<i>Basically, they would log on from their control server in Eastern Europe to a blood gas analyzer; they’d then go from the BGA to a data source, pull the records back to the BGA, and then out. Wright says they were able to determine that hackers were taking data out through medical devices because, to take one example, they found patient data in a blood gas analyzer, where it wasn’t supposed to be.</i><p>Not to minimize the problems with the BGA or with other devices, but this points at least as much to a problem with the &quot;data source&quot;, which is left unidentified in TFA. One reason the BGA wouldn&#x27;t be worried about protecting PII might be that... it should never have PII in the first place. There&#x27;s a HIPAA violation somewhere, but I don&#x27;t think it&#x27;s in the BGA, and the BGA isn&#x27;t the only host that&#x27;s assuming a safe network.<p>Target, Home Depot, etc. have been justifiably criticized for operating their POS devices as if firewalls could possibly be sufficient to protect a large network. Hospitals might consider themselves more noble than mere stores, but it doesn&#x27;t make a difference to a hacker.