How can shared responsibility models improve healthcare cybersecurity?
In this episode, Greg Garcia joins Christian and Trevor to break down the evolving landscape of medical device cybersecurity from a national policy perspective. Together, they discuss the legacy device challenge, shared accountability, and how sector-wide collaboration is critical to progress. The episode drives home the message that cybersecurity is not just technical—it’s foundational to patient safety and innovation.
Greg Garcia is one of the people shaping the future of critical infrastructure cybersecurity—and he’s got the track record to back it up. As executive director of the Health Sector Coordinating Council Cybersecurity Working Group, he’s all about connecting the dots between policy, industry, and patient safety.
Key points:
(1:30) Cyber in Critical Infrastructure
* Greg’s career path from Homeland Security to health sector leadership.
* The Health Sector Coordinating Council’s mission.
(10:35) The Legacy Device Dilemma
* Medical device cybersecurity suffers from the finger-pointing between HDOs and MDMs.
* Managing unsupported devices and contractual accountability.
(18:05) Budget Gaps and Cultural Challenges
* Rural hospitals and underfunded providers struggle to keep up with cybersecurity expectations.
* The case for regulatory mandates to level the playing field.
(31:47) Regulation, Risk, and Big Ideas
* The idea of Authorization to Operate (ATO) for health tech.
* Comparisons to Department of Defense (DoD) and FedRAMP models are raised as a vision for healthcare.
(40:12) Culture Over Compliance
* Why data shows low medical device exploitation—but that’s no reason to relax.
* How to make “secure by default” a reality.
The Med Device Cyber Podcast is brought to you by Blue Goat Cyber, cybersecurity professionals specializing in providing elite cyber solutions for medical devices. Learn more about securing your product and business from cyber-criminals by visiting https://bluegoatcyber.com
If you’re interested in our services or partnering with us, schedule a Discovery Session: https://meetings.hubspot.com/blue-goat-cyber/discovery-session
Thanks to Greg Garcia for being on the show. Connect with Greg Garcia on LinkedIn: https://www.linkedin.com/in/gregorytgarcia/
Learn about the Health Sector Coordinating Council: https://healthsectorcouncil.org/
Christian Espinosa is the CEO and founder of Blue Goat Cyber. Trevor Slattery is the Chief Technology Officer / Director of MedTech Cybersecurity at Blue Goat Cyber.
Christian Espinosa on LinkedIn: https://www.linkedin.com/in/christianespinosa/
Blue Goat Cyber on LinkedIn: https://www.linkedin.com/company/blue-goat-cyber/
Blue Goat Cyber on Instagram: https://www.instagram.com/bluegoatcyber/
Blue Goat Cyber on Facebook: https://www.facebook.com/bluegoatcyber/
Blue Goat Cyber on YouTube: https://www.youtube.com/@BlueGoatCyber
Trevor Slattery on LinkedIn: https://www.linkedin.com/in/trevor-slattery-34852b1a9
Feedback? Questions? Contact: https://bluegoatcyber.com/contact/
Learn more about Christian Espinosa, buy his books, or invite him to speak on your stage: https://christianespinosa.com/
Christian Espinosa on YouTube: http://www.youtube.com/@ChristianEspinosaOfficial
The Med Device Cyber Podcast is your essential resource for medical device cybersecurity. Each episode we dive into the latest threats, solutions, and best practices to protect modern healthcare technology. Whether you're a provider, a manufacturer, or a cybersecurity professional, gain the knowledge to safeguard patient safety by subscribing to the Med Device Cyber Podcast.
Subscribe via Spotify: https://spoti.fi/3XX95g0
Subscribe via Apple Podcasts: https://apple.co/483OJ9I
Subscribe via YouTube: https://www.youtube.com/@BlueGoatCyber/podcasts
This episode was produced by Story On Media: https://www.storyon.co/
