Connected medical devices are now embedded throughout NHS care pathways, yet their security is governed in fragments across device manufacturers, trusts and regulators. In this Comment article, written as lead and corresponding author with Kunal Rajput, Ara Darzi and Saira Ghafur, we propose a cross-layer risk framework that treats the physical device, the network it joins and the cloud services it depends on as a single attack surface.

The paper sets out a policy agenda for the MHRA and NHS organisations: secure-by-design requirements for device development, mandatory Software Bills of Materials (SBOMs) so that vulnerable components can be traced, and RACI-style accountability so that responsibility for a device’s security does not fall between institutions.

Since publication the article has received more than 7,500 accesses and ranks in the top 9% of all tracked articles of similar age by Altmetric attention. It was covered by Digital Health.

Read the article at npj Digital Medicine

Recommended citation: Toparti, O., Rajput, K., Darzi, A. & Ghafur, S. (2026). "Cybersecurity in connected medical devices: a policy agenda for the NHS." npj Digital Medicine 9, 204. https://doi.org/10.1038/s41746-026-02534-4