| Week 1 |
Jan 8 |
Thursday |
Opening Lecture |
Course Overview, Expectations, and Rules. |
| Week 2 |
Jan 13 |
Tuesday |
Course Introduction |
Review agenda & objectives; Framing Medical Device Cybersecurity; Differentiating stakeholders and context. |
| Jan 15 |
Thursday |
Discussion Session |
Therac-25 Activity |
| Week 3 |
Jan 20 |
Tuesday |
Concepts and Terminology |
Cybersecurity recap; Contrasting IT vs OT; safety vs security; Relating today's threat landscape. |
| Jan 22 |
Thursday |
Discussion Session |
Peer review. |
| Week 4 |
Jan 27 |
Tuesday |
Cybersecurity in Healthcare |
Healthcare's unique risks and exposure: Review of security events and trends. |
| Jan 29 |
Thursday |
Discussion Session |
Top 10 Health Technology Hazards for 2026, by ECRI. |
| Week 5 |
Feb 3 |
Tuesday |
Medical Device Introduction |
History: from research to documented events; Lack of progress - understanding constraints; Practical and technical path forward |
| Feb 5 |
Thursday |
Discussion Session |
Security and Privacy in Implantable Medical Devices (SoK) – IEEE S&P 2014 |
| Week 6 |
Feb 10 |
Tuesday |
Regulations and Standards (1) |
US FDA - regulatory approach and structure; US - beyond FDA; International efforts |
| Feb 12 |
Thursday |
Discussion Session |
(1) Regulatory Aspects of Artificial Intelligence and Machine Learning"; (2) Term Project Proposal; |
| Week 7 |
Feb 17 |
Tuesday |
Regulations and Standards (2) |
Applicable standards and guidances; Privacy and safety; Interoperability |
| Feb 19 |
Thursday |
Discussion Session |
Andrew Carney of ARPA-H will speak on the UPGRADE Program and Whole Hospital Simulation |
| Week 8 |
Feb 24 |
Tuesday |
Guest Lecture |
Penetration Testing for Medical Devices (Beau Woods) |
| Feb 26 |
Thursday |
Discussion Session |
Principles and Practices for Software Bill of Materials for Medical Device Cybersecurity |
| Week 9: Spring Break |
| Week 10 |
Mar 10 |
Tuesday |
Hospital Perspective |
Operators' cybersecurity responsibilities and challenges; Contrasting manufacturer and operator lifecycles; Security processes from procurement to decommissioning; PATCH WHS and VMP |
| Mar 12 |
Thursday |
Discussion Session |
MITRE's Playbook for Threat Modeling Medical Devices |
| Week 11 |
Mar 17 |
Tuesday |
Guest Lecture |
Beyond the device (Josh Corman) |
| Mar 19 |
Thursday |
Discussion Session |
Term Project |
| Week 12 |
Mar 24 |
Tuesday |
Manufacturer Perspective (1) |
Premaket overview; Key activities along the lifecycle; Risk and vulnerability management; Regulatory approval and market release. |
| Mar 26 |
Thursday |
Discussion Session |
Cybersecurity Practices for Small Healthcare Organizations & Introduction to Helm |
| Week 13 |
Mar 31 |
Tuesday |
Manufacturer Perspective (2) |
Postmarket overview; Postmarket risk management; Deep dive and select topics; Beyond engineering (manufacturing, support, hosting) |
| Apr 2 |
Thursday |
Discussion Session |
H-ISAC Medical Device Cybersecurity Lifecycle Management |