HIMSS Survey: 60% of Health Systems Can’t Protect Unmanaged Medical Devices

HIT Consultant – Read More

What You Should Know

The Report: Elisity has co-published a new research report with HIMSS Market Insights titled The Implementation Paradox: Healthcare Leaders Want Microsegmentation-Level Security Without Disruption.
The Vulnerability: The attack surface is expanding rapidly due to connected medical devices. 62% of respondents flagged an inability to protect unpatchable or agentless devices (IoMT) as a critical or significant limitation, followed closely by poor visibility into device inventory (56%).
The Paradox: While hospitals desperately need microsegmentation to prevent lateral ransomware attacks, 40% cite concerns about disrupting clinical workflows as the primary barrier to implementation. Concurrently, 76% stated it is highly important that a solution entirely avoids clinical disruption.
The Insurance Squeeze: Health systems are running out of time to stall. Nearly half (46%) of respondents reported that their cyber insurance carriers demanded specific security controls during policy renewal or underwriting in the past two years.
The Solution: Legacy segmentation requires massive network overhauls. Modern approaches, like Elisity’s identity-based microsegmentation, bypass this by deploying agentless policies directly onto existing network switches without requiring system downtime.

The Unpatchable Attack Surface

Today, a new report co-published by Elisity and HIMSS Market Insights quantified this exact gridlock. The report, aptly titled The Implementation Paradox: Healthcare Leaders Want Microsegmentation-Level Security Without Disruptionx, reveals an industry that is simultaneously desperate for Zero Trust security and utterly paralyzed by the implementation process.

The HIMSS data highlights a staggering lack of foundational visibility. According to the survey of healthcare IT and security executives, 62% rated their inability to protect unpatchable or agentless devices as a critical or significant limitation. Furthermore, 56% cited poor visibility into their actual device inventory as a major gap.

You cannot secure what you cannot see, and you cannot install traditional endpoint detection software on a proprietary ultrasound machine. This makes microsegmentation—isolating devices on the network so malware cannot spread laterally—the only viable defense.

Yet, 40% of healthcare organizations admit that concerns over workflow disruptions are actively blocking them from deploying microsegmentation.

“For two decades, healthcare did nothing about segmentation because legacy approaches demanded disruptions organizations couldn’t afford,” said James Winebrenner, CEO of Elisity. “Modern microsegmentation breaks that cycle: deploy in weeks on existing switches, cover every device, manage policies simply, zero downtime. A more modern approach is needed so that the industry can seamlessly secure their complex environments, prevent lateral movement attacks, and maintain patient care continuity while achieving HIPAA compliance and HHS 405(d) best practices.”

The Cyber Insurance Mandate

Hospitals can no longer afford to do nothing. The grace period for ignoring lateral movement vulnerabilities is over, and the pressure isn’t just coming from hackers—it’s coming from underwriters.

The report found that nearly half (46%) of healthcare organizations had cyber insurance carriers demand specific controls (like MFA, EDR, and segmentation) during renewal in the past two years. An additional 28% were explicitly required to provide proof of segmentation controls just to maintain their coverage, while 22% faced increased premiums if they failed to comply.

“Healthcare organizations cannot afford any disruptions that traditional security implementations often require,” said Rob Courtney, Healthcare CTO, Carahsoft. “The report’s findings validate that need for a new, modern approach. Proven solutions like Elisity can help overcome the barriers through advanced microsegmentation to improve security posture, accelerate Zero Trust maturity, and quickly deploy with no downtime – critical for maintaining patient care.”

To download the report, visit https://www.elisity.com/blog/himss-medical-device-security-healthcare-microsegmentation.