Bridging the Gap: Understanding System Limitations in Secure Connectivity for Medical Devices

Secure communication between medical devices and health information systems is now a regulatory expectation — but in practice, adoption of secure standards like HL7, DICOM, and ASTM remains inconsistent. This whitepaper explains the disconnect between regulatory guidance and real-world deployment, showing how infrastructure limitations, legacy systems, and divided regulatory responsibilities contribute to insecure implementations. Drawing on real examples and audits, it identifies systemic barriers to secure connectivity and provides actionable recommendations for device manufacturers, healthcare organizations, and regulators to bridge the gap.

The FDA requires manufacturers to support secure connectivity as part of device cybersecurity, yet most hospitals operate on infrastructures that can’t, or don’t, enforce it. While device manufacturers fall under FDA oversight, healthcare delivery organizations (HDOs) are governed by HIPAA, creating a regulatory blind spot where secure system integration is no one’s responsibility. This paper outlines how that gap undermines both patient safety and compliance, and what all parties can do to drive progress toward true system-level security and interoperability.