Illustrative scenario
Picture Monday morning. The assessment report lands in your inbox. You open it, scroll, and keep scrolling. There are hundreds of findings. Maybe more. Your team is already stretched thin, and now you're holding a list that could keep them busy for two years.
Where do you start?
Your hospital already knows the answer. It's called triage. When the emergency department fills up, nobody treats patients in the order they walked in. They treat the person who is in the most danger first. A sprained ankle waits. Chest pain doesn't.
Device security works the same way. The mistake most teams make is sorting findings by how scary the technical label sounds. That's like triaging by how loud someone is yelling. Instead, ask three simple questions about every device.
Prioritize by patient impact
First, what can it reach? A camera that can only talk to its own video recorder is a sprained ankle. A camera that sits on the same network as your patient records is chest pain.
Second, what happens to patients if it's taken over? A lobby sign showing the wrong message is embarrassing. A pharmacy refrigerator that stops reporting its temperature is dangerous.
Third, how hard is it to fix? Some problems take five minutes, like changing a factory password. Others need a vendor, a budget line, and a weekend outage. Quick fixes on high-risk devices go to the top of the list. You'll be amazed how much risk disappears in the first two weeks.
Contain what you cannot fix yet
For the problems you can't fix right away, don't just leave them sitting there. Contain them. If an old controller can't be updated until next year, wall it off so it can only talk to the one system it needs. That buys you time without leaving the door open.
There's a bonus, too, and it makes all of this much easier to sell inside your hospital. Almost everything you find maps neatly to the rules and frameworks you already report against. That includes the HIPAA Security Rule, the HHS 405(d) Health Industry Cybersecurity Practices, the NIST Cybersecurity Framework, and the CIS Controls. When you show your compliance team that fixing a camera password also closes a gap they've been asked about, you gain a powerful ally.
Questions for your team
Is your team sorting findings by technical score or by patient impact? Which five devices on your network would hurt patients most if they were taken over? What could you fix this week in under an hour?