Legacy apps and medical devices continue to pose persistent and considerable risk to healthcare IT environments, and many organizations are still unaware of their prevalence in their settings, said Keith Fricke, partner and principal consultant at tw-Security.
To get a better handle on these products, it’s imperative for healthcare entities to take several critical steps, he said in an interview with Information Security Media Group conducted at the Healthcare Information and Management Systems Society 2025 conference in Las Vegas, Nevada.
For instance, “it’s important for them to take a look at any MDS [manufacturer disclosure statement] forms that the vendor may release that has the security profile for the device and understand what the migration path is to a more recent version that might have more security controls,” he said.
“Also, segmenting those products on a network if possible” is also highly recommended for healthcare providers, he said. As for new products entering their environments, “it’s important for them to have a sound practice on how they evaluate new devices.”
In this audio interview with Information Security Media Group (see audio link below photo), Fricke also discussed:
- Top lessons for the healthcare sector in the aftermath of the massively disruptive Change Healthcare ransomware attack last year and its data breach affecting 190 million people;
- The lack of governance around artificial intelligence in healthcare;
- Other critical cybersecurity and privacy issues facing the healthcare sector.
Fricke provides virtual CISO and cybersecurity advisory services for covered entities and business associates at tw-Security. He has more than 35 years of experience in IT with 19 years focused on healthcare information security tactical and strategic initiatives. Before joining tw-Security, Fricke served as CISO at Mercy Health, formerly Catholic Health Partners, covering 24 hospitals across three states.