Best Practices for Managing IoT Firmware Updates in Healthcare

Hospitals increasingly rely on connected medical devices, but outdated firmware poses serious risks to patient safety and cybersecurity. With IoMT (Internet of Medical Things) devices set to double in U.S. hospitals by 2026, ensuring secure, timely firmware updates is more critical than ever. This guide outlines how healthcare organizations can manage firmware updates effectively, focusing on:

• Why IoMT firmware updates matter: Protect patient safety, reduce cybersecurity risks, and comply with FDA regulations.
• Key risks of outdated firmware: Data breaches, device malfunctions, and unauthorized control of critical devices.
• Steps to secure firmware updates:
  • Maintain accurate device inventories and prioritize updates by risk.
  • Implement policies for approvals, testing, and emergency updates.
  • Use technical safeguards like code signing, encryption, and secure boot.
  • Plan for staged rollouts and rollback mechanisms to minimize disruptions.
• Regulatory compliance: Follow FDA, HIPAA, and NIST standards to meet legal and safety requirements.
• Performance tracking: Measure update success rates, patch timelines, and inventory accuracy to improve processes.

Device Firmware Update Best Practices

IoT Firmware Updates in Healthcare: Core Concepts

Firmware acts as the brain of a device, controlling its operations. In healthcare, it plays a vital role by managing functions like therapeutic logic, data transmission, cloud connectivity, and executing medical algorithms ^[1]. As Dr. Baya Oussena aptly explains: "Today's medical devices are software-first products that also have hardware components, not the reverse." ^[6] This highlights the importance of securing firmware as an ongoing priority within the healthcare system. The unique role of firmware in healthcare devices makes the consequences of any issues far-reaching and device-dependent.

IoT vs. IoMT: What Is the Difference in Healthcare?

Not all connected devices in a hospital share the same level of risk. General IoT devices, such as printers or HVAC systems, may experience operational interruptions if updates fail. However, IoMT (Internet of Medical Things) devices - like infusion pumps, ventilators, imaging systems, and cardiac monitors - are directly tied to patient care. A failed update in these devices could result in serious patient harm.

Here’s a quick comparison:

Source: ^[6]

These differences make it clear why firmware updates for IoMT devices require a higher level of scrutiny and care compared to general IoT devices.

The Risks of Unpatched Firmware in Healthcare

Outdated firmware is often a weak link in hospital networks. In fact, software-related problems now account for 20% of all medical device recalls ^[6]. Between 2023 and 2025, cybersecurity attacks on medical devices surged by 278% ^[6]. A single connected infusion pump, for instance, can contain 50 to 200 third-party open-source components ^[7], each representing a potential security gap if not updated.

The risks go beyond data breaches or ransomware attacks. Unpatched firmware can lead to unauthorized remote control of devices critical to patient care, such as those delivering medications or supporting life. The National Vulnerability Database identified nearly 50,000 new CVEs (Common Vulnerabilities and Exposures) in 2025 alone ^[7], showing how quickly threats are evolving - often outpacing hospital patch management cycles.

U.S. Regulations and Standards That Apply to Firmware Updates

In the U.S., managing firmware updates in healthcare devices is governed by a mix of regulations and standards. For example, FDA Section 524B mandates that manufacturers of cyber devices monitor vulnerabilities and deploy patches within a "reasonably justified timeline" ^[7]. Additionally, 21 CFR Part 820 outlines quality system requirements, including design and change controls, while 21 CFR Part 11 focuses on electronic records and audit trails.

Other laws and frameworks also play a role. HIPAA requires connected devices to safeguard protected health information (PHI), and NIST frameworks provide practical guidance on managing cybersecurity risks.

Technical standards further ensure device safety. IEC 62304 defines processes for the software lifecycle in medical devices, while ISO 14971 focuses on risk management for these devices. Together, these standards promote a Total Product Lifecycle (TPLC) approach, emphasizing that firmware security is an ongoing responsibility - from deployment to decommissioning ^[6]. Familiarity with these standards is essential for creating a robust system for managing firmware updates.

Building a Governance Framework for Firmware Updates

Addressing firmware vulnerabilities in healthcare requires more than just quick fixes - it demands a structured governance framework. This approach transforms firmware updates from a reactive scramble into a well-organized process. Without clear policies, assigned responsibilities, and defined workflows, even the most advanced technical measures can fall short. As Dr. Baya Oussena aptly puts it:

"Organizations that view OTA update infrastructure as a technical afterthought rather than a strategic compliance enabler are essentially building houses without foundations." ^[6]

Device Inventory and Risk Categorization

The first step is creating an accurate and up-to-date device inventory. Use MDS2 forms from vendors to gather details about each device’s security features, update needs, and known limitations. Pairing this information with Unique Device Identification (UDI) data gives you a solid foundation for tracking devices, their models, and current firmware versions. This baseline is crucial for prioritizing updates.

Once the inventory is complete, categorize devices based on their clinical importance and the risks posed by unpatched firmware. For example, devices directly tied to patient care, such as ventilators or infusion pumps, should be at the top of the priority list. On the other hand, non-critical devices like administrative IoT endpoints can be ranked lower. Flag devices as high-risk if they lack well-documented update procedures or have unclear remote access protocols ^[4].

How to Create a Firmware Update Policy

A clear and detailed firmware update policy is the backbone of any governance framework. It ensures updates are handled systematically and documented thoroughly, covering everything from approvals to testing and failure management.

Here’s what your policy should include:

• Roles and Responsibilities: Clearly define the duties of clinical engineering, IT security, and compliance teams to avoid confusion or duplication of effort.
• Approval Workflows: Require a risk-based justification for each update, especially when changes could impact safety or intended use, in alignment with ISO 14971 standards.
• Emergency Update Procedures: Set up a fast-track process for critical patches. While expedited, this process should still maintain a documented approval chain.
• Documentation Standards: For every update, maintain a Software Update File (SUF) with traceable links to the risk assessment, testing outcomes, and verification evidence. This aligns with FDA Premarket Guidance and IEC 62304 requirements.

Your policy should also cover labeling compliance. For instance, under 21 CFR Part 801, any update that alters a device’s functionality, remote access, or alert protocols requires an update to its Instructions for Use (IFU).

Vendor and Third-Party Risk Management for Firmware Updates

Vendors play a pivotal role in the firmware update process but can also introduce risks. Healthcare organizations rely on manufacturers for timely updates, cryptographically signed firmware, and clear guidance on network segmentation. When vendors fall short, hospitals must step in to ensure device security.

To manage vendor-related risks effectively, adopt a structured and ongoing evaluation process. Check if vendors provide signed firmware builds, follow transparent vulnerability disclosure timelines, and support rollback mechanisms. Tools like Censinet RiskOps™ are designed for healthcare settings, offering streamlined third-party risk assessments and continuous tracking of vendor security practices. These platforms help manage risks tied to medical devices and clinical applications.

Technical Controls for Secure Firmware Updates

Having a governance framework is essential, but it’s the technical controls that bring those policies to life and secure firmware updates. Without proper safeguards at both the device and network levels, even the best-written policies won’t stop malicious or corrupted firmware from sneaking through.

Authentication and Integrity Verification

Before any firmware update is installed, one crucial question must be answered: Is this update authentic? The update must come from a trusted source and remain unchanged during transit.

Code signing is the go-to solution for this. Firmware builds are signed using the manufacturer’s private key, and devices verify that signature using a known public key before installation. As Eystein Stenberg, CTO of Northern.tech, explains:

"Code signing provides a cryptographic assurance that the updates come from a trusted source and remain unaltered during transmission." ^[2]

To double down on security, devices should verify the signature during download and again at startup using Secure Boot. This ensures that even if tampered code somehow gets through, it won’t run because the bootloader validates the digital signature during startup ^[9].

Public Key Infrastructure (PKI) simplifies trust management by issuing, rotating, and revoking digital certificates across fleets of devices ^[8]. Storing public keys in tamper-resistant areas on each device establishes a root of trust, ensuring all verification processes are anchored securely ^[9].

Once authenticity is confirmed, secure transport mechanisms safeguard the firmware update process.

Encryption and Secure Transport for Firmware Packages

Encrypting firmware packages is critical to prevent attackers from intercepting and reverse-engineering them. An unencrypted firmware binary could expose libraries, configurations, and logic, giving attackers a blueprint for exploitation ^[9].

TLS (Transport Layer Security) is the standard for securing firmware in transit ^[8]. For sensitive applications like healthcare IoT, mutual TLS (mTLS) - where both the device and server authenticate each other - is particularly important to defend against man-in-the-middle attacks ^[1].

As the Mender Editorial Team emphasizes:

"Every build that moves toward deployment must be validated and cryptographically signed, ensuring the integrity and authenticity of the software from development through delivery." ^[1]

Another practical method is delta updates, which involve sending only the differences between firmware versions rather than the entire package. This reduces bandwidth usage while still requiring full integrity checks and signature verification on the transmitted data ^[3].

sbb-itb-535baee

Operational Best Practices for Managing Firmware Updates

Combining technical controls with a structured operational process is essential to avoid disruptions in care.

Defining a Repeatable Update Lifecycle Process

A well-defined lifecycle process removes guesswork and reduces the chance of errors. Every firmware update should follow a documented sequence: risk assessment, requirements documentation, build, verification, staged deployment, and post-market monitoring.

Following established software lifecycle standards ensures compliance with FDA expectations, from gathering requirements to ongoing maintenance ^[1]. A key step in this process is starting every update with a detailed risk assessment that links each change to specific clinical risks - before any code is written ^[1].

Tracking performance after deployment, such as monitoring false-positive alert rates, provides valuable insights for future updates ^[1].

"The traceability matrix is what regulators examine during audits, and it must be current and complete at all times." ^[1]

Clear communication about expected downtime and clinical impact is critical. Informing hospital staff ahead of time helps them adjust workflows to minimize interruptions in patient care ^[4].

This structured approach lays the groundwork for rigorous testing and controlled rollouts.

Testing, Staging, and Rollback Planning

Once the update lifecycle is established, thorough testing and rollback plans are crucial to ensure patient safety and system continuity.

Firmware updates should only proceed after comprehensive testing. This involves verifying three key points: that the patch resolves the targeted vulnerability, that existing device functions remain intact, and that no new vulnerabilities are introduced.

For specialized devices, testing must simulate real clinical conditions. For instance, neurostimulator updates should be tested against both simulated and real electrocorticography (ECoG) data to ensure therapeutic logic remains accurate ^[1]. Similarly, remote monitoring systems need alert logic validation to avoid false positives or negatives after updates ^[7].

Staged rollouts offer the safest deployment method. By updating a small subset of devices first, you can limit potential issues before scaling up ^[4]. The table below outlines CVSS severity scores, clinical risks, patch timelines, and regulatory pathways:

When immediate patching isn’t possible, temporary measures like network segmentation or firewall rules can reduce risks ^[7]. Always prepare a clear rollback plan:

"Hospitals need to know when updates are coming, how long they will take, and how to recover if something goes wrong. Clear schedules, signed packages, step-by-step instructions, and safe rollback options reduce hesitation and risk." ^[4]

Using Automation with Strong Security Controls

Automation plays a key role in ensuring consistency and readiness for audits. Manual processes for firmware updates are prone to errors and don’t scale well. Automated testing pipelines enforce consistent integration, regression, and safety-critical path tests for every code change, making the process faster and more reliable ^[1].

Automated tools also generate logs, version records, and traceability matrices, which serve as formal evidence for FDA submissions. This significantly reduces the workload for quality and regulatory teams ^[1]. With software issues causing 20% of medical device recalls and cybersecurity threats rising by 278% in two years, automation is a critical step toward addressing these challenges ^[6].

However, automation needs to be balanced with human oversight. Platforms like Censinet RiskOps™ help healthcare organizations manage medical device risks, including firmware vulnerabilities, through automated workflows that still allow for human review. As Dr. Baya Oussena warns:

"Organizations that view OTA update infrastructure as a technical afterthought rather than a strategic compliance enabler are essentially building houses without foundations." ^[6]

Choose medical-grade over-the-air (OTA) platforms that meet regulatory standards for audit trails, change control, and rollback capabilities ^[6].

Sustaining and Improving Your Firmware Update Program

Keeping your firmware update program effective involves more than just setting it up; it requires consistent monitoring, evaluation, and adjustments. To truly maintain and refine such a program, you need to focus on performance metrics and proactive risk management.

Key Performance Indicators (KPIs) to Track

To measure the effectiveness of your firmware update program, track metrics like time-to-patch, update success rate, and rollback frequency. These indicators provide a snapshot of your system's reliability.

Beyond technical metrics, clinical safety is equally important. For example, monitoring false alert rates after updates ensures that critical therapeutic functions and monitoring systems remain accurate ^[1]. On the compliance side, the bidirectional traceability percentage - which measures how well requirements, risks, test cases, and evidence are connected - demonstrates alignment with standards like IEC 62304 and ISO 14971 ^[1].

Another often overlooked metric is inventory accuracy. Ensuring the completeness of Unique Device Identification (UDI) and Manufacturer Disclosure Statement for Medical Device Security (MDS2) data is crucial. This data allows you to quickly locate affected devices when new vulnerabilities arise ^[4].

These KPIs work hand-in-hand with your governance strategy, helping you measure and improve firmware security in a concrete way.

Incident Response for Firmware Update Failures

Even the best-tested updates can sometimes fail. Having a detailed incident response plan is critical to managing these situations without causing prolonged disruptions.

When an update causes issues, the first step is containment. This might involve isolating affected devices using network segmentation or firewall rules to stop the problem from spreading ^[7]. Your plan should also outline clear escalation paths and define forensic support steps to ensure the right team members are brought in quickly ^[4].

In cases where the issue reveals a deeper problem - such as a systemic process failure - it’s essential to initiate a Corrective and Preventive Action (CAPA). CAPA is reserved for addressing broader issues, not routine updates to third-party libraries ^[7]. Don’t forget to include regulatory reporting timelines in your plan to stay compliant with relevant requirements.

"The patch timeline is driven by the clinically relevant risk of the vulnerability, not the severity of the fix itself." - Ran Chen, Global MedTech Expert ^[7]

Ongoing Risk Assessment and Program Maturation

Treating cybersecurity as a dynamic, ever-evolving discipline is key to a mature firmware update program.

With every software release, update your threat models to account for new attack vectors, such as Bluetooth Low Energy (BLE) vulnerabilities, API hijacking, or mobile app spoofing ^[1]. Real-world data from clinical deployments should flow directly into Post-Market Surveillance reports, as required by FDA 21 CFR 820.100 and MDR Article 86 ^[1].

Tools like Censinet RiskOps™ can simplify continuous risk assessments, vendor management, and regulatory compliance. As the Mender Editorial Team highlights:

"Cybersecurity is a discipline that evolves with every feature, every update, and every new threat vector." ^[1]

Supporting your team is just as important as refining your processes. Providing hospital staff with practical resources - such as checklists, quick-reference guides, and short instructional videos - can help reduce errors and build trust in the update process ^[4].

"Strong firmware security is not about perfection. It is about reducing uncertainty, supporting hospitals, and building trust over time." - Tala Secure ^[4]

Conclusion: Key Takeaways for Healthcare IoT Firmware Management

Managing IoT firmware updates in healthcare demands consistent effort and foresight. With cybersecurity threats projected to surge by 278% between 2023 and 2025, and software issues responsible for 20% of device recalls, waiting to act until a problem arises is simply not an option ^[6]. As Dr. Baya Oussena aptly states, "When a smartphone update fails, users experience inconvenience. When a medical device update fails, patients face potential harm." ^[6]

The foundation of a strong firmware management program lies in adhering to key principles. A secure-by-design approach - leveraging cryptographic code signing, secure boot processes, and Zero Trust controls - ensures that only authenticated updates are delivered to devices ^[2][3]. Techniques like phased rollouts and A/B partition strategies further safeguard clinical operations, allowing systems to recover automatically in case of errors, without requiring manual fixes in sensitive environments ^[3][5].

However, technical solutions alone are not enough. Governance plays a crucial role. Maintaining a comprehensive device inventory, ensuring vendor accountability, and establishing traceable requirements, risks, and test evidence prepare organizations for audits and unforeseen incidents. Tools such as Censinet RiskOps™ support healthcare organizations in managing vendor risks and compliance effectively at scale.

"The issue is not if robust update capabilities are needed, but whether they are in place before the next audit or incident." - Dr. Baya Oussena ^[6]

These principles underscore the importance of combining technical safeguards with systematic governance to ensure patient safety.

As the number of IoMT devices in U.S. hospitals is expected to more than double by 2026, the complexity of firmware management will grow significantly ^[3]. Organizations that prioritize firmware update infrastructure as a strategic initiative - rather than an afterthought - will be better equipped to safeguard patients, meet regulatory demands, and swiftly address emerging threats.

FAQs

How do we prioritize which devices to patch first?

To manage firmware updates effectively, consider using a risk-based framework. This approach evaluates vulnerabilities based on both their technical severity and their potential impact on patient safety. Begin by creating a thorough inventory of all devices. Once that's done, classify these devices into risk categories - such as high, medium, and low. High-risk devices, especially those tied to clinical care or patient data, should take top priority.

For devices that can't be patched, alternative measures like network segmentation can help reduce risks. Tools like Censinet RiskOps™ can simplify this process by automating the evaluation and focusing attention on the most critical threats.

What should an emergency firmware update workflow include?

An effective emergency firmware update workflow hinges on well-documented steps for intake, validation, and deployment. Here’s how it can be done:

• Assess vulnerabilities: Start by identifying potential risks and prioritize updates based on the severity of the threat.
• Validate patches in a controlled environment: Test updates in a secure, isolated setting to ensure they function as intended without introducing new issues.
• Define rollback procedures: Have a clear plan in place to revert changes if an update causes problems.

Clear communication with clinical staff is also crucial. Keeping them informed helps coordinate updates efficiently while minimizing disruptions to patient care. Additionally, ensure all updates are cryptographically signed to protect their integrity and meet compliance requirements. This approach not only safeguards systems but also aligns with patient safety frameworks like Censinet RiskOps™.

What evidence is required for FDA and HIPAA audits after updates?

To comply with FDA and HIPAA audit standards, it's essential to keep thorough, traceable records of your firmware update process. This includes documenting steps like identifying vulnerabilities, prioritizing risks, and considering the device's specific context. You should also provide a machine-readable Software Bill of Materials (SBOM), evidence of testing (such as simulated clinical scenarios), and detailed records of workflows, including patch intake, verification, and rollback procedures.

Censinet RiskOps™ simplifies this process by automating tracking, consolidating monitoring efforts, and making compliance documentation more manageable.

Related Blog Posts

• How to Secure Medical Device Software Updates
• Best Practices for IoT Device Inventory in Healthcare
• How Code Integrity Protects Medical Device Software
• IoMT Firmware Security: Problems and Solutions