Study: Impact of Authentication on Medical Device Security

Weak login controls on medical devices can affect care, not just data. I found one clear pattern across the research from 2012 to 2024: devices with default passwords, shared accounts, poor device checks, or weak session controls are more open to bad access, false data, and therapy changes.

Here’s the short version:

• Weak authentication is still common in infusion pumps, implantables, remote monitoring tools, and IoMT sensors.
• Patient safety is part of the risk. Bad actors may change settings, block alarms, or tamper with readings.
• Stronger controls help most when they protect high-risk tasks like therapy changes, firmware updates, and vendor access.
• Workflow matters. If logins slow staff down, people may fall back to shared accounts or open sessions.
• Legacy devices are a major problem. Many hospitals still run old systems that are hard to update or retire.
• Inventory, SBOM review, procurement checks, and post-sale tracking help teams find weak points before they turn into larger issues.

A few numbers stand out:

• CVE-2021-33882 in B. Braun infusion pumps had a CVSS score of 9.7
• 44% of healthcare groups were reported to be using end-of-support devices with known flaws
• 81% said SBOMs are important or required in purchasing and risk review

Implementing PKI for Medical Devices: A Practical Guide

sbb-itb-535baee

Quick Comparison

If you want the main takeaway in one line, it’s this: better authentication lowers device risk, but only when it fits how care teams actually work.

Common Authentication Weaknesses Found in Medical Devices

Default Credentials, Shared Accounts, and Missing Device Verification

A lot of the risk starts with the basics: weak credential handling and poor device verification.

The most common failures are plain and simple. Think default passwords, hard-coded credentials, and shared logins used across single units or entire device fleets. A 2023 analysis found that the most serious vulnerabilities were tied to poor credential management, hard-coded credentials, and privilege errors.^[10] Hard-coded passwords are hard to rotate and often get reused across a product line.^[10]

When credentials break down, attackers can get into therapy controls, monitoring functions, and device settings. Shared accounts make this worse because they blur accountability and make stolen credentials easier to use.^[10] If an attacker gets one valid login, that access may not stay contained. They can move laterally from a compromised device into EHR systems, clinical applications, or other connected endpoints.^[8]

Another common gap is one-way authentication. In those setups, the device checks the server, but the server doesn't check the device. That opens the door for rogue or cloned endpoints to enroll as trusted systems and start sending commands or pulling data.^[12][15]

Authentication Issues by Device Type: Infusion Pumps, Implantables, and IoMT Sensors

These failures don't look the same across every device class. Battery limits, communication constraints, and day-to-day care workflows all shape which controls manufacturers can realistically deploy.

For smart infusion pumps, one study found that many hospitals still relied on universal passwords, unchanged keys, and shared credentials.^[19] NIST guidance on wireless infusion pumps also points to default maintenance passcodes as a major weakness, noting that attackers can use them to install malware, change configuration settings, or extract PHI.^[22][23]

Implantable cardiac devices bring a different set of problems. They often use lightweight authentication, which can lead to weak or missing device-to-programmer verification.^[18] In some assessments, physician programmers required no user authentication at all, which meant anyone with physical access could reprogram supported implants.^[18] Research on implantable cardioverter-defibrillators (ICDs) also showed that a device could be forced to keep communicating with an unauthenticated external device, draining the battery and creating a denial-of-service condition.^[20][24]

Remote monitoring platforms and IoMT sensors have their own weak points. Weak session handling, password-only portals, and cloned devices can damage monitoring reliability and the integrity of clinical data.^[12][15][9]

Why Authentication Gaps Persist in Healthcare Workflows

A big reason these gaps stick around is that many legacy devices can't support stronger authentication without vendor updates or hardware replacement.^[10][14] Until that happens, many organizations are stuck relying on passwords and shared accounts.

In ICU and emergency settings, extra login steps and pairing delays can slow care at the worst possible moment.^[11][13] So teams often fall back on workarounds, like shared credentials passed across shifts.^[11][16] It's not hard to see why this happens. When speed matters, security controls that add friction often get pushed aside.

Ownership is another problem. Device management is often split across clinical engineering, IT, security, and outside vendors. That kind of fragmentation slows credential policy enforcement and remediation.^[8][10]

When these weaknesses touch therapy delivery, monitoring, or device trust, the risk gets much more serious.

Security and Patient Safety Impact of Weak vs. Strong Authentication

How Weak Authentication Enables Cyberattacks

These access gaps matter because an authentication failure doesn’t just expose data. It can hand over direct control of device behavior. Once an attacker gets onto the hospital network, exposed device interfaces become simple targets. Weak authentication can let them reuse stolen credentials, get into privileged functions, and change device settings.^[26][1]

The clinical effect can show up fast. Tampered alarms, altered thresholds, and falsified telemetry can undermine monitoring and delay intervention.^[25][27] If a device lacks strong cryptographic authentication, an attacker may capture valid command packets and send them again to trigger unauthorized actions, such as suppressing alarms or changing dosage settings.^[7][1]

Researchers identified CVE-2021-33882 in B. Braun infusion pumps. The flaw, scored 9.7 on the CVSS scale, was classified as a missing authentication for critical function issue and allowed remote reconfiguration of pump settings over an unauthenticated proprietary TCP protocol.^[17][31] And the risk doesn’t stop with one device. A single weakly protected system can become a stepping stone into nearby systems, including EHR platforms and clinical applications.

Clinical Consequences for Therapy Integrity and Monitoring Reliability

The patient safety impact is direct. If attackers can modify alarm thresholds or disable alerts, continuous monitoring stops being something clinicians can fully trust. Early signs of deterioration may be missed because the data on screen has been changed or suppressed.^[26][1]

Weakly authenticated telemetry channels can also be used to inject false readings. That can push care teams toward treatment decisions based on incorrect vital signs or therapy status.^[7][1] In a clinical setting, that’s not a small technical glitch. It affects the information people rely on at the bedside.

The FDA has warned that vulnerabilities in insulin pump communications protocols could allow an unauthorized person to deliver too much or too little insulin, directly linking authentication gaps to treatment accuracy.^[30] Regulators treat flaws that allow unauthorized access and changes to device behavior as high-risk because they can lead to delayed treatment, wrong therapy settings, or failure to detect adverse events in time.^[21][2]

Even when no physical harm is documented, the disruption is still serious. Clinical teams may need to do more manual checks, compare readings across systems, and remove affected devices from service while the issue is investigated. That slows care and puts extra strain on already busy workflows.^[21][29]

Weak vs. Strong Authentication Models

Stronger authentication doesn’t erase risk, but it can make attacks much harder and more expensive to carry out. Public-key authentication blocks password guessing and password reuse, while also supporting mutual authentication that helps stop spoofing and replay. MFA for privileged actions adds another checkpoint, so a stolen password by itself can’t start a configuration change or remote maintenance session. Centralized hospital identity services also improve revocation and auditing.^[25][6][28]

Of course, stronger controls come with tradeoffs. They can add integration work and, at times, login friction. That burden makes the most sense when it is aimed at high-risk actions, such as therapy changes and firmware updates.

The key issue isn’t whether stronger authentication helps. It’s how to use it in a way that protects patients without getting in the clinician’s way.

The remaining challenge is matching stronger controls to clinical workflow.

Usability, Regulatory Expectations, and Operational Trade-Offs

How Clinician Workflow Can Undermine Sound Security Controls

The strongest authentication control can fall apart if clinicians can't use it smoothly during patient care. When logins are slow, repeated too often, or get in the way of treatment, staff often work around them with shared credentials, open sessions, or generic accounts.^[33][34][35]

Login fatigue is not just an annoyance. It's a documented issue. Nurses, physicians, and technicians may need to sign in to several bedside devices during one shift, and that mental burden stacks up fast.^[33][34][35]

Biometrics don't fix this on their own. In clinical settings, fingerprint and facial recognition systems have shown frequent failures because gloves, masks, and uneven lighting get in the way of capture.^[33] On paper, that may sound fine. At the bedside, it's a different story.

The stakes get higher in a code blue or ICU emergency. A multi-step login can slow time-critical care.^[34][35] Break-glass access helps keep things moving in those moments while still preserving audit logs and post-event review.^[38][39] That's the trade-off healthcare teams have to manage: speed during care, control after the fact. And that tension makes regulatory alignment harder, not less important.

What the Findings Mean for FDA-Aligned Cybersecurity Programs

This is exactly why FDA expectations carry so much weight. FDA guidance treats authentication as a core security requirement for networked medical devices, alongside cryptography and integrity as a fundamental control.^[25][4][6] Under section 524B of the FD&C Act, manufacturers of cyber devices must show these controls in premarket submissions.^[3][2][5]

For U.S. healthcare governance teams, the message is pretty direct. HIPAA's Security Rule requires unique user identification and emergency access procedures. It also addresses automatic logoff and encryption/decryption for systems that store ePHI.^[36][37] These requirements line up closely. If a device depends on shared accounts or default credentials, it falls short of both FDA expectations and HIPAA technical safeguards at the same time.

In practice, that points to a few clear moves:

• Require enterprise single sign-on
• Enforce unique user accounts and session timeouts
• Use postmarket monitoring to find places where workflow pressure weakens controls^[29][5]

Platforms like Censinet RiskOps™ can help teams coordinate assessments of vendor and internal controls tied to authentication, PHI access, and clinical applications, so governance groups can track gaps and progress.^[32]

These controls set the baseline. The next issue is which authentication models tighten security without adding more friction to clinical work.

Emerging Authentication Approaches and Risk Management Next Steps

Beyond device controls, the research points to procurement and lifecycle management as the next layer of defense.

What Recent Research Says About Legacy Fleets and Procurement

Recent research points to three core controls: inventory, SBOM review, and procurement standards. Legacy devices remain a stubborn problem because healthcare reimbursement is usually tied to the volume of procedures or services delivered, not the age or security posture of the equipment ^[40]. At the same time, enterprise risk management is moving away from looking back at past issues and toward predicting how devices will hold up against new attacks ^[40].

One of the clearest ways to spot weak points is benchmarking data. The latest Medical Device Innovation Consortium (MDIC) benchmarking report brought together anonymized security maturity data from 27 medical device manufacturers ^[40]. Healthcare teams are also encouraged to use the Health Sector Coordinating Council's (HSCC) Joint Security Plan (JSP) as a reference guide across the full product lifecycle ^[40].

Those findings only help if teams can track them across the fleet.

How Structured Risk Operations Support Medical Device Security

The tougher part is putting those controls into day-to-day practice at scale. A complete, continuously updated device inventory is the starting point. Without it, teams can't tell which devices are running past end-of-support or still relying on hardcoded credentials. Recent research found that 44% of healthcare organizations are currently running end-of-support devices with known vulnerabilities ^[41].

MDS2 forms and SBOMs give procurement teams a way to catch authentication gaps before a purchase is made. In one survey, 81% of organizations rated SBOMs important or essential ^[41]. Benchmarking adds one more layer. MDIC, working with the HSCC, used the Joint Security Plan (JSP) as a reference framework to show where security maturity falls behind peers ^[40].

Key Takeaways for Healthcare Security Leaders

The practical lesson is simple: authentication has to be managed as a lifecycle control, not a one-time feature.

Authentication isn't a checkbox. The research lines up on this point: weak authentication increases the risk of unauthorized device access and can affect patient care. Stronger controls work best when they sit alongside steady inventory management, procurement review, and lifecycle oversight.

For healthcare security leaders, the next step is to put a few basics into practice:

• Maintain a complete inventory
• Use benchmarking to spot gaps
• Require security documentation during procurement
• Track remediation over time

That shift moves medical device security from reactive to resilient.

FAQs

Which medical devices face the highest authentication risk?

Devices with the highest authentication risk are usually legacy equipment and IoMT devices that were never built with modern security in mind. Imaging systems, pump controllers, and patient monitoring devices tend to sit near the top of that list.

The risk gets worse when those devices run outdated or unsupported systems. It also climbs when they don’t have multi-factor authentication or role-based access control. Add hardcoded credentials, shared passwords, or insecure remote access, and you’ve got a weak spot that’s hard to ignore.

How can hospitals strengthen authentication without slowing care?

Hospitals can tighten authentication without slowing patient care by using risk-adjusted access policies. The idea is simple: make access easy for low-risk, routine tasks, and ask for more proof only when the risk goes up.

For shared workstations, badge tap-and-go paired with a PIN or biometrics gives clinicians fast, secure access. And with session roaming, they can move from one device to another without losing their place, which cuts friction during busy shifts.

A few policy choices make a big difference:

• Use short re-authentication grace periods
• Apply step-up multi-factor authentication only for sensitive actions
• Keep emergency break-glass procedures in place so critical device functions remain available during urgent care

That way, staff aren’t hit with extra prompts at the worst possible moment, but higher-risk actions still get tighter checks.

What should buyers check before purchasing connected medical devices?

Buyers should check whether the device meets strong security standards. That includes unique user IDs, RBAC, MFA, and centralized logging.

They should also review MDS2 forms and SBOMs for weak points. Just as important, they need to confirm that the vendor offers ongoing support, clear security patch timelines, vulnerability disclosures, and alignment with HIPAA and FDA cybersecurity guidelines. Censinet RiskOps™ can help make that review process smoother.

Related Blog Posts

• 7 Critical Medical Device Security Risks in Healthcare
• IoT Device Authentication for Medical Devices: Guide
• Study: 162 New Medical Device Vulnerabilities Found
• Best Practices for Medical Device Access Control