Practical Tips for Developing IoT Devices for Healthcare

At-a-Glance

The challenge: Building connected medical devices in a regulated, high-stakes environment

Developing connected medical devices involves more than just technical proficiency. It requires navigating complex regulatory landscapes, security initiatives, and managing long-term device lifecycles. This blog outlines key challenges in healthcare IoT development and how the FoundriesFactory™ platform can assist in building compliant, adaptable, and durable software solutions.

Navigating Regulatory Requirements

Healthcare IoT devices are subject to stringent regulations. In the United States, the Food and Drug Administration (FDA) mandates, amongst other things, that medical devices address cybersecurity risks. The FDA's guidance in this area emphasizes the inclusion of Software Bills of Materials (SBOMs), vulnerability management plans, and secure update mechanisms in premarket submissions. [Source: FDA Cybersecurity Guidance]

In the European Union, the Medical Device Regulation (EU MDR) requires manufacturers to classify software based on risk and mandates comprehensive post-market surveillance.[Source: EU MDR Overview]

Attempting to meet these requirements with outdated tools and manual processes can lead to increased complexity and potential non-compliance.

Ensuring Data Security and Workflow Integrity

Medical IoT devices often handle sensitive patient data and are tightly integrated with clinical workflows. Any vulnerability, such as default credentials or unsigned firmware, can compromise both trust and patient safety. These vulnerabilities are among the most common entry points for attackers targeting medical devices, as outlined in the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook published by MITRE (Massachusetts Institute of Technology Research and Engineering).

Without scalable and verifiable update mechanisms, patching vulnerabilities in the field becomes difficult, especially when devices are distributed across hospitals or remote clinics.

Long lifespans, increasing maintenance burden

Healthcare devices are typically expected to operate reliably for ten years or more. Supporting software on that timeline requires consistent patching, configuration control, and compliance updates. Teams relying on static images or traditional handoffs often struggle to maintain product quality and security focus across the full lifecycle.

Updates without downtime

In healthcare, failed updates can be even more costly than in other environments, as they can impact and potentially disrupt patient care. Whether updating one device or an entire fleet, developers must minimize risk. Yet many in-house over-the-air (OTA) systems lack the rollback mechanisms or deployment controls necessary for clinical reliability.

Complex and fragmented development environments

Medical IoT devices often span hardware platforms, integrate with hospital IT systems, connect to cloud services, and run edge AI models. Managing this complexity with hand-assembled Linux distributions, custom board support packages (BSPs), and ad-hoc tooling increases the risk of inconsistencies and technical debt.

How the FoundriesFactory platform can help address these challenges

The FoundriesFactory platform is designed to offer support to teams building and maintaining connected embedded devices in these regulated environments. It is a complete platform designed to help deliver Linux-based products that can be securable, traceable, and built to last.

End-to-end security-focused infrastructure

The FoundriesFactory platform includes features that help developers to create and maintain securable medical devices. Devices can use hardware-based root of trust, digitally signed software artifacts, and verified firmware updates using The Update Framework (TUF). These practices help prevent unauthorized code from being installed on production systems.

We support platform-level features like secure boot and provide integration pathways for hardware-based trust anchors. FoundriesFactory is aligned with Platform Security Architecture (PSA) Certified Level 1 requirements.

Long-term lifecycle support built in

FoundriesFactory enables teams to maintain products in the field throughout the product lifecycle. Incremental OTA updates reduce bandwidth usage and can be deployed using phased rollouts with full rollback control.

Using our OTA update infrastructure, developers can deploy new builds to internal test devices or QA environments with the ability to control what gets pushed, when, and to whom.

The platform also supports “wave”, a deployment feature that allows updates to be rolled out gradually across subsets of devices. This phased approach facilitates validation under tightly controlled conditions, ensuring that each update performs as expected in the field before it reaches broader populations.

Customization without compromise

The Foundries.io Linux microPlatform™ (LmP), built using the Yocto Project, provides a customizable, open Linux base with full developer control. Learn more about how it works in our LmP documentation. Teams can bring their own BSPs, proprietary drivers, and third-party integrations without sacrificing CI/CD capabilities or update reliability.

This approach gives developers deep configurability and flexibility while maintaining the consistency needed for long-lived products in regulated industries.

Embedded DevOps with traceability

FoundriesFactory enables continuous integration and deployment for embedded systems. Every time a change is pushed, whether to firmware, kernel, or containerized applications—a versioned and auditable build is automatically created. All artifacts are reproducible and traceable, simplifying documentation for regulators and accelerating response time when vulnerabilities emerge.

Each build includes a software bill of materials (SBOM), automatically generated and version-linked. These SBOMs can be exported and used in premarket submissions or vulnerability analysis. When a Common Vulnerability or Exposure is announced, teams can more easily trace which deployed builds are affected and deploy patches using the same OTA infrastructure.

See how we build SBOMS

Read more about OTA best practices

Key Features Beneficial to Healthcare IoT Developers

• Securable OTA Updates: Delivers digitally signed, encrypted updates with phased rollout and rollback support, potentially reducing exposure to supply chain threats.
• CI/CD Pipelines for Embedded Systems: Automates firmware, kernel, and application builds with integrated testing and deployment, helping to reduce time-to-market.
• Reproducible Builds and SBOMs: Tracks all components in each build and automatically generates SBOMs, potentially assisting with compliance with FDA and EU MDR requirements.
• Containerized Applications: Supports application containers that are decoupled from the base operating system, allowing updates to individual software modules without recertifying the entire stack.
• Fully Customizable Linux Base: Provides a Yocto-based embedded Linux OS that developers can adapt for any board or system design, offering full control with no vendor lock-in.

With FoundriesFactory platform, we help medical IoT teams build high-integrity, update-ready products faster and with greater confidence.

Are you looking to offload complex underlying software systems to focus your expertise into your real value add activities?

• Launch a Community Edition factory – create a fully featured FoundriesFactory instance in under 10 minutes and run a test OTA update. No payment details required.
• Request a technical demo – our engineers will answer your implementation questions and demo our key features.

Download Healthcare Spotlight