Discussions of hospital security pull inwards almost by gravity: staff training, endpoint management, EMR permissions. All of it matters. But looking at the structure common to published breach cases, the entry point frequently was not inside the hospital at all.
A known vulnerability in an appliance installed for maintenance. A dedicated line pulled in for one departmental system. A device manufacturer's remote monitoring link. A connection to an affiliated facility. Every one of them was installed because it was needed. And in most cases, the department that installed it is not the department watching security.
Supply chain risk is the set of connections built for good reasons that nobody is looking at as a whole. This article sets out where that risk sits structurally, how to prioritise visibility with limited staff, and what to fix in contracts and operations.
Disclaimer: This article is general information. It does not discuss any specific hospital's breach; it organises the structures common to published cases as patterns. The authoritative texts are the MHLW and METI/MIC publications.
Four Routes In
| Route | Examples | Why it stays invisible |
|---|---|---|
| ① The supplier's suppliers | Cloud platforms, monitoring SaaS and offshore development behind your EMR vendor | They sit behind your counterparty and are not visible to you |
| ② Departmental systems | Laboratory, dialysis, rehabilitation, endoscopy, health screening, catering | The department owns the relationship; IT never registered the system |
| ③ Medical devices and maintenance paths | Imaging systems, patient monitors, remote monitoring, maintenance lines | Procured as "equipment", never managed as network equipment |
| ④ Partners and affiliated facilities | Laboratories, pharmacies, home-visit nursing, group sites | You cannot control the other party's security level |
What unites them is that each was installed as an operational necessity before anyone framed it as a security question. Nobody cut corners. Which is exactly why individual vigilance does not solve it and a structural mechanism for visibility is required.
The MHLW guidelines (edition 6.0) apply to "all those involved in the introduction, operation, use, maintenance and disposal of any medical information system" — not only the EMR. See The Three-Ministry Guidelines.
① The Suppliers You Never Contracted With
You contract with one vendor. Behind them sit the cloud platform, monitoring services, a CDN, mail delivery, outsourced development. Without visibility into that chain, an incident leaves you unable to locate even where it originated.
Ask "do you subcontract?" on a check sheet and the answer often comes back no — not from bad faith, but because industry habit does not call cloud use subcontracting. The remedy is one added clause:
Will any work be subcontracted? Include use of cloud services, and describe the platform, monitoring, development and support layers.
Beyond that, three things:
| Item | Why |
|---|---|
| Name, country and scope of each subcontractor | A subcontractor whose name cannot be produced may not be managed |
| How their safeguards are verified | Without a method, subcontracting is a break in the chain of management |
| Prior notice when a subcontractor changes | The chain shifts during the term; without notice your picture goes stale |
The third is the practical one. Verify at signature and a year later it may be different. A prior-notice clause is what keeps the picture current. See Questions to Ask Your Vendor and Security Check Sheets for Vendors.
From the vendor's side, being able to describe that chain at all requires their own supplier management to be in order. Annex A of ISO/IEC 27001 includes organisational controls covering supplier relationships, so a certified vendor has at least had a third party confirm that a mechanism for managing suppliers exists. See What Is an ISMS?.
② The Departmental Blind Spot
The larger the hospital, the more systems run alongside the EMR — laboratory, dialysis, rehabilitation, endoscopy, screening, catering, time and attendance. Each arrived by its own route, and the contract and the vendor relationship often sit with the department.
What follows:
- IT does not know it exists — servers absent from the network diagram
- Only the department has the support contact — nobody knows who to call in an incident
- Each has its own remote maintenance path — a different VPN or remote tool per vendor
- The OS is never updated — the PC bundled with the equipment runs an out-of-support OS
- It is integrated with the EMR — standalone the impact is limited; integrated it propagates
Three and four are the dangerous ones. A recurring structure in published cases is exactly this: an appliance or remote path installed for maintenance serving as the entry point. A separate remote path per department means an entry point per department.
The first step is an inventory of connections. You do not need a perfect network diagram; filling in these five columns from departmental interviews already changes what you can see.
| Column | Content |
|---|---|
| System name | The department's own name for it is fine |
| Vendor and contact | Support desk plus an emergency contact |
| External connectivity | Any path outside the hospital (VPN, leased line, internet) |
| Remote maintenance | Does the vendor connect remotely? By what method, and is each session requested? |
| EMR integration | Whether integrated, and in which direction |
The rows you cannot fill in are your investigation queue. See Network Segmentation and Asset Management and Securing Remote Maintenance.
③ Medical Devices and Maintenance Paths
Medical devices fall out of network management for three reasons.
1. Clinical departments lead procurement. The device is chosen on clinical grounds; network requirements are incidental, and IT may never see the specification.
2. Replacement cycles are long. Imaging systems run well past a decade. OS support ends during that life, and the device's regulatory configuration cannot simply be changed, so updating is not straightforward.
3. Remote monitoring is assumed. Manufacturer monitoring and predictive maintenance raise availability — and also mean a permanent connection from outside.
None of this makes devices "dangerous". It means they must be brought inside the management frame.
| Measure | Content |
|---|---|
| Register them | Include network-connected devices in the asset register, with OS and support status |
| Segment them | Where a device cannot be updated, segment the network to bound the impact |
| Narrow the path | Restrict the destination, protocol and hours of remote monitoring |
| Write it into the contract | Require the manufacturer's response to disclosed vulnerabilities — notification and remediation — in the maintenance agreement |
| Fix ownership | Determine, contract by contract, who applies firmware updates |
That last row is the gap. The device manufacturer treats the device as theirs and the network as someone else's; the network contractor covers the circuit but not firmware. Nobody is watching. Lay the contracts side by side and settle firmware ownership device by device. See Writing SLAs and Responsibility Boundaries, Demarcating Responsibility, and Securing Network-Connected Medical Devices.
④ Partners and Affiliated Facilities
Laboratories, pharmacies, home-visit nursing, other sites in the group. Connections built for regional coordination or group operations are also routes.
The difficulty here is that you cannot control the other party's security level. A supplier can be held to contract terms; an equal partner or a small counterparty often cannot.
The realistic move is not raising their level but lowering the granularity of the connection.
- Connect the minimum — open only the data exchange path required, not the networks
- Constrain direction — if one-way transmission suffices, do not make it bidirectional
- Separate the credentials — connection accounts distinct from staff accounts, tightly scoped
- Log it — record access arriving over the link and review it periodically
- Decide how to cut it — know in advance which path is severed, and on whose authority, if the partner is compromised
The fifth matters most. When the call comes that a partner has been breached, not knowing who decides to cut which link stalls the entire response. Build link severance into your incident plan. See Hospital Incident Response Plans.
Where to Start with Limited Staff
| Priority | Condition |
|---|---|
| Highest | Permanently connected from outside and integrated with the EMR |
| High | Externally connected, not integrated with the EMR |
| Medium | No external connection, but on the hospital network with an unpatched OS |
| Low | Standalone, exchanging data only by portable media |
The highest priority is the product of external connectivity and EMR integration. Anything in that cell you cannot account for means your visibility does not match your exposure.
Deciding who owns this inventory is the starting point. The FY2026 electronic clinical information coordination system development addition requires, as a common criterion, a dedicated medical information system safety management officer. Writing the connection inventory and its upkeep explicitly into that role keeps it from depending on one individual's memory. See The Medical Information System Safety Management Officer and The FY2026 Fee Revision.
Conclusion
- There are four routes: suppliers' suppliers, departmental systems, medical devices and maintenance paths, partners and affiliated facilities
- Subcontracting only surfaces if you write "including use of cloud services" — and add a prior-notice clause for changes
- Start departmental visibility with a five-column inventory of connections. A perfect network diagram is not required
- For devices, settle who owns firmware updates by laying the contracts side by side
- With partners, lower the granularity of the connection rather than trying to raise their standard, and decide the severance procedure in advance
- Prioritise by external connectivity × EMR integration
- Write the inventory into the safety management officer's duties so it does not depend on one person
Supply chain visibility is not a one-off exercise; it needs updating every time a connection is added. For help designing the first inventory or approaching existing suppliers, contact us. If you are on the supplier side and being asked to evidence your posture, see ISMS certification support.
References and Sources
- Guidelines for the Safe Management of Medical Information Systems | MHLW
- Guidelines, edition 6.0 (PDF) | MHLW
- FY2026 Fee Revision | MHLW
- Information-technology Promotion Agency (IPA)
- National center of Incident readiness and Strategy for Cybersecurity (NISC)
Note: this article organises structures common to published cases as patterns and does not address any specific incident. Guideline requirements and fee criteria change with revisions.