HHS Layoffs Threaten Medical Device Cybersecurity Oversight

As the Department of Health and Human Services (HHS) undergoes mass layoffs, lawmakers and cybersecurity experts warn of dire consequences for medical device security. The Trump administration’s plan to cut over 10,000 staff—including 3,500 from the FDA’s Center for Devices and Radiological Health (CDRH)—could cripple oversight of vulnerabilities in devices like insulin pumps and imaging systems¹. The cuts coincide with a congressional hearing where experts testified that the FDA’s already strained cybersecurity team may fail to respond to concurrent threats².

TL;DR: Key Impacts

10,000+ HHS layoffs include 3,500 FDA staff, primarily from CDRH¹.
FDA’s ability to manage medical device vulnerabilities (e.g., legacy infusion pumps) will degrade³.
Only 55% of hospitals follow cybersecurity best practices for devices, per industry reports².

FDA’s Cybersecurity Capacity at Risk

The FDA’s CDRH division, responsible for reviewing medical device security, was already operating with a “skeleton crew” before the layoffs³. Kevin Fu, former FDA cybersecurity director, testified that losing specialized staff would delay patch approvals for critical vulnerabilities. For example, unpatched insulin pumps with known exploits (CVE-2019-10964) remain in widespread use due to slow FDA review cycles¹. The layoffs could extend response times from weeks to months, leaving hospitals exposed.

Legacy Devices and Threat Landscape

Over 60% of medical devices in U.S. hospitals run on unsupported OS versions like Windows 7². These devices—including MRI machines and patient monitors—often lack encryption or secure boot mechanisms. The Health Sector Coordinating Council (HSCC) found that manufacturers rarely provide patches without FDA pressure³. Recent attacks, such as the Change Healthcare breach, demonstrate how adversaries target these weak points.

“If two cybersecurity incidents occurred simultaneously, FDA wouldn’t be able to meet its mandates.”
— Kevin Fu, ex-FDA cybersecurity director¹

Political and Industry Responses

Democrats, including Rep. Frank Pallone, argue the layoffs jeopardize patient safety by dismantling oversight infrastructure². Republicans counter that manufacturers and CISA should share responsibility, though industry compliance remains spotty. Erik Decker, CISO of Intermountain Health, noted that FDA guidance is often the only driver for manufacturers to address vulnerabilities³.

Relevance to Security Professionals

For threat researchers and SOC teams, the reduced FDA oversight means:

Increased exploit opportunities: Unpatched devices (e.g., GE Healthcare’s vulnerable imaging systems) will linger longer in networks.
Detection gaps: Legacy devices rarely support endpoint monitoring, complicating threat hunting.

Mitigation Strategies

Organizations should:

Inventory all medical devices and isolate those running unsupported OS versions.
Implement network segmentation to limit lateral movement from compromised devices.
Pressure vendors for SBOMs (Software Bill of Materials) to identify vulnerable components.

Conclusion

The HHS layoffs risk creating a regulatory vacuum in medical device security at a time when ransomware groups increasingly target healthcare. Without FDA enforcement, hospitals and manufacturers must proactively address vulnerabilities—or face breaches with life-or-death consequences.