as printers or EKG machines, may need a different type of protection than a traditional compute and server endpoint, Weismann says, adding, “Microsegmentation helps minimize the blast radius.”

It was crucial to communicate with clinicians about what type of microsegmentation was required.  

“By having those conversations with clinical operations and understanding exactly what is needed and what isn't, we're then able to implement rules that aren't going to disrupt patient care,” Weismann says. “It takes a lot of collaboration across the system to do that, and I think our teams have navigated that fairly successfully.”

Through partnerships, Main Line Health implemented a real-time risk management platform for adding new medical devices to the network. If a device presents a threat, Weismann’s team can isolate it from communicating with other devices and sandbox it. Such devices can still communicate with the internet but not with the internal network.

Going forward, Weismann plans to ensure that devices touching any open port are authenticated so the organization can prevent a potential compromise from a local attack.

“We were very focused on remote attacks with the strategy we've taken, and now we're pivoting to look more locally as well,” Weismann says.

Michigan Medicine Maintains Device Visibility Amid Mergers

The University of Michigan Health (Michigan Medicine) experienced a number of mergers in recent years, which presented a pressing challenge to gain visibility to tens of thousands of devices in an ever-growing ecosystem. In 2018, it joined with Metro Health (now University of Michigan Health-West) and in 2024, Sparrow Health was brought into the fold.

Michigan Medicine uses tools to assign a vulnerability score for devices such as MRI machines and smart TVs. Threat intelligence allows the school to better determine the criticality of vulnerabilities, says Greg Sieg, CISO for the University of Michigan Regional Health Network, which includes the community hospitals UM Health-Sparrow in Lansing and UM Health-West in Grand Rapids.

The ServiceNow platform helps manage device inventory, and segmented networks keep medical technology separate from consumer-grade devices. Cisco’s Identity Services Engine (ISE) automates some of Michigan Medicine’s network segmentation and determines if a device should be allowed on the network. It can move a device such as an infusion pump to the correct virtual network in the organization to secure it, Sieg says.

RELATED: Clinical care resilience ensures healthcare business continuity when IT fails.

“It does all that automation on the back end, and it doesn't matter where I plug it into a switch,” Sieg adds. “As long as the switch has ISE enabled, it's going to do that.”

If a patient unplugs an infusion pump and plugs in an Xbox console instead, for example, the port will shut down, Sieg explains.

Legacy devices are also segmented, he adds: “As we find devices, we get them moved over to where they need to be.”

Industry threat intelligence enables the health system to pinpoint which devices to prioritize for patching, Sieg says, along with information from federal agencies. Managing edge devices is an ongoing process, so the health system continues to evaluate partners for its next steps.

Luminis Health Guards Against Edge Device Vulnerabilities

Maryland-based Luminis Health has more than 100,000 devices on its network, says Virtual CISO Jason Taule. That’s a lot of vulnerable endpoints to manage.  

“Hospitals are a fairly permissive environment due to the nature of our mission, allowing patients and their families in, but as soon as I find out a device doesn't belong, we’ve got to get it out of there,” Taule says.

Another key challenge is avoiding a prolonged outage, Taule says. “We are laser-focused on downtime, prolonged outages, because that inhibits our ability to serve our patients.”

Managing legacy edge devices can present its own set of issues, especially when acquiring new services. When Luminis Health was buying a blood chemical analyzer from a medical device company, it discovered that the solution was running on a long-unsupported Windows CE operating system, Taule says.

“The U.S. Food and Drug Administration process is flawed, because you don't have to go through a new certification if you don't change your product, giving companies no incentive to update an old, unpatched, vulnerable thing,” Taule says. “I couldn’t defensively put that on my network.”

Click the banner below to sign up for HealthTech’s weekly newsletter.

That’s why it’s critical for healthcare organizations to carefully evaluate a device before ordering hundreds of them to add to the network.

“Hospitals don't have billions of dollars to replace stuff that works,” Taule says. That means devices can stay in use for years, maybe even more than a decade. Regardless of the age of a device, organizations need to have visibility into their environments and manage their technology appropriately.

In addition, privileged access management systems such as those that Microsoft offers allow health systems to create administrative accounts for only the time required for a specific workflow. Taule can reset permissions for certain devices based on need. “As soon as the job is done, the account goes away,” he adds.

Even with recent hospital acquisitions, Luminis Health maintains a full inventory of devices across facilities. Device utilization from one hospital to another is a factor in whether the organization will support it, but security considerations should be a priority, Taule says.

“Security has got to be driving business risks and costs,” he adds.