Patient Monitoring (PM)

Patient Monitoring (CRI-PM), The Patient: a radiograph of a chest with ECG electrodes and a heart trace.

Taxonomies › Hospitals and medical devices › Patient Monitoring

The Patient · CRI-PM · suit 03 of 17 · 13 entries

Bedside monitors (ECG, SpO2, NIBP and invasive BP, heart rate, respiration, capnography, temperature), central stations, telemetry and early-warning feeds.

Scope: Bedside monitors (ECG, SpO2, NIBP, invasive BP, heart rate, respiration, capnography, temperature), central stations, wireless telemetry, alarm limits and alarm suppression, false or frozen values, clock drift, patient-to-monitor association errors, early-warning score feeds, remote viewing, monitors as network footholds, legacy embedded OSs.

Entries are ranked Ace (most severe) to 2. In the taxonomy the ID is a stable reference, not a severity: rate each finding in your own system.

Patient Monitoring: each entry's ID, title, threat, mitigation principle and design measures. The full text follows below.

Text version: every entry is written out below, with its card prompts and mappings. The same text is in the PDF and Excel downloads on the overview page.

The threats

CRI-PM-A False values on the monitor

† Wrong or delayed treatment

Threat. Monitors and central stations accept data from the monitoring network without checking its source or integrity. Altered values show normal SpO2, heart rate and blood pressure while the patient deteriorates, or alarming values for a stable one, and staff treat the screen.

Principle. Displayed vital signs come only from authenticated devices over integrity-protected links.

Design measures:

  1. Authenticate monitors to central stations and gateways, and protect each message for integrity.
  2. Show the source device and data age beside every value at the central station.
  3. Cross-check related signals, such as SpO2 pulse rate against ECG heart rate, and flag disagreement.

Card prompts:

  • How does the central station know data came from a genuine monitor?
  • What protects vital signs in transit across the monitoring network?
  • Would staff notice values that look normal but are false?

Mappings: STRIDE S, T · CAPEC-194, CAPEC-148 · CWE-924, CWE-306 · ATT&CK T0832, T1565.002 · EMB3D TID-406 · MDS2 TXIG, NAUT · IEC TR 60601-4-5; FDA premarket

CRI-PM-K Alarms silenced from afar

† Wrong or delayed treatment

Threat. Alarm limits, volume and pause states can be changed from a central station, a remote viewer or the network without authorisation, and alarm forwarding can be turned off. Deterioration alarms never reach a nurse.

Principle. Changes to alarm behaviour are authorised, local where possible, visible and logged.

Design measures:

  1. Require clinician authentication for changes to alarm limits, volume or forwarding.
  2. Show any non-default alarm setting prominently on the bedside monitor.
  3. Log every alarm configuration change with who made it and from where.
  4. Prevent alarms being turned off entirely from remote stations.

Card prompts:

  • Who can change alarm limits, and from where?
  • Does the bedside show a remote change, and who made it?
  • Can anyone turn alarm forwarding off without a clinician knowing?

Mappings: STRIDE T, E, R · CAPEC-176 · CWE-862, CWE-306 · ATT&CK T0838, T0878 · EMB3D TID-310 · MDS2 AUTH, AUDT · IEC TR 60601-4-5; ISO 14971

CRI-PM-Q Telemetry dropout looks quiet

† Wrong or delayed treatment

Threat. Wireless telemetry is jammed or drops out and the central station keeps showing the last value or no alarm, instead of a loud loss-of-signal. A patient walking off the ward or behind a lift shaft goes unmonitored.

Principle. Loss of monitoring is treated as an alarm in its own right.

Design measures:

  1. Raise a technical alarm as soon as telemetry is lost, with escalation if it persists.
  2. Mark stale values clearly and never show them as current.
  3. Survey wireless coverage and monitor the band for interference and jamming.

Card prompts:

  • What does the central station show when telemetry drops out?
  • Where on the ward does telemetry coverage fail?
  • Is loss of signal an alarm, or just a blank tile?

Mappings: STRIDE D · CAPEC-601, CAPEC-604 · CWE-754, CWE-636 · ATT&CK T0815, T0829 · MDS2 CONN · IEC 80001-1; IEC TR 60601-4-5

CRI-PM-J Wrong patient on the monitor

† Wrong or delayed treatment

Threat. The link between monitor, bed and patient admission is wrong or can be changed without checks. Readings and alarms are charted to another patient, sent to the wrong nurse, and drive someone else’s treatment.

Principle. Every monitor-to-patient association is verified when made and visible all the time.

Design measures:

  1. Confirm association by scanning the patient’s wristband at the monitor.
  2. Show the patient’s name and identifier on the monitor and at the central station.
  3. Log association changes and alert when a monitor is reassigned while readings are flowing.

Card prompts:

  • How is a monitor linked to the right patient and bed?
  • Who can change that link, and is the change checked?
  • Where can staff see which patient a monitor belongs to?

Mappings: STRIDE S, T · LINDDUN DD · CAPEC-151 · CWE-1293 · ATT&CK T1565.001 · MDS2 IGAU, AUDT · IEC 80001-1

CRI-PM-10 Early-warning score goes stale

† Wrong or delayed treatment

Threat. Vital signs feed early-warning and sepsis scores in the record. If the feed stops or lags, the score keeps its last value and no escalation is triggered, while staff believe the system is watching.

Principle. A score shows how fresh its inputs are and alerts when they are not.

Design measures:

  1. Timestamp every input and show its age with the score.
  2. Alert when expected observations are overdue for a patient.
  3. Monitor the interface feeding the score and page someone when it stops.

Card prompts:

  • How fresh are the inputs behind the early-warning score?
  • What alerts staff when the vital signs feed stops?
  • Would a stale score look any different from a current one?

Mappings: STRIDE D, T · CWE-754, CWE-1088 · ATT&CK T0829 · MDS2 IGAU, CONN · IEC 80001-1

CRI-PM-9 Monitors as network footholds

† Wrong or delayed treatment

Threat. Monitors and central stations run old embedded or desktop operating systems with exposed services that cannot be patched quickly. One compromised device becomes a route to other monitors and the clinical network.

Principle. Monitoring devices expose only what they need and sit where a compromise cannot spread.

Design measures:

  1. Disable unused services and ports, and document the rest for the hospital.
  2. Place monitors in their own network segment with traffic only to their central station and gateway.
  3. Publish patch and support timelines and validate security fixes quickly.
  4. Supply an SBOM so the hospital can track vulnerable components.

Card prompts:

  • Which services do monitors and central stations expose on the network?
  • How quickly can a monitor vulnerability actually be patched?
  • What else could a compromised monitor reach?

Mappings: STRIDE E, D, T · CAPEC-682 · CWE-1104, CWE-1395 · ATT&CK T0866, T1210 · EMB3D TID-202, TID-210 · MDS2 SAHD, CSUP, SBOM · IEC 80001-1; IEC 81001-5-1

CRI-PM-8 Monitor firmware phones home

† Wrong or delayed treatment

Threat. Monitor firmware contains hidden functions that send patient data to fixed external addresses or fetch and run files from them. Nobody at the hospital knows the function exists until it is reported.

Principle. A monitor connects only to destinations the hospital configured, and contains no hidden functionality.

Design measures:

  1. Review firmware and third-party components for undeclared network functions before purchase and release.
  2. Let the hospital configure, and see, every outbound destination.
  3. Block monitor traffic to the internet by default at the network edge.

Card prompts:

  • Which external addresses do the monitors contact?
  • Who configured each destination a monitor connects to?
  • How would the hospital discover hidden functions in monitor firmware?

Mappings: STRIDE I, E · LINDDUN DD, U · CAPEC-443 · CWE-912, CWE-506 · ATT&CK T0862 · EMB3D TID-401 · MDS2 CONN, SBOM · FDA premarket; IEC 81001-5-1

CRI-PM-7 Service menus behind default passwords

† Wrong or delayed treatment

Threat. Service and configuration menus on monitors use default or shared passwords published in manuals. Anyone with the password changes alarm defaults, calibration or network settings, and the change looks like normal behaviour.

Principle. Service access needs individual credentials and leaves a trace.

Design measures:

  1. Ship without default service passwords and require a unique one at installation.
  2. Separate clinical configuration from engineering functions with different roles.
  3. Log service-mode entry and every configuration change.

Card prompts:

  • Who knows the service password, and is it the same everywhere?
  • Is every change made through a service menu logged?
  • Could a calibration change be told apart from normal behaviour?

Mappings: STRIDE E, T, R · CAPEC-70 · CWE-1392, CWE-798 · ATT&CK T1078 · EMB3D TID-311, TID-328 · MDS2 PAUT, AUTH, AUDT · IEC TR 60601-4-5

CRI-PM-6 Clocks drift apart

† Wrong or delayed treatment

Threat. Monitor and central station clocks are not synchronised, or their time source can be spoofed. Alarms, ECG strips, events and drug times land out of order in the record, misleading diagnosis and undermining the record as evidence.

Principle. Every device keeps trusted, synchronised time, and the record shows when it did not.

Design measures:

  1. Synchronise clocks to an authenticated hospital time source.
  2. Alert when a device’s clock drifts beyond a set tolerance.
  3. Record both device time and receipt time for each event.

Card prompts:

  • What time source do monitors and the central station use?
  • Could that time source be spoofed or lost?
  • How would the record show that a device clock was wrong?

Mappings: STRIDE T, R · CWE-1293 · MDS2 AUDT, IGAU · IEC 80001-1

CRI-PM-5 Remote viewing open to the internet

† Wrong or delayed treatment

Threat. Remote viewers let doctors watch live waveforms from home. Exposed to the internet with weak logins, they leak patients’ data and, where they can silence alarms or change settings, give an outsider control.

Principle. Remote viewing is read-only by default and reachable only through the hospital’s controlled remote access.

Design measures:

  1. Publish remote viewers only behind the hospital’s remote access with multi-factor authentication.
  2. Make remote viewing read-only unless a specific, logged role needs control.
  3. Scan regularly for monitoring interfaces reachable from the internet.

Card prompts:

  • How do doctors reach remote viewing from outside the hospital?
  • Can remote viewing silence alarms or change settings?
  • Who reviews remote viewing logins and failed attempts?

Mappings: STRIDE I, E, S · LINDDUN DD, I · CAPEC-115 · CWE-306, CWE-308 · ATT&CK T1133, T1190 · EMB3D TID-310 · MDS2 PAUT, RMOT, AUTH · IEC 80001-1

CRI-PM-4 Waveform archives stolen in bulk

Threat. Central stations and gateways store waveforms, ECGs and alarm histories unencrypted. Theft of the store reveals cardiac diagnoses for every patient monitored in years.

Principle. Stored monitoring data is encrypted and kept no longer than needed.

Design measures:

  1. Encrypt waveform and event stores at rest with keys held off the device.
  2. Set retention periods and delete data once it has been written to the record.
  3. Restrict export of waveform data to authorised roles and log it.

Card prompts:

  • Where are waveforms, ECGs and alarm histories stored, and is that encrypted?
  • How long is stored monitoring data kept?
  • Who can copy the whole monitoring archive?

Mappings: STRIDE I · LINDDUN DD, I · CAPEC-545 · CWE-312 · ATT&CK T1005 · MDS2 STCF, MPII · ISO 27799

CRI-PM-3 Spot checks under a shared login

Threat. Portable vital-signs devices upload observations under a generic ward login. Nobody can tell who took a reading or entered a manual value, so mistakes and falsified observations cannot be traced.

Principle. Every observation is attributed to the person who took it.

Design measures:

  1. Require badge-tap or quick login per user on spot-check devices.
  2. Mark manually entered values differently from measured ones in the record.
  3. Log who submitted each observation and from which device.

Card prompts:

  • Can you tell who took each observation?
  • Which devices upload under a shared ward login?
  • How would a falsified manual value be traced?

Mappings: STRIDE R · LINDDUN Nr · CWE-778 · MDS2 PAUT, AUDT · IEC 80001-1

CRI-PM-2 Discovery traffic maps the ward

Threat. Monitors announce themselves on the network with patient names, bed numbers and demographics in discovery and multicast traffic. Anyone on that network can map who is in which bed and what is being monitored.

Principle. Network announcements carry no patient data.

Design measures:

  1. Remove patient identifiers from discovery and multicast messages.
  2. Encrypt traffic that must carry patient context.
  3. Keep monitor discovery traffic inside the monitoring segment.

Card prompts:

  • What patient data do monitors broadcast in discovery traffic?
  • Who else shares the network segment where monitors announce themselves?
  • Could the bed board be rebuilt from network traffic alone?

Mappings: STRIDE I · LINDDUN I, L, D · CAPEC-292 · CWE-319, CWE-359 · ATT&CK T0846 · EMB3D TID-408 · MDS2 TXCF, CONN · IEC 80001-1

Seen in the wild

Mappings

Patient Monitoring: the mappings of each entry to STRIDE, LINDDUN, CAPEC, CWE, ATT&CK, EMB3D, MDS2 and standards.

Across the 13 entries, the STRIDE counts are Tampering 7, Elevation of privilege 5, Repudiation 4, Information disclosure 4, Spoofing 3, Denial of service 3 (an entry can carry more than one). 10 map to CAPEC 3.9, 13 to CWE 5.0, 11 to ATT&CK v20.0, 7 to MITRE EMB3D and 6 to LINDDUN. The MDS2 capabilities a buyer should check first are AUDT (5), CONN (4), AUTH (3). 10 carry the amber † for wrong or delayed treatment. A blank means nothing fitted well; a loose tag would mislead.

← Body-worn and Home-use Devices · Hospitals and medical devices overview · Life Support and Therapy →

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the hospitals and medical devices overview.