Where connected medical systems and AI actually fail — not in theory, but in the moment when the decision still has to be made. Built from 28 years of clinical reality and lived device dependency.
Hospitals and homes are full of connected devices that keep people alive. What happens when those devices fail — or get hacked? Explore real scenarios and make real decisions.
At 2am in the ER, I'm not waiting on a dashboard. Healthcare doesn't pause for data validation. Our security frameworks need to stop assuming it does.
Imagine you're a nurse at 2am. A patient needs help right now. You don't have time to wait for a computer to tell you what to do. You have to make a decision in seconds. That's why health technology security matters — people's lives depend on it working correctly.
Most healthcare cybersecurity focuses on protecting data. This lab focuses on what happens when the technology keeping a person alive fails — in real time, under real conditions, with real consequences that no framework fully accounts for.
I teach it. I live it. I build it. I'm learning how attackers see it — so I can defend it better than anyone who only knows one side. This is how I protect my patients. My devices. Myself.
Battery indicator reports full charge. Device loses power within minutes. No backup source. Power infrastructure unstable.
A machine that helps someone breathe says its battery is full — but it's not. When the power goes out, the machine stops working after less than 3 minutes. The person has no backup. What should happen? What went wrong?
A portable oxygen concentrator is a machine about the size of a small backpack that pulls oxygen from the air and delivers it through a tube to someone who needs help breathing. People with lung conditions like pulmonary hypertension (PAH) depend on these 24/7. The device this scenario is based on? It's real — and it belongs to the person who built this lab.
If this were a smartphone, we'd expect a low battery warning at 20%, 10%, and 5%. Why don't life-critical medical devices have the same protections? This is a design problem — and it's something the healthcare technology industry needs to fix.
Real-time battery health telemetry with verified discharge testing. Mandatory backup protocols for single-source oxygen-dependent patients. Infrastructure dependency mapping for high-risk home medical devices. Emergency registry enrollment at local utility and fire department level.
The device should send a real warning when battery health is low — not just show a number. Patients who depend on oxygen 24/7 should always have a backup plan. Local fire departments should know which homes have oxygen-dependent patients so they can help during power outages. These are simple fixes that could save lives.
AI triage scores patient low acuity. Clinician overrides based on observation. System flags the override as anomalous.
A computer program says a patient isn't very sick. But the nurse can see with her own eyes that something is wrong. She overrides the computer — and turns out to be right. But then the computer marks her decision as a mistake. Who was actually wrong?
Hospitals use AI programs to help decide which patients need care the fastest. The AI reads information from computers — like test results and symptoms typed in. But it can't see what a trained nurse sees: the color of someone's skin, how hard they're working to breathe, or whether they look scared. That's called clinical intuition — and it takes years to develop.
Should a computer ever be able to overrule a trained medical professional? What should the relationship between AI and human experts look like in healthcare? There's no perfect answer — but it's one of the most important questions in health technology right now.
Override logging that distinguishes expert judgment from error. Model retraining governance requiring human review. Mandatory human-in-the-loop thresholds for high-acuity clinical AI. Regular red-team exercises against experienced clinician baseline.
The computer should recognize when an experienced nurse overrides its decision and treat that as valuable information — not a mistake. AI in healthcare should always support human experts, never replace them. A nurse's eyes and instincts are data too.
Networked pump receives unauthorized parameter update during active medication delivery. Nurse managing four other patients simultaneously.
A hacker gets into the hospital's network and changes the settings on a machine that's giving a patient medicine. The nurse is too busy to notice right away. This is how a cyberattack can directly hurt a patient.
An infusion pump delivers medicine directly into a patient's bloodstream at a very precise rate — sometimes drop by drop. Getting the rate wrong by even a small amount can be dangerous. Modern pumps connect to hospital networks so nurses can update medication settings from a central station. That convenience also creates a security risk.
This is why cybersecurity in healthcare isn't just about protecting private information — it's about protecting people's lives. A hacker who gets into a hospital network isn't just stealing data. They could potentially change how medicine is delivered to patients. That's why health technology security is one of the most important fields you could choose as a career.
Mutual TLS authentication for all pump updates. Real-time anomaly detection on rate changes. Clinical workflow-aware alerting. Mandatory FDA MedWatch reporting integration.
The pump should require a verified password or key before anyone — or any computer — can change its settings. Any change should immediately alert the nurse at the bedside, not just log it somewhere. Medical devices connected to networks should be treated like the life-critical systems they are.
Before attackers touch a network, they watch it. What they find in 30 minutes would surprise most security teams.
Your Apple Watch says you're fine. The clinical system believes it. The coach clears you to play. You are not fine. Two perspectives — the clinician receiving spoofed data, and the patient whose data is being manipulated — same failure, different stakes.
Smartwatches and fitness trackers measure your heart rate, oxygen levels, and activity. But what if someone could fake that data? What if your watch said your heart rate was normal when it wasn't? What decisions would get made based on wrong information?
Consumer wearables like the Apple Watch now include medical-grade sensors — ECG, blood oxygen (SpO2), heart rate variability, fall detection, and irregular rhythm notifications. These devices are increasingly used in clinical decision-making, athlete performance monitoring, remote patient monitoring programs, and insurance wellness programs. The data they generate is trusted. That trust is the attack surface.
Data integrity verification at every point in the wearable-to-EHR pipeline — not just transmission encryption, but authenticity verification of the data itself. Clear regulatory boundaries on when consumer wearable data can be used for clinical decision-making. Anomaly detection that compares wearable data against in-person vitals to flag statistical improbability. Sports medicine protocols that require human clinical confirmation before automated clearance decisions. The gap between consumer wellness device and clinical medical device is where attackers live — and no current framework addresses it adequately.
Any data used to make medical decisions needs to be verified as real — not just transmitted securely, but confirmed as authentic. A doctor or athletic trainer should never rely solely on wearable data without a human check. Consumer devices like Apple Watches are not regulated as medical devices — but they're increasingly used to make medical decisions. That gap needs to be closed. This is a career opportunity for the next generation of health technology professionals.
The EHR is locked. The patient is crashing. 90 seconds. No medication history. This is not a drill.
Connected to the internet. Receives automatic firmware updates via the myAir remote monitoring platform. Documented CVEs exist on this exact device. The patient depending on it is also the analyst who built this lab.
A CPAP machine that helps someone breathe at night connects to the internet to send sleep data to doctors. But that same connection can also receive software updates — and if an attacker gets into that channel, they could change how the device works while the patient is asleep.
The ResMed AirSense 11 AutoSet is a CPAP machine that connects to ResMed's myAir cloud platform via cellular or WiFi. It transmits nightly sleep therapy data and can receive remote configuration changes from clinicians. It also receives automatic firmware updates. This scenario is built from the actual device used by the person who created this lab — and from documented vulnerability research on the ResMed connected device ecosystem.
The person who built this lab uses a ResMed AirSense 11 every night. She also has a condition called pulmonary hypertension that makes breathing more difficult. This scenario isn't theoretical — it's personal. That's what makes healthcare cybersecurity different from any other type of security work.
Mandatory patient notification and consent before any remote firmware update on a home medical device. Cryptographic code signing with independent verification before update acceptance. Anomaly detection on therapy parameter changes post-update. FDA-mandated Software Bill of Materials (SBOM) for all connected home medical devices. Patient-accessible audit log of all remote device interactions. These protections do not currently exist as enforceable standards for home CPAP devices.
Before any medical device gets a software update while a patient is using it, the patient should be notified and should agree to the update — just like how your phone asks you before installing updates. The update should be verified as coming from the real manufacturer. And any changes to how the device works should be flagged to the patient's doctor immediately.
A cognitively impaired patient living at home relies on a connected ecosystem of smart sensors, GPS tracking, automated medication dispensers, and telehealth platforms. Each device is a lifeline. Each connection is a potential failure point. The patient cannot self-advocate when the system fails.
As health technology improves, more people with memory conditions like Alzheimer's and dementia can live at home longer — with the help of connected devices. But what happens when those devices fail, get hacked, or just stop working? The patient often can't tell anyone something is wrong.
According to the 2025 WHO report on dementia and digital health, AI-powered diagnostic tools, smart home monitoring sensors, GPS tracking devices, telehealth platforms, cognitive aid applications, automated medication dispensers, and robotic companion devices are now core components of modern dementia home care. These technologies reduce caregiver burnout, lower emergency visits, and allow patients to live safely at home longer. They are also almost entirely unsecured from a cybersecurity standpoint.
According to the WHO, over 55 million people worldwide live with dementia. As health technology allows more of them to live at home independently, the security of those technologies becomes a matter of life and safety. This is one of the most important unsolved problems in healthcare cybersecurity today — and almost nobody is working on it.
A dedicated security framework for connected home care ecosystems serving cognitively impaired patients — distinct from hospital IoMT frameworks because the patient cannot self-advocate. Mandatory network segmentation between home care devices and general household WiFi. Caregiver alert integrity verification — dashboards must confirm data authenticity, not just data presence. AI anomaly detection trained specifically on dementia patient behavioral patterns. Regulatory classification of dementia home care technology ecosystems as life-critical infrastructure. The 2025 WHO report on digital dementia care identified telehealth and connected monitoring as transformative — but makes no mention of cybersecurity. That gap is the problem.
Home care devices for people with dementia need their own security rules — separate from hospital rules — because the patient can't tell anyone when something goes wrong. Family members and remote caregivers need to know when device data might not be trustworthy. And the companies building these devices need to design security in from the beginning, not add it later. Right now, very few people are working on this problem. That could be you.
A compromised continuous glucose monitor transmits falsely normal readings. An endocrinologist makes an insulin dosing decision on manipulated data. The patient never knew the signal was wrong.
Select a scenario — read the situation — make the call.
Read the situation carefully. Pick the best response. Learn from every answer.
Real incidents. Real patient impact. Real framework gaps. Ransomware attacks on hospitals are attacks on human life — not just data.
| Organization | Date | Attack Vector | Patient Impact | Recovery | Framework Gap | Severity |
|---|
Healthcare cybersecurity is one of the fastest-growing and most underpopulated fields in security. These are the roles that sit at the intersection of clinical knowledge and technical skill — where the real work happens.
Did you know you can have a career that combines healthcare, technology, and protecting people — all at the same time? These are real jobs that real people do every day to keep hospitals safe and patients protected. Which one sounds like you?
Take health classes seriously. Learn basic coding (Scratch, Python). Explore biology and computer science. Ask questions about how technology works.
AP Computer Science. Biology and health science courses. Cybersecurity clubs and competitions (CyberPatriot). Volunteer at hospitals or clinics to understand the environment.
Health Informatics, Cybersecurity, or Biomedical Engineering degrees. Internships at hospitals or health tech companies. Certifications like CompTIA Security+ and HCISPP.
This lab was created by Chaunda C. Dallas, MSIT — healthcare cybersecurity consultant, IoMT risk specialist, and clinical emergency medicine professional with 28+ years of direct patient care across ER, interventional radiology, hyperbarics, and pediatric care.
The scenarios here are not theoretical. They are built from the intersection of clinical expertise and daily device dependency — managing pulmonary hypertension on a portable oxygen concentrator, with a CPAP connected to the internet, and no insurance safety net.
Featured Defender in the Semperis documentary 'Midnight in the War Room' — premiering at Black Hat USA 2026.
Ms. Chaunda teaches health technology to middle school students, mentors 200+ women in cybersecurity through WiCyS, and will be featured in a documentary about hospital ransomware attacks at Black Hat USA 2026 — one of the biggest cybersecurity conferences in the world.