The Internet of Things (IoT) has long promised to connect everyday products like smart thermostats, appliances, and cars.
More recently, the human body itself has become a key part of this connected world through devices such as fitness trackers, insulin pumps, and pacemakers. However, this has increased cybersecurity risks.
Hacking into medical devices wirelessly to cause harm is no longer just a theme in thrillers like the TV show Homeland or the novel Kill Decision. It is also a serious real-world concern. For example, former Vice President Dick Cheney’s pacemaker was once considered vulnerable to hacking. In 2019, the U.S. Food and Drug Administration (FDA) recalled a certain insulin pump due to cybersecurity threats.
Despite these risks, many medical device makers have continued to release products without fully integrating cybersecurity safeguards. Their main focus has been on patient safety, rather than protection from hackers.
To address this gap, Johns Hopkins Whiting School of Engineering now offers a new course called Medical Device Cybersecurity. This course prepares students for the FDA’s updated approval process, which demands stronger cybersecurity measures throughout the device design.
“Protecting these devices from cyber threats is not just a technical challenge — it is a matter of patient safety,” says the course syllabus. The class is taught by Michael Rushanan, a computer science lecturer who earned his PhD at Johns Hopkins in 2016. He explains, “A security breach in devices like pacemakers and insulin pumps can have life-threatening consequences.”
The course covers the FDA’s cybersecurity guidelines and the steps needed to comply with them — from initial design to final deployment.
Students study real case examples and take part in hands-on exercises and simulations. Their final project requires them to build medical devices with strong cybersecurity protections built in.
Rushanan, who is also chief scientist at Harbor Labs (founded by retired Johns Hopkins professor Avi Rubin), says, “We want students to understand how critical it is to apply cybersecurity risk management from the very start. Without this, manufacturers face costly problems later on.”
Rubin, founder of the Johns Hopkins Health and Medical Security Lab, adds that manufacturers are now more aware of security issues thanks to new FDA rules. Still, he says this course is the first to teach students how to navigate this new regulatory landscape and design secure medical devices from the ground up.
“This is a first-of-its-kind course focused on the unique cybersecurity challenges in medical devices,” Rubin said. “These devices are highly regulated and directly interact with the human body. They also handle sensitive health data, which raises privacy concerns. This course gives students hands-on experience and prepares them for careers in healthcare security.”
On May 12, students presented their projects, all designed with cybersecurity built in. These included:
ThermaTrack: Tracks a patient’s body temperature in real time and alerts caregivers to abnormal changes. The data is securely stored on AWS cloud and accessible via web and mobile apps.
Cardio Crisis: Monitors heart activity with a sensor that sends data through Bluetooth to a smartphone app. It detects heart irregularities in real time to allow fast medical response.
PulseLite: Collects and analyzes heart ultrasound data, enabling remote monitoring and alerting emergency contacts to events like heart attacks.
HappyKittySleepyKitty: Tracks sleep and stress in people with PTSD and anxiety. The device uses AI to give real-time feedback and suggest ways to improve well-being.
NeuroMotion: Monitors movement and medical data for Parkinson’s patients. It helps track treatment progress and optimize care for better recovery and mental health.
