Witnesses warn legacy medical devices create ongoing cybersecurity risks to patient care

A House Energy and Commerce Subcommittee hearing on aging medical technology heard experts say legacy medical devices — equipment that cannot be reasonably protected against current cybersecurity threats — pose an ongoing risk to patient safety and health-care operations.

Witnesses told the Subcommittee on Oversight and Investigations that medical devices are increasingly computer-based, often run on unsupported software, and can remain in hospitals for a decade or more, creating widespread exposure when vulnerabilities are discovered. "Medical devices are miraculous," said Dr. Christian Dameff, co‑director of the UC San Diego Center for Healthcare Cybersecurity. "At their core, many modern medical devices are just computers. And this means there will be unavoidable flaws in software and hardware."

The concern is not limited to large hospitals. "The financial and operational stress that rural and critical access…