FDA Safety Communication: Cybersecurity Vulnerabilities with Certain Patient Monitors from Contec and Epsimed
Date Issued: January 30, 2025
The U.S. Food and Drug Administration (FDA) is raising awareness among health care providers, health care facilities, patients, and caregivers that cybersecurity vulnerabilities in Contec CMS8000 patient monitors and Epsimed MN-120 patient monitors (which are Contec CMS8000 patient monitors relabeled as MN-120) may put patients at risk after being connected to the internet.
Three cybersecurity vulnerabilities have been identified:
- The patient monitor may be remotely controlled by an unauthorized user or not work as intended.
- The software on the patient monitors includes a backdoor, which may mean that the device or the network to which the device has been connected may have been or could be compromised.
- Once the patient monitor is connected to the internet, it begins gathering patient data, including personally identifiable information (PII) and protected health information (PHI), and exfiltrating (withdrawing) the data outside of the health care delivery environment.
These cybersecurity vulnerabilities can allow unauthorized actors to bypass cybersecurity controls, gaining access to and potentially manipulating the device.
The FDA is not aware of any cybersecurity incidents, injuries, or deaths related to these cybersecurity vulnerabilities at this time…read more from FDA
Related Articles
-
The Get Well platform is used at more than 70 Veteran Affairs Medical Centers (VAMCs). Now that it is listed on the FedRAMP Marketplace, the Get Well digital patient engagement platform can be contracted by any government agency without additional security…
-
“We are incredibly fortunate to welcome Dr. Rizk to our advisory board. Her remarkable track record and profound knowledge in digital health will be invaluable as we continue to be at the forefront of redefining patient monitoring standards.”
-
The integration of technology and connectivity into healthcare is not only improving patient outcomes but also reshaping the way care is delivered.
-
Health IT interoperability advocacy group, The Sequoia Project released its latest Data Usability Implementation Guide including added guidance for receiving systems, advanced baseline requirements from USCDI V1, and more.
