Medical Device Cybersecurity Risk Assessments: Engaging Clinicians to Mitigate Threat

This article details an evidence-based cybersecurity risk assessment of a medical devices project in a health system located in the Gulf Coast region of the United States. The assessment identified clinically relevant medical devices with cybersecurity risks and their severity. Clinicians were provided medical device cybersecurity education and were engaged to use the Center for Internet Security Risk Assessment Method (CIS RAM) while ranking high-risk medical devices according to clinical workflow inconvenience and potential to harm patients. This work may serve as an exemplar for other hospitals to include clinical leaders in medical device cybersecurity risk assessments and underscores the value clinicians bring to mitigation of cybersecurity threats.

Continuing Education Instructions and Disclosure Information:

Contact hours available until 11/30/2026.

Requirements for Successful Completion:
Complete the learning activity in its entirety and complete the online nursing continuing professional development evaluation. You will be able to print your NCPD certificate at any time after you complete the evaluation.

Disclosure of relevant financial relationships with ineligible companies (planners, faculty, reviewers, authors):

Faculty, Planners, and Reviewers Conflict of Interest Disclosure:
The editor, content reviewers, and director of education reported no actual or potential conflict of interest in relation to this continuing nursing education article.

Author(s) Disclosures:
There are no author disclosures to declare.

Commercial Support:
No commercial support declared.

Accreditation Statement:
This educational activity is jointly provided by Anthony J. Jannetti, Inc. (AJJ) and the American Nursing Informatics Association (ANIA).

Anthony J. Jannetti, Inc. is accredited as a provider of continuing nursing education by the American Nurses Credentialing Center’s Commission on Accreditation. Anthony J. Jannetti, Inc. is a provider approved by the California Board of Registered Nursing, provider number CEP 5387.

Learning Outcome:
After completing this education activity, the learner will be able to discuss the use of the Center for Internet Security Risk Assessment Method (CIS RAM) to complete a medical device security risk assessment, and the importance of involving clinicians in the security risk assessment and mitigation process.