Depot Insights
Medical Device Patch Management: The Depot Turn Is Your Patch Window
Your RPM and hospital-at-home devices live on patient Wi-Fi and cellular, outside every scanner and NAC you own. The turn between episodes is the one reliable moment to patch, verify, and document every device. Miss it and the fleet ages in place.
Talk to a SpecialistThe fleet left your network. It never left your compliance perimeter.
Every device you ship into a patient home leaves your network the moment the courier pulls away. It does not leave your responsibility. The blood pressure cuff, the tablet, the cellular gateway in the kit: each one is still your asset, still handling patient data, and still expected to be current when an auditor or an attacker comes asking. That is what medical device patch management means for a home-based fleet, and it is a different problem from patching devices that sit on a hospital network.
On campus, a vulnerable device gets found by a scanner, isolated by the network team, and patched in place. In a patient's living room there is no scanner, no network team, and often no reliable way to push an update at all. The fleet's security posture is decided somewhere else entirely: at the depot, during the turn between one patient episode and the next.
A home-based device fleet has one reliable patch window per episode: the depot turn. Patch windows per device per year = 365 / (episode days + turnaround days). A 30-day episode with a 5-day turnaround gives each device about 10 windows a year. A fleet with no depot discipline gets zero.
Regulation moved while your fleet was in the field
Three dated shifts frame the problem. First, Congress added section 524B to the FD&C Act in December 2022, and FDA began refusing to accept new cyber device submissions without cybersecurity documentation on October 1, 2023. Manufacturers of connected devices must now maintain plans to monitor and address vulnerabilities, make updates and patches available on a regular cycle, and provide a software bill of materials. FDA finalized its updated premarket cybersecurity guidance on June 27, 2025. The practical effect for providers: the patches exist, on a published cadence, and the excuse that no fix was available is disappearing.
Second, HHS proposed the first major rewrite of the HIPAA Security Rule in over a decade on January 6, 2025. The proposal would require a technology asset inventory and network map refreshed at least every 12 months, vulnerability scanning at least every six months, annual penetration testing, and encryption of ePHI at rest and in transit. OCR received roughly 4,745 comments, and the final rule's timing has slipped, with the administration's regulatory agenda now pointing to 2027. The date is uncertain. The direction is not: you will be expected to know every device you own, where it is, and what software it runs.
Third, the Consolidated Appropriations Act, 2026 extended the Acute Hospital Care at Home waiver through 2030, and CMS counts 366 approved programs across 139 health systems in 37 states. Home-based fleets are no longer pilots. They are production infrastructure with a five-year runway, and they will be audited like it.
Why home-based fleets miss every patch cycle
The numbers on in-hospital devices are already sobering. Claroty's March 2025 healthcare exposures report analyzed more than 2.25 million connected medical devices across 351 healthcare organizations and found known exploited vulnerabilities inside 99 percent of those organizations. In 86 percent of them, patient-facing devices carried confirmed exploited vulnerabilities. And those are devices that sit on managed networks, visible to security teams every day.
A device in a patient home is in a worse position on every count. It connects through consumer Wi-Fi or a cellular link you may not control. It never appears in a network scan. A remote update depends on the device being powered, connected, and idle, three things a patient's home does not guarantee. Update campaigns against fielded devices routinely leave a long tail of units that never took the patch, and nobody can say which ones without touching them.
The honest operational statement is this: for most RPM and hospital-at-home fleets, a device's firmware is whatever it shipped with at the start of the episode. If the episode is 30 days, that is a 30-day-old posture at best. If the device came back, sat on a shelf, and went straight out again, it could be running software from three enrollments ago.
The depot turn is the patch window
Between episodes, every kit passes through the same sequence: recover the device, clean it, reset it, reconfigure it, replace what failed, replenish consumables, rekit, QA, and redeploy. Most programs treat that sequence as a logistics chore. It is also the only point in the device's life where a technician holds it, powered and connected, with time to act. Every step in the turn maps to a security outcome.
| Turn step | Security outcome |
|---|---|
| Recover | Device is back inside a controlled environment and accounted for in the asset inventory |
| Reset and wipe | Prior patient data is removed and the device returns to a known state |
| Reconfigure | Firmware and software are updated to current versions and settings are reapplied from a golden image |
| QA | Version, connectivity, and function are verified and recorded, creating the audit trail |
| Redeploy | The next patient receives a device with a documented, current baseline |
Run that way, patch currency stops being a hope and becomes arithmetic. A fleet turning every 35 days is never more than 35 days behind the manufacturer's latest release. The asset inventory the proposed HIPAA rule asks for is not a separate project; it is a byproduct of a depot that logs every turn. The same discipline that keeps kits moving is the discipline that keeps them defensible.
What connectivity-first lifecycle management adds
The step where turns stall is almost always connectivity: the device that will not check in, the gateway that needs a new activation, the kit that passed bench QA and failed in the field. A connectivity-first depot closes that gap. Kits built around managed cellular, with Ericsson Cradlepoint routers and carrier service on AT&T, Verizon, or T-Mobile, take the patient's home network out of the equation entirely, which means update behavior and check-in behavior are predictable enough to verify before the kit ships.
This is the model behind RCN's hospital-at-home technology logistics practice: provisioning, kitting, depot operations, and a 24/7 U.S.-based NOC watching the connectivity layer across the fleet's whole lifecycle. Managed cellular connectivity gives every device a monitored path home, supports the technical safeguards required under HIPAA, and turns the question of which units are current from a guess into a report. It also compounds with the rest of the operation: kit turnaround time caps your census, recovery rate sets your fleet cost, and as programs scale, depot workload grows with admissions. Patch discipline rides on the same rails. A program that gets the turn right gets security nearly free; a program that improvises the turn pays for both.
Every device turn is a security event. Treat it like one.
RCN builds and runs connectivity-first depot operations for home-based device fleets: provisioning, kitting, reset and reconfigure, QA, and redeployment, with a 24/7 NOC watching the connectivity layer. Bring us your turn process and we will show you where the patch window fits.
Talk to a SpecialistFrequently asked questions
What is medical device patch management?
Medical device patch management is the process of tracking, applying, and verifying firmware and software updates across a fleet of connected medical devices. For home-based fleets such as RPM and hospital-at-home kits, it centers on the depot turn between patient episodes, because that is the only point where every device is powered, connected, and in a technician's hands.
Does FDA section 524B apply to hospitals and health systems?
No. Section 524B places obligations on device manufacturers, who must monitor vulnerabilities, provide a software bill of materials, and release patches on a regular cycle. The operational burden of actually applying those patches to fielded devices falls on the provider or its logistics partner, which is why the depot process matters.
How often should home-based RPM devices be patched?
At minimum, at every depot turn between patient episodes. A device on 30-day episodes with a 5-day turnaround gets about 10 patch windows a year, and a disciplined turn process keeps the fleet no further behind than one episode length. Devices that skip the depot step have no reliable patch cadence at all.
Can home-based devices be patched remotely instead of at a depot?
Sometimes, but not dependably. Remote updates require the device to be powered, connected, and idle, and campaigns against devices on consumer Wi-Fi leave a tail of units that never take the patch. The depot turn is the verification layer: even when updates are pushed remotely, the turn is where version and function are confirmed and documented.
What would the proposed HIPAA Security Rule changes mean for device fleets?
The January 2025 proposal would require a technology asset inventory and network map updated at least every 12 months, vulnerability scanning every six months, annual penetration testing, and encryption of ePHI at rest and in transit. A depot that logs every device turn produces the inventory and update records as a byproduct of normal operations.
What happens to a device during a depot turn?
A full turn covers recovery, cleaning, data wipe and reset, reconfiguration from a golden image including firmware updates, replacement of failed units, replenishment of consumables, rekitting, QA with documented verification, and redeployment. Each step has both a logistics purpose and a security outcome.
Speak with a Connectivity Expert
Ready to take RPM device logistics off your program’s plate?
Want to Learn More?
Request a custom quote.