By Eric Andrew Kristof, RN, CAHIMS | Healthcare IT Professional | HIMSS Arkansas Chapter Member
About This Series: The HIMSS Word of the Day is a running blog series drawing from the HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025) — the authoritative reference for healthcare IT professionals and the primary study resource for CAHIMS and CPHIMS certification. Each post paraphrases the term in plain language, grounds it in real-world healthcare IT context, and adds a bedside nursing perspective you won’t find in a textbook.
📖 The Term: Internet of Things (IoT)
Source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025)
🔍 Plain-Language Definition
The Internet of Things (IoT) is the network of physical devices embedded with sensors, software, and connectivity that allow them to collect and exchange data with other devices and systems, often without direct human involvement. In healthcare, connected medical devices are often called the Internet of Medical Things (IoMT).
The HIMSS Dictionary describes IoT in two ways. First, as the expanding network of physical objects with internet connectivity and the communication among them and other internet-enabled systems, extending connectivity beyond computers and phones to many everyday items with embedded technology. Second, as linked devices, machines, objects, animals, or people that carry unique identifiers and can share data across a network on their own, with no person needing to relay it.
| Healthcare IoT Category | Examples | Purpose |
|---|---|---|
| Bedside Medical Devices | Infusion pumps, physiologic monitors, ventilators | Therapy delivery and monitoring with data sent to the EHR |
| Patient Environment | Smart beds, nurse call systems, room displays | Fall alerts, communication, patient engagement |
| Location and Asset Tracking | Real-time location system tags | Finding equipment, tracking hand hygiene, staff safety |
| Remote and Home Devices | Connected blood pressure cuffs, glucose sensors, scales | Remote patient monitoring |
| Building and Operations | HVAC, refrigerators, access control | Environmental monitoring, medication and vaccine temperature |
⚠️ Exam Alert: IoT refers broadly to connected devices; IoMT refers to connected medical devices and health applications. Device integration sends device data into clinical systems. Network segmentation isolates devices to limit risk. Many IoT devices run embedded software that is difficult to patch.
🌐 Why It Matters: Real-World Healthcare IT Context
Connected devices can improve care and efficiency. Smart infusion pumps with drug libraries and EHR integration reduce programming errors and documentation burden. Monitors that send vital signs directly to the EHR save time and improve accuracy. Real-time location systems help staff find equipment quickly. Home devices allow remote patient monitoring for chronic conditions and post-discharge care.
Device data is only useful if it reaches the right place. Integration with the EHR requires interfaces, middleware, standards, and careful patient-device association so data appears in the correct chart. Alarm management systems route alerts to clinicians’ mobile devices, which can help or contribute to alarm fatigue depending on design.
IoT expands the attack surface. Every connected device is a potential entry point. Many medical and building devices run older operating systems, have default or hard-coded passwords, lack security monitoring, or cannot be patched easily. Attackers may use vulnerable devices to enter the network or disrupt operations, and devices themselves may be affected by malware.
Visibility is the first challenge. Many hospitals lack a complete, current inventory of connected devices, including where they are, what software they run, and how they communicate. Specialized tools can discover and profile devices on the network, supporting risk assessment and segmentation.
Standards and guidance are maturing. NIST has published foundational guidance for IoT device manufacturers on cybersecurity capabilities, including NISTIR 8259, and runs a broader cybersecurity program for IoT. The FDA’s premarket cybersecurity guidance and federal law for cyber devices require manufacturers to address cybersecurity throughout the device life cycle, including software bills of materials and plans for postmarket vulnerabilities.
Governance requires collaboration. Clinical engineering, IT, security, facilities, and clinical leaders share responsibility for connected devices. Procurement processes increasingly include security requirements, such as support for updates, encryption, and vendor disclosure of known vulnerabilities.
Reliability is a clinical concern. Wireless coverage gaps, network congestion, and battery failures can interrupt data flow from devices, and clinicians may not realize that a connected monitor or pump has stopped sending data. Organizations test wireless coverage in clinical areas, monitor device connectivity, and define what should happen when integration fails so that care does not depend on an assumption that data is arriving.
Privacy matters too. Devices that collect location, audio, video, or physiologic data raise questions about consent, retention, and access, especially for patients at home and for staff tracked by location systems.
Common IoT challenges in healthcare:
- Incomplete inventories of connected devices
- Legacy devices running unsupported software
- Default passwords and weak device security
- Flat networks that allow devices to reach critical systems
- Alarm overload from connected devices
- Unclear ownership across IT, clinical engineering, and facilities
Practices for safe healthcare IoT:
- Continuous device discovery and inventory
- Network segmentation for medical and building devices
- Security requirements in procurement and contracts
- Coordinated patch and vulnerability management with vendors
- Thoughtful alarm management and integration design
- Shared governance across clinical engineering, IT, and nursing
🏥 The Nurse’s Perspective: Clinical, Bedside, & Workflow
Nurses use connected devices constantly and often notice first when they malfunction.
At the Bedside
Smart pumps, monitors, beds, and nurse call systems are part of daily nursing work. Associating devices with the correct patient, using drug libraries, and confirming that device data appears accurately in the EHR are important safety steps.
Unexpected device behavior, such as a pump displaying unusual messages, a monitor losing connection, or settings changing unexpectedly, should be reported to clinical engineering. These issues can reflect technical faults or, rarely, security problems.
In Clinical Workflow
Integrated device data reduces manual charting, but nurses still validate values before they become part of the legal record. Artifacts from movement or poor sensor placement should be corrected or annotated.
Alarm notifications sent to mobile devices can help nurses respond quickly, but too many low-value alarms contribute to fatigue. Nurses provide essential input when organizations adjust alarm thresholds and routing.
Remote monitoring programs rely on nurses to review data from home devices, contact patients when readings are concerning, and teach patients how to use equipment correctly.
Nurses should avoid connecting personal devices or unapproved equipment to hospital networks or medical devices, which can introduce risks.
Home patients need support too. Nurses teaching patients to use connected devices can explain how to keep devices charged, updated, and paired, and whom to call when readings stop transmitting.
In EHR Implementation (Go-Live Perspective)
During an Epic Go-Live, device integration for monitors, pumps, and other equipment is tested extensively. Patient-device association workflows must work reliably so data flows into the correct chart.
At-the-elbow support analysts often help nurses with device association, data validation, and troubleshooting connectivity. Quick escalation to clinical engineering and integration teams prevents gaps in monitoring and documentation.
🎓 CAHIMS / CPHIMS & HIMSS Perspective
CAHIMS Exam Domain Mapping
IoT appears in technology trend, device integration, and security questions:
| CAHIMS Domain | How IoT Appears |
|---|---|
| Healthcare & Technology Environments | Connected health trends; FDA device cybersecurity; remote monitoring |
| Clinical Informatics | Device integration, alarm management, data validation |
| Healthcare Information & Systems Management | Device inventory, segmentation, interfaces, vulnerability management |
| Management & Leadership | Governance across clinical engineering and IT, procurement, risk |
Key Terms to Know Alongside IoT
- Internet of Medical Things (IoMT) — connected medical devices and health applications
- Device Integration — automated transfer of device data into clinical systems
- Real-Time Location System (RTLS) — technology that tracks the location of equipment or people
- Network Segmentation — dividing networks to limit access and contain threats
- Software Bill of Materials (SBOM) — a list of software components in a product
- Alarm Fatigue — desensitization to alarms due to their volume or low relevance
HIMSS Organizational Position
HIMSS addresses connected health and medical device security through its education, research, and Healthcare Cybersecurity Community, and through its collaboration with IHE on device integration. Members can find related education and research through the HIMSS Resource Center.
🔗 Explore Further: External References
- NIST — NISTIR 8259, Foundational Cybersecurity Activities for IoT Device Manufacturers https://csrc.nist.gov/pubs/ir/8259/final
- NIST — Cybersecurity for IoT Program https://www.nist.gov/itl/applied-cybersecurity/nist-cybersecurity-iot-program
- FDA — Medical Device Cybersecurity https://www.fda.gov/medical-devices/digital-health-center-excellence/cybersecurity
- HHS 405(d) Program — Health Industry Cybersecurity Practices https://405d.hhs.gov/
- IHE International https://www.ihe.net/
- HIMSS — Healthcare Cybersecurity Community https://www.himss.org/networking/communities/healthcare-cybersecurity/
Term source: HIMSS Dictionary of Health Information and Technology Terms, Acronyms, and Organizations, 6th Edition (2025). All definitions in this series are paraphrased for editorial purposes. Readers are encouraged to consult the primary source for exact language.
Eric Andrew Kristof, RN, CAHIMS is a Healthcare IT professional and HIMSS Arkansas Chapter member based in Hot Springs Village, AR, with hands-on Epic Go-Live experience and a diverse healthcare and IT background. He writes at kristof.org at the intersection of clinical care and healthcare technology.
Leave a Reply