re: Any IT security experts on this board?

I feel your pain. I work for a medical device company. It has giving me a new perspective on things as far as why medical equipment is so expensive. The FDA is a HUGE part of why medical things lag behind, if something is working the customer does not want to change it as it costs them lots of money to validate everything. That being said, you should take what is said on this board with a grain of salt. Medical systems should follow the recommendations of the FDA. We hire cybersecurity consultants that specialize in medical equipment. I suggest that you do the same. I do not know the details of your product(s) but I would start here LINK (it is about medical devices but you may still find the information useful). Also, other useful information may be to check out IEC 62304 for development of medical software.

I know what you mean. We have a device that is still operational in labs and hospitals today that was first put on the market in 1972. The customers are refusing to change even though we bought the worlds supply of parts for that machine 10 years ago and we only have about a 2 year supply left. Knowing that information, they are still hesitant to change and are willing to run the machine until it dies before switching. And mind you, the replacement device was released 15 years ago. All of our current development is using the latest technologies and standards the exceed the FDA requirements.