The Internet of Medical Things (IoMT) comprises a vast array of medical devices used in healthcare settings. For healthcare IT and managed service providers (MSPs) that deal with medical providers, the highly varied and critical nature of these devices presents management, governance, and security challenges.
This guide explains what tech teams need to know about IoMT to provide effective, secure, and compliant IT services in healthcare environments.
What is the Internet of Medical Things (IoMT)?
IoMT covers any embedded network device used for medical purposes or in a healthcare environment. This is a diverse, vast field of devices that include wearables, sensors, monitors, implants, pumps, and other smart devices (some of which may also be used outside a healthcare setting). It also covers the apps and cloud platforms used to monitor and manage these devices.
IoMT differs from Internet of Things (IoT) in purpose: it’s the use case and setting (as well as its potential impact on the well-being of people) that defines the category. Connected devices intended for medical use, or used in medical settings such as hospitals, clinics, patient homes, mobile care settings, and for remote monitoring programs, that connect using Wi-Fi, cellular, Bluetooth, or wired connections, are considered IoMT.
Common examples of IoMT devices and how they support healthcare operations
Common examples of IoMT that support clinical care, patient monitoring, facility operations, and healthcare administration include:
- Remote patient monitoring devices
- Wearable health monitors
- Glucose monitors
- Blood pressure monitors
- Smart infusion pumps
- Connected imaging systems
- Hospital patient monitors
- Smart beds
- Medication tracking devices
- Connected diagnostic tools
- Emergency response devices
- IoT healthcare monitoring system components
These devices help healthcare staff monitor and advise patients inside as well as outside medical environments (i.e., telehealth and remote care for home treatment), continuously tracking vital signs and other live data and sending alerts to medical teams. This reduces manual labor, makes healthcare more accurate and efficient, and supports faster clinical decision-making.
Typical IoT devices that can become IoMT include temperature and other sensors used to monitor patient rooms or help automate and maintain care facilities.
IoMT management and security challenges
The broad categorization and distributed nature of IoMT makes management inconsistent: different devices rely on different connection methods and platforms, and not every device has the same risk level.
Devices that collect and transmit patient data, or protected healthcare data (PHI), and/or that connect to systems that do, require stronger oversight and protection than basic sensors. These measures should include:
- Maintaining a complete device inventory: Visibility gaps can easily appear as the number of IoMT devices increases.
- Identifying legacy devices with limited patch options: EOL devices or devices with known security vulnerabilities should be tracked to ensure they are properly isolated or mitigated.
- Assign ownership of all devices and establish responsibility: Assign ownership of devices to reduce management gaps, and clarify with vendors where their responsibility begins and ends.
- Implement network segmentation: Keep IoMT devices on their own network, and only explicitly grant access to the services they require to operate (including integration with clinical systems).
- Avoid weak or shared credentials: IoMT management tools (including apps and cloud services) should be secured using strong credentials that are not shared among staff.
- Maintain consistent, thorough documentation: Document the above alongside other relevant operational information, including uptime requirements, compliance considerations, how they integrate and interact with other clinical systems, and any other risks.
Common mistakes IT teams make when managing IoMT
Treating IoMT the same as IoT is the primary mistake IT teams and MSPs make, leading to further missteps that compromise security and operations. While IoT should be kept as secure as possible, available resources do affect prioritization, and while this is less of an issue in business environments, security and privacy are much more important factors in healthcare.
IoMT devices that collect, transmit, or connect to systems that host PHI cannot be treated like regular endpoints or other IoT devices. Compliance must be maintained at all times, in accordance with HIPAA and other local regulations that protect patient privacy.
Lifecycle planning is also a common shortfall: IoMT devices must be accounted for, kept up-to-date, and retired as soon as possible when they are no longer receiving updates. This can be particularly challenging in healthcare, where expensive medical equipment may only be compatible with legacy hardware or operating systems. This often requires creating exceptions to policy and implementing specific controls for those devices, such as airgapping or additional monitoring.
How healthcare IT teams should manage IoMT at scale
Internal IT teams and MSPs that manage IT operations for healthcare organizations must be able to securely monitor and manage IoMT devices. This requires compliant IT toolchains that can grant access to devices that may handle sensitive PHI.
NinjaOne provides a unified IT operations platform that combines mobile device management (MDM), remote monitoring and management (RMM), network monitoring, documentation, and remote access, with built-in compliance that makes it suitable for many healthcare use cases.
