How to find every medical device on the network

A hospital can hold a tidy asset register and still fail a simple question: which medical devices are connected to the network right now. The register records what was purchased and what was serviced. The network sees what is powered on and talking. The gap between those two views is where unmanaged devices, shadow installations and forgotten research equipment live, and closing that gap is the first practical step in any security or maintenance program.

Why the device list and the network never match

Asset registers grow from purchasing records, capital plans and service tickets. Devices also arrive through research grants, trials, donated equipment and short-term rentals, and those paths rarely end in the same database. A device moved between departments keeps its old location in the register while appearing somewhere else entirely on the network.

Network addressing makes the mismatch worse. A device may hold one address for years, or receive a new one every time it reconnects. Clinical engineers who try to reconcile the two lists by hand usually stop after the first audit, because the lists disagree on names and owners as well as on locations. Building a proper medical device inventory is therefore a data problem before it is a scanning problem.

Passive discovery: listening without touching

Passive discovery places a sensor on a network segment and records the traffic already flowing past it. Nothing is sent to the devices. The sensor reads broadcast protocols, address requests, manufacturer identifiers and the rhythm of communication between devices and their servers. Because it never transmits, passive monitoring is safe for infusion pumps, anaesthesia machines and any device whose vendor warns against unsolicited traffic.

The limitation is coverage. A passive sensor only sees segments it can reach, and it only learns about a device when that device speaks. Equipment that is switched off, idle overnight or isolated behind a gateway stays invisible until it becomes active again, which may be exactly the device nobody has documented.

Active discovery: asking devices to answer

Active discovery sends queries and waits for replies. It reaches idle equipment and often returns richer detail, including model, firmware version and exposed services, because the device is asked directly. That detail is valuable for maintenance planning and for vulnerability work, but the act of asking carries risk on a clinical network.

Older devices may react badly to unexpected traffic. Some crash, some drop their link to a monitoring system, and some misbehave only under load. Active scanning therefore needs a maintenance window, a written list of excluded devices and a clinician available to confirm that equipment still works afterward.

Using both methods together

Most mature programs run passive monitoring continuously and active scanning on a schedule. The passive feed supplies the baseline and catches new arrivals between scans. The active pass confirms identity, firmware state and the services a device exposes, which is what turns an address into an asset.

What to do with what you find

Discovery produces a list, not an inventory. The list becomes useful only when each entry is tied to an owner, a location, a maintenance record and a risk class. A device that cannot be matched is itself a finding, because it is either undocumented, mislabelled or sitting outside the maintenance program altogether.

• Match every discovered address to an asset record and mark the ones that do not match.
• Record the network segment and switch port, not only the department name.
• Flag devices on unsupported operating systems for a separate review.
• Confirm with clinical staff before removing an unknown device from the network.
• Repeat the exercise on a fixed cycle, because the list decays quickly.

Where devices carry a unique device identifier, use it as the join key between the network record and the maintenance record. It survives renames, relocations and departmental reorganizations in a way that hostnames do not.

Who owns the inventory

Discovery work usually lands with the security team, because the tools sit in that budget and the network is their territory. Ownership of the resulting inventory belongs with clinical engineering, which already holds the maintenance history and the safety context for each device. Splitting the two produces a list that security trusts and clinical engineering ignores.

A workable arrangement gives clinical engineering the record of truth, gives security the monitoring feed and gives IT responsibility for documenting network topology. One named person signs off on changes, and that signature is what keeps the record alive when staff leave.

Where discovery stops being a project

A single scan answers a question once. Connected devices change with every installation, relocation, firmware update and decommissioning, so discovery works best as a standing process with a defined review cycle. Its output should feed preventive maintenance planning, replacement decisions and network segmentation for medical IT rather than sit in a report nobody opens.

The test of a good process is simple. Ask for the current list of connected medical devices and see whether the answer arrives in minutes with owners attached, or whether it begins with an apology and a search through old spreadsheets.