Congressional Hearing on Cybersecurity Vulnerabilities in Medical Devices

On April 1, 2025, Congressman Brett Guthrie (KY-02), Chairman of the House Committee on Energy and Commerce, and Congressman Gary Palmer (AL-06), Chairman of the Subcommittee on Oversight and Investigations, held a hearing titled Aging Technology, Emerging Threats: Examining Cybersecurity Vulnerabilities in Legacy Medical Devices. The hearing is focused on addressing the growing cybersecurity risks in medical devices, which are critical for diagnosing, monitoring, and treating patients across healthcare systems.

Guthrie and Palmer emphasized that while medical devices play a vital role in patient care, many contain significant cybersecurity vulnerabilities that can expose healthcare systems to cyber threats.

Premier, Inc. issued a statement in response to the hearing. In its statement, Premier warned that as healthcare organizations integrate emerging technologies like artificial intelligence (AI), the Internet of Medical Things (IoMT), and connected devices, the vulnerability of healthcare systems to cyberattacks grows. The increasing sophistication of cyber adversaries, coupled with outdated legacy systems, exacerbates this threat. Premier pointed out that unlike other critical industries, healthcare cybersecurity has lagged behind due to fragmented regulations and a lack of clear federal oversight, leaving healthcare organizations exposed to significant cyber risks.

In its statement, Premier called for urgent action from Congress to modernize cybersecurity protections for medical devices. Premier’s key recommendations include:

• Governance
• Shared Responsibility
• Objective Data Collection
• Fair Breach Penalties
• Emergency Use Authorization (EUA) Clarity