The Internet of Medical Things (IoMT) is the network of connected medical devices, sensors, and software that collect patient information for clinical systems. IoMT security is the set of technical controls, policies, and working habits that keep those devices accurate and stop that information from being stolen or altered.
That second part matters more than most guides admit. A leaked record is a privacy problem, but a patient monitor showing the wrong reading is a safety problem. When ransomware hit NHS pathology provider Synnovis in June 2024, blood test delays spread across South East London. One patient’s death was later linked in part to a long wait for a result.
This guide explains what the Internet of Medical Things covers and why connected medical devices are so hard to protect. It then sets out the UK and Irish rules that apply, with practical steps for families and answers to common questions.
Table of Contents
What Is the Internet of Medical Things?
The Internet of Medical Things covers far more than hospital equipment. Anything that measures, treats, or monitors a patient over a network belongs to it, from a glucose sensor to an MRI scanner.
Four Tiers of Connected Care
It helps to split the Internet of Medical Things into four tiers, because each one carries different risks and falls under different owners.
| Tier | Examples | Who usually manages it |
|---|---|---|
| Personal and wearable | Continuous glucose monitors, connected insulin pens, heart rhythm patches | The patient, supported by the prescribing clinic |
| Home monitoring | Blood pressure cuffs, pulse oximeters, virtual ward kits | The patient’s household and the remote monitoring team |
| Bedside and point of care | Patient monitors, infusion pumps, ventilators | Clinical engineering and ward staff |
| Clinical infrastructure | Imaging scanners, pathology analysers, medicine dispensing cabinets | Hospital IT and specialist suppliers |
The further up the table you go, the more patients a single fault can affect. A compromised home cuff exposes one person’s readings. A compromised pathology system can stall testing for thousands.
Where Consumer Wearables End and Medical Devices Begin
Not every health gadget counts as a medical device in law, and the difference changes which rules apply. A fitness tracker counting steps is a consumer product. A heart patch prescribed to detect arrhythmia is a medical device, regulated in Great Britain under the Medical Devices Regulations 2002.
That line decides which security law applies. The UK’s Product Security and Telecommunications Infrastructure (PSTI) regime covers fitness trackers. It specifically excludes medical devices already covered by the 2002 regulations. The EU’s Cyber Resilience Act takes the same approach, leaving devices covered by the EU Medical Device Regulation to their own sector rules. So a smartwatch and a hospital finger monitor can sit under different laws, even when they measure the same thing.
Why Connected Medical Devices Are Easy Targets
Medical equipment breaks most of the assumptions ordinary IT security relies on. You often can’t install security software on it or switch it off for updates, and that’s the root of most Internet of Medical Things risk.
Long Lifespans and Unsupported Software
Hospitals keep expensive equipment for as long as it works, and the software inside often stops receiving updates long before the hardware wears out. RunSafe Security’s 2026 Medical Device Cybersecurity Index surveyed 551 healthcare professionals across the US, UK and Germany. It found that 28% of organisations run medical devices past the manufacturer’s end of support.
The same survey found that 44% of organisations use devices with known, unpatched vulnerabilities. Many mirror the wider IoT device vulnerabilities found in cameras and routers. The stakes are higher when the device is attached to a patient.
The Patching Problem: Updates as Safety Corrections
Patching a medical device isn’t like updating a phone. A software change can trigger formal safety checks, and taking a ventilator offline needs clinical planning.
In Great Britain, new post-market surveillance rules for medical devices came into force in June 2025. Specialists reviewing the rules note that manufacturers must now report serious incidents, including those caused by cyber attacks, to the MHRA within 15 days. They also point out that fixes for critical security flaws are handled through the formal field safety corrective action process, with notices sent to users. That gives hospitals a clearer paper trail for Internet of Medical Things fixes, though urgent patches follow a defined route.
Hidden Functions in Device Firmware
Sometimes the risk ships inside the device itself. In January 2025, the US Cybersecurity and Infrastructure Security Agency (CISA) and the FDA issued a warning about the Contec CMS8000 patient monitor. Its firmware connected to a hard-coded external IP address.
CISA said this could allow files on the monitor to be overwritten and patient data to leave the network unnoticed. A separate flaw, CVE-2024-12248, was rated critical because it could let an attacker run code remotely. NHS England Digital issued its own alert (CC-4612) because the monitors were also used in Europe. Security firm Claroty later argued this was insecure design rather than a deliberate backdoor. Either way, hospitals had a monitor sending patient data somewhere they hadn’t approved.
Patient Data Theft Versus Patient Harm
Most security writing treats a breach as a data problem. Attacks on the Internet of Medical Things cause two separate kinds of damage, and each needs a different response.
| Attack scenario | What is at risk | Likely clinical impact | First control to check |
|---|---|---|---|
| Ransomware on clinical systems | Records, test results, scheduling | Cancelled appointments, delayed diagnosis | Tested offline backups and downtime plans |
| Data leaking from a device | Vital signs linked to identity | Privacy harm, fraud using medical details | Outbound traffic rules and encryption |
| Tampered device settings | Dosage, alarm limits, displayed readings | Wrong treatment decisions | Integrity checks and restricted admin access |
| Device made unavailable | Monitoring and therapy functions | Staff fall back to manual observation | Spare devices and clear escalation routes |
The Synnovis attack showed how the first row plays out. The Qilin ransomware group disrupted pathology services for weeks. King’s College Hospital and Guy’s and St Thomas’ postponed 10,152 outpatient appointments and 1,710 elective procedures. South East London Integrated Care Board later reported that 170 patients suffered some level of harm. You can read more about how these groups operate in our guide to the evolution of ransomware attacks.
The data side lasted far longer than the outage. Synnovis spent more than a year piecing together what had been stolen, and only finished telling NHS organisations whose patients were affected by November 2025. Stolen medical details can be reused for years, which is why medical identity theft is so hard to spot and undo.
This isn’t a rare pattern. In RunSafe’s 2026 survey, 24% of organisations reported attacks or exploited flaws involving medical devices. Of those incidents, 80% caused moderate or significant disruption to care.
A Layered Defence for IoMT Security
No single product protects a hospital’s Internet of Medical Things estate. The approach that holds up combines a clinical inventory, separated data, realistic access controls and careful buying.
Map Devices to Clinical Risk, Not Just Addresses
A list of device names and network addresses tells you very little. A useful inventory records the ward, what the device connects to, whether it touches a patient, and who to call when it fails.
With that context, teams can rank each device by clinical impact. An unsupported infusion pump in intensive care goes to the top of the list, while an unsupported label printer in outpatients can wait. The inventory should also record whether a device receives updates, since that decides whether it can be fixed or must be contained.
Separate Vital Signs from Patient Identity
The simplest way to limit a leak is to make sure a device never holds more than it needs. A bedside monitor needs heart rate, oxygen levels and alarm settings. It rarely needs a patient’s name, address, and NHS number sitting alongside them.
Well-designed systems send physiological readings with a token instead of an identity, and only link the two inside a secured clinical record. If someone intercepts the device traffic, they see numbers without names. Readings should also travel over current transport encryption such as TLS 1.3, and our explainer on understanding encryption covers how that protection works.
One legal point is often missed. Under UK GDPR, pseudonymised data is still personal data, because it can be linked back to a person. Splitting identity from readings lowers the risk, but it doesn’t remove the organisation’s duties.
Break-Glass Access for Emergencies
Security controls that slow down resuscitation are badly designed controls. A nurse in sterile gloves during a cardiac arrest can’t type a long password. Pretending otherwise pushes staff towards shared logins.
Break-glass access solves this by allowing immediate emergency access to a device or record, then flagging every use for review afterwards. It works best alongside tap-in proximity badges and sensible screen lock timings. Stronger login checks belong on remote and administrator accounts, where attacks tend to start. Attackers often get those logins through phishing emails aimed at staff, not through the devices themselves.
Buy Secure, Retire Securely
The cheapest time to fix a device’s security is before it arrives. A software bill of materials (SBOM) lists every software component inside a device. It lets a hospital check quickly whether a new flaw affects its equipment.
Buyers are starting to insist on it. RunSafe found that 35% of healthcare buyers won’t consider a device without an SBOM. And 56% have rejected a device over security concerns, up from 46% in 2025. At the other end of the lifecycle, devices leaving service should have stored patient data securely wiped before they’re sold, returned or recycled.
UK and Irish Rules for Connected Medical Devices
Most guidance on the Internet of Medical Things is written around US law. UK and Irish organisations work under a different mix of rules, and several changed in 2025 and 2026.
NHS DTAC and Supplier Assurance in England
NHS England published version 2 of the Digital Technology Assessment Criteria (DTAC) on 24 February 2026, and it became mandatory from 6 April 2026. The new form has around 25% fewer questions. It removes overlap with the Data Security and Protection Toolkit and the pre-acquisition questionnaire for medical devices.
The technical security section now asks suppliers to confirm they meet the government’s Software Security Code of Practice. Multi-factor authentication requirements have also been widened to cover administrator and remote access accounts. That change has real weight, since Digital Health News reported that the Synnovis attack could have been prevented by two-factor authentication.
MHRA Oversight and UK GDPR
The Medicines and Healthcare products Regulatory Agency (MHRA) regulates medical devices in Great Britain, including their software. Its post-market surveillance rules, in force since June 2025, bring cyber incidents into the same reporting system as mechanical faults.
Data protection sits alongside device safety. Health information is special category data under Article 9 of UK GDPR, so it needs a specific lawful condition and stronger safeguards. A breach likely to put people at risk must be reported to the Information Commissioner’s Office within 72 hours.
The Cyber Security and Resilience Bill
The UK’s Cyber Security and Resilience Bill was introduced to Parliament on 12 November 2025. It would give regulators powers to designate critical suppliers to essential services, and the government named healthcare diagnostics providers to the NHS as an example.
As of September 2026, the Bill has passed the House of Commons and is going through the House of Lords as HL Bill 32. It isn’t law yet, with Royal Assent expected between late 2026 and spring 2027 and phased commencement after that.
Ireland and the EU: NIS2, MDR and the CRA Gap
Ireland hasn’t yet written the EU’s NIS2 Directive into national law, and the National Cyber Security Bill intended to do so remains unenacted. On 8 July 2026, the European Commission referred Ireland to the Court of Justice of the EU over the delay. Under the draft scheme, an agency under the Minister for Health would supervise the health sector.
Medical devices sold across the EU must meet the EU Medical Device Regulation, which requires IT security in software design. The Health Products Regulatory Authority (HPRA) oversees medical devices in Ireland. Because the Cyber Resilience Act excludes devices covered by the MDR, those two regimes carry the load for certified equipment.
| Framework | Where it applies | What it means for connected medical devices |
|---|---|---|
| NHS DTAC version 2 | NHS and adult social care in England | Supplier assurance, including technical security and MFA checks |
| MHRA post-market surveillance rules | Great Britain | Faster serious incident reporting, including cyber incidents |
| UK GDPR Article 9 | United Kingdom | Stronger safeguards for health data, 72-hour breach reporting |
| Cyber Security and Resilience Bill | United Kingdom (pending) | Possible designation of critical healthcare suppliers |
| EU MDR | EU, including Ireland and Northern Ireland | Security built into device design and risk management |
| NIS2 Directive | EU (not yet transposed in Ireland) | Risk management and incident reporting for health entities |
Northern Ireland adds another layer, since EU medical device rules continue to apply there under the Windsor Framework. Suppliers working on both sides of the border should plan for both sets of obligations.
Advice for Patients Using Connected Devices at Home
Remote monitoring now reaches many homes through virtual wards. If your family uses a connected monitor, a few habits make the Internet of Medical Things safer at home.
Keep the companion app and the device updated, and only install apps from the provider your clinic names. Put the device on your main home Wi-Fi with a strong router password, not on a guest network shared with visitors. If readings suddenly look wrong or don’t match how the person feels, contact the clinical team rather than adjusting settings yourself. Our guide to protecting healthcare data in an AI and IoT world explains what happens to readings once they leave your home.
Be careful with wellness apps too. A fitness tracker falls under consumer product rules, so check its privacy settings and who sees the data.
Next Steps for Hospitals, Suppliers and Families
Securing the Internet of Medical Things doesn’t start with new technology. It starts with knowing which devices touch patients, keeping identity apart from readings, and making sure emergency access works without shortcuts.
For NHS suppliers, the immediate job is checking evidence against DTAC version 2. For Irish organisations, it’s preparing for NIS2 before the law arrives. For families, it’s keeping home devices updated and reporting anything odd. Have you seen a connected device cause problems in your care or your workplace? Share your experience in the comments below, as reader questions help shape future updates to this guide.
Frequently Asked Questions
These answers cover the questions readers most often ask about the Internet of Medical Things and patient data, both at home and in hospital.
Is a fitness tracker part of the Internet of Medical Things?
Only loosely. Most fitness trackers sit at the consumer edge of the Internet of Medical Things and are covered by the UK’s PSTI rules. A device becomes a medical device when it’s intended to diagnose, monitor or treat a condition, and then medical device regulation applies instead.
Who is responsible when a connected medical device leaks patient data?
Usually more than one party. The hospital or clinic is normally the data controller under UK GDPR, so it answers for how the device is set up and connected. The manufacturer answers for the device’s safety and built-in security under medical device law. It may share liability if it processes data through its own cloud.
What is break-glass access?
In the Internet of Medical Things, it’s an emergency override that gives clinical staff immediate access to a device or record during a crisis. Every use is logged and reviewed afterwards, so speed doesn’t come at the cost of accountability.
Does the EU Cyber Resilience Act cover medical devices?
No. Devices regulated under the EU Medical Device Regulation and the In Vitro Diagnostic Regulation are excluded because those rules already set their own security requirements. Health apps and wearables that aren’t medical devices can still fall within its scope.
What should I do if a home monitor shows strange readings?
Check the person first and seek urgent help if they seem unwell. Then tell the clinical team that issued the device, noting the time and what you saw. They can check whether it’s a fault or something more serious.