Hospital and Medical Device Threat Taxonomy

Taxonomies › Hospitals and medical devices

This is the reference for the Critical Condition card game: every card’s threat, the mitigation principle a sound design follows, design measures, and mappings to STRIDE, LINDDUN, CAPEC, CWE, ATT&CK, EMB3D and MDS2.

It covers the hospital and the medical devices in it, on it and around it: implants and their programmers, body-worn and home-use devices, patient monitors (ECG, SpO2, blood pressure, heart rate), ventilators and other life support, infusion pumps and pharmacy systems, X-ray, CT, MRI and radiotherapy, the laboratory and clinical software. Around them sit the systems that run care: records, integration, networks, clinical and emergency communications, the building, suppliers, identity and continuity.

It is written for a mixed table: device manufacturers, clinical engineering, hospital IT and security, integrators, estates teams and emergency services. It is jurisdiction-neutral. Hospitals are critical infrastructure, and the adversary may be a ransomware group, a state preparing for a crisis, an insider, or nobody at all: a faulty update or a failed link. What sets hospitals apart is the consequence. A design flaw that costs another business money can cost a patient their life, and the hospital can’t close while it recovers.

The two decks and the Trumps

Critical Condition is played with two decks, and each deck plays on its own. Each has its suits, the ten structural hazards as Trumps, a quick-reference card and a taxonomy card whose QR code links to this page.

The Patient deck: a fan of three cards, CRI-IM-A, CRI-PM-K and CRI-LS-A, beside the deck's eight suits and the Trumps

The Patient (116 cards) is what touches the patient: implants, body-worn devices, monitors, life support, medication, imaging, the laboratory and clinical software. It’s the deck for device makers and clinical engineering.

The Hospital deck: a fan of three cards, CRI-CC-A, CRI-EC-Q and CRI-FB-A, beside the deck's nine suits and the Trumps

The Hospital (129 cards) is what runs care: records, integration, networks, clinical and emergency communications, the building, suppliers, identity and downtime. It’s the deck for hospital IT, estates and suppliers.

Trumps are the ten structural hazards of hospitals and medical devices as a whole, and both decks carry them. To cover a whole system, play the two decks one after the other.

The ID format

Every entry has the ID printed on its card: the game prefix, the suit and the rank, joined by hyphens, such as CRI-PM-K (the King of Patient Monitoring) or CRI-TR-4 (Trump 4). The hyphens make each ID a single searchable token. Ranks are frozen: an entry added later between two ranks takes an intermediate value, such as CRI-PM-3.1, so no published ID ever changes. Every entry on these pages has an anchor, so #cri-pm-k links straight to it.

In the game, ranks follow severity, Ace high to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding on its merits in your own system.

The suits

The table gives every suit at a glance: its code, its deck, how many entries it holds and what it covers. The list under it links to each suit’s page, where every entry is set out in full.

The 17 suits and the structural hazards, with each one's code, deck, number of entries and what it covers. Each is linked in the list below.

The Patient

  • 01 · Implants and Programmers (IM): 13 threats. Pacemakers, ICDs, neurostimulators, cochlear and retinal implants and implantable pumps, with the programmers, home transmitters and clouds that talk to them.
  • 02 · Body-worn and Home-use Devices (BW): 13 threats. Insulin pumps, CGMs and closed loops, patch and Holter ECG, pulse oximeters, BP cuffs, hearing aids and connected inhalers, and the phones that control them.
  • 03 · Patient Monitoring (PM): 13 threats. Bedside monitors (ECG, SpO2, NIBP and invasive BP, heart rate, respiration, capnography, temperature), central stations, telemetry and early-warning feeds.
  • 04 · Life Support and Therapy (LS): 13 threats. Ventilators and respirators, anaesthesia workstations, oxygen, defibrillators, dialysis, ECMO, neonatal incubators and surgical robots.
  • 05 · Medication Delivery (MD): 13 threats. Infusion and PCA pumps, drug libraries, pump-EHR auto-programming, barcode administration, dispensing cabinets, pharmacy robots and controlled drug records.
  • 06 · Imaging and Radiation (IR): 13 threats. X-ray, CT, MRI, fluoroscopy, ultrasound, mammography, nuclear medicine and radiotherapy, with their worklists, workstations, images and dose.
  • 07 · Laboratory and Diagnostics (LD): 13 threats. Analysers, LIS and middleware, point-of-care tests, blood bank, pathology and digital pathology, sequencers and outsourced lab services.
  • 08 · Clinical Software and AI (CA): 13 threats. Software as a medical device, decision support, dose calculators, early-warning and sepsis scores, imaging AI, AI scribes and the apps clinicians reach for.

The Hospital

  • 09 · Records and Patient Data (RC): 13 threats. The EHR and patient administration, orders and results, identity matching, sensitive categories, portals, research use and the audit trail.
  • 10 · Integration and Interoperability (IN): 13 threats. HL7 v2, FHIR, DICOM, integration engines, device integration middleware and regional exchange.
  • 11 · Networks and Wireless (NW): 13 threats. Segmentation, legacy systems inside devices, Wi-Fi, WMTS telemetry, Bluetooth, RTLS, device inventory and satellite sites.
  • 12 · Clinical Communications (CC): 13 threats. Nurse call, alarm routing to handsets, pagers and bleeps, DECT and Wi-Fi phones, secure and shadow messaging, crash calls, switchboard and overhead paging.
  • 13 · Emergency and External Communications (EC): 13 threats. Ambulance dispatch, prehospital ECG and pre-alerts, emergency services radio, diversion, image transfer, telehealth, hospital-at-home hubs, staff call-in, patient SMS and backup links.
  • 14 · Facilities and Building Systems (FB): 13 threats. Medical gases, theatre and isolation ventilation, backup power, cold storage, water, sterile services, pneumatic tubes, lifts, infant security and building management.
  • 15 · Suppliers, Service and Lifecycle (SV): 13 threats. Vendor remote service, service laptops, manufacturer clouds, patching rights, end of support, procurement evidence, refurbished devices, disposal and vendor failure.
  • 16 · Identity and Access (AC): 13 threats. Clinician identities, default and hard-coded credentials, shared directories, shared logins, break-glass, session handover, privileged and temporary accounts, badges.
  • 17 · Continuity and Downtime (CD): 13 threats. Estate-wide ransomware, shared services, backups, restore validation, downtime procedures and copies, diversion, incident communications and extortion.

Both decks

  • 18 · Structural hazards (TR): 10 hazards. Ten structural hazards of hospitals and medical devices as a whole. Both decks carry them, ranked 1 (highest) to 10.

Where each suit sits

The map places each suit by how close it sits to the patient. The Patient deck’s suits are on, in and at the bedside, with the departments and clinical software around them. Further out come the hospital’s systems, then the building, then the outside world: the ambulance service, other hospitals, the patient at home and the vendors. The Trumps aren’t placed, because they apply everywhere.

Where each suit sits: the patient at the centre with implants, body-worn devices, monitoring, life support and medication; around them the departments and clinical software; then the hospital's systems, the building, and outside it the ambulance service, other hospitals, the patient at home and the vendors. The ten Trumps apply across all of it.

Use the map to pick suits for a session. Start from the part of the system you are designing, then add the suits on either side of it: most threats in this taxonomy cross one of those boundaries.

How to read an entry

Every entry has the same shape. The card carries the ID, the title, the threat and three prompts. The taxonomy adds what the card has no room for: the principle a sound design follows, the design measures and the mappings.

How to read an entry, using CRI-PM-K Alarms silenced from afar: the card on the left, and the taxonomy entry on the right with its ID, title and marker, threat, mitigation principle, design measures, card prompts and mappings.

Every entry has the same parts:

  • ID and title, as printed on the card.
  • Threat: the design weakness and what it leads to, written against the system you are reviewing.
  • Principle: what a sound design does about it, in one sentence.
  • Design measures: three concrete measures, four where one more was needed. Other designs can meet the principle too.
  • Card prompts: the three questions the card asks the table.
  • Mappings: STRIDE; LINDDUN where there is a privacy angle; CAPEC; CWE; ATT&CK (Enterprise, or ICS for building and device control); MITRE EMB3D for embedded devices; the MDS2 security capabilities, the main one first; and the standards that address the entry directly. A blank means nothing fitted well.

The two † markers

Two markers flag a consequence for patient safety. 156 of the 231 entries carry one:

  • Red †, direct harm (55 entries): the threat can itself injure or kill a patient: a wrong dose delivered, therapy changed, life support stopped, a radiation overdose, a gas or power failure. In the game, a red † finding is not accepted without the person who owns clinical safety for the system in the room.
  • Amber †, wrong or delayed treatment (101 entries): the harm comes through information, communication or service failure: a missed alarm, a wrong result, a stale record, a delayed ambulance. An amber † finding needs a clinical lead’s sign-off before it is accepted.

Where the other taxonomies take over

This taxonomy picks the others up only where they become a route into patient care, or a consequence for it:

Seen in the wild

Each of these public cases illustrates one or more entries. Attribution is given only where an official body made it.

Mappings

The table shows how far each framework reaches into each suit: how many of its entries map to CAPEC, CWE, ATT&CK, EMB3D and LINDDUN, its most common STRIDE categories, the MDS2 capabilities a buyer should check first, and how many entries carry each † marker.

Mappings at a glance: for each suit, its top three STRIDE categories, how many entries map to CAPEC, CWE, ATT&CK, EMB3D and LINDDUN, the first MDS2 capabilities to check, and its red and amber † counts, with a row for all 231 entries.

A few things stand out:

  • EMB3D is strongest at the bedside. All 13 Life Support and Therapy entries map to it, and 9 of 13 implant entries. It has nothing for clinical software, records or clinical communications, because those threats aren’t in embedded devices.
  • LINDDUN concentrates in the records. All 13 Records and Patient Data entries have a privacy mapping, against 1 or 2 in most device suits.
  • CAPEC is thinnest where care meets operations. It covers only 4 of 13 Continuity and Downtime entries and 1 of the 10 structural hazards, because those threats are about how a hospital recovers and how it is organised, not about an attack on a component.
  • The red † clusters in the device suits. Life Support, Medication Delivery, Implants and Body-worn Devices carry 35 of the 55 direct-harm entries.

Across the 231 entries, the STRIDE counts are Tampering 110, Denial of service 81, Spoofing 67, Information disclosure 63, Elevation of privilege 54, Repudiation 41 (an entry can carry more than one). 184 map to CAPEC 3.9, 222 to CWE 5.0, 183 to ATT&CK v20.0, 73 to MITRE EMB3D and 76 to LINDDUN. The MDS2 capabilities a buyer should check first are IGAU (62), AUDT (57), AUTH (52). 55 carry the red † for direct harm and 101 the amber † for wrong or delayed treatment.

Every ID was checked against MITRE’s own data: ATT&CK Enterprise and ATT&CK for ICS from the v20.0 release (October 2026), CAPEC 3.9, MITRE EMB3D, and CWE 5.0 (28 October 2026). Revoked and deprecated entries were excluded, and only CWEs whose mapping usage is Allowed or Allowed-with-Review were used. MDS2 codes follow ANSI/NEMA HN 1-2019. Each suit page has its own mapping table.

Downloads

FileFormatWhat it’s forSize
hospitals-and-medical-devices-threat-taxonomy.pdfPDFRead and print: landscape, a section per suit, with the licence on the first pages.2.0 MB
hospitals-and-medical-devices-threat-taxonomy.xlsxExcelWork with it: a sheet per suit, an all-entries sheet and a licence sheet.247 KB
hospitals-and-medical-devices-threat-taxonomy.skos.jsonldSKOS (JSON-LD)Linked data: a W3C SKOS concept scheme, one concept per entry.512 KB
hospitals-and-medical-devices-threat-taxonomy.stix.jsonSTIX 2.1Security tools: attack patterns, courses of action and groupings per suit.1.2 MB

Licence

© 2026 Jonathan Brett Crawley. This taxonomy is licensed under the Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International licence (CC BY-NC-ND 4.0), with the additional permissions below. You can share the whole taxonomy freely for non-commercial purposes, unchanged and with credit.

UsePermission needed?
Sharing the whole taxonomy non-commercially (OWASP, universities, conferences, individuals)No
Threat modeling with it, including for paying clientsNo
Internal use and training inside any organisationNo
Quoting entries, with credit, in paid courses, reports and talksNo
Shipping the taxonomy in a product: a tool’s built-in library, a printed deck, a reprint for saleYes, ask me

Additional permissions. In addition to the rights the licence gives, and whether or not the use is commercial, the copyright holder grants you permission to:

  • use the taxonomy to threat model systems you build, operate or assess, including for paying clients;
  • use it internally, and for training, inside any organisation;
  • quote individual entries, with credit, in paid courses, reports, findings and talks.

Any other commercial use, including shipping the taxonomy or a substantial part of it in a product (a tool’s built-in library, a printed deck, a reprint for sale), needs written permission. Ask me on LinkedIn.

Credit: “Hospital and Medical Device Threat Taxonomy” by Jonathan Brett Crawley, ostering.com, licensed under CC BY-NC-ND 4.0.

These additional permissions are given alongside the licence. They add to what the licence allows and do not take anything away from it.

Version

VersionDateChange
1.04 November 2026First published as reference pages, with PDF, Excel, SKOS and STIX downloads. References are stable identifiers.

Corrections, missing threats and worked examples are welcome: reach out to me on LinkedIn. Changes are logged here.

Read more