We spent three years working with medical devices in large NHS hospitals. The lesson that stayed with us was not really about the devices. It was about who owns them, and who does not.
A connected device in a hospital sits in the middle of several groups of people, none of whom owns the whole of it. Clinical staff are the users; when it goes wrong they can tell you it is broken, rarely more. Clinical engineering are responsible for the device and can fix the device, the hardware they can hold and open up. What they cannot fix is connectivity, and the moment a fault sits in the network rather than the device, they depend entirely on the IT, network and cyber teams, who own the enterprise side and rarely know the connected equipment in any depth. Each vendor owns its own box and the surface it chooses to expose. The hard part is that at the outset no one can say which side of that line a fault is on.
And there is a real reason the connectivity teams stay on their side of it. They cannot safely investigate a device they do not understand. From the network they often cannot even tell what a given device is; standard fingerprinting will cheerfully label a cardiac monitor a router. They cannot reliably tell what it is doing, or whether a patient is depending on it at that moment. An action that is routine on an office network, reaching out to a device to see how it responds, can be unsafe on equipment that was never built to expect it. So the safe choice, and usually the right one, is to leave it alone. The fault then sits in the gap: the team that could question the network will not risk touching the device, and the team that can open the device cannot see what the network is doing to it.
Most of the time that is invisible, because most faults are small. A reported failure is, often enough, something simple: a device left off its charger, a faulty component that needs replacing, or a casing cracked in the everyday knocks of a busy ward. Clinical engineering clear those without anyone else hearing about it. The trouble starts with the faults that are not simple, the ones that live in the space between the device, the network, the patient system and the vendor. Those do not resolve in an afternoon. They resolve in weeks, in meetings, with people from inside and outside the building, while a piece of equipment someone depends on sits unavailable and no one can say, with evidence, where the fault actually is.
The cost is coordination, not just the fault
What surprised us was not the difficulty of the faults. It was the difficulty of the conversation around them.
A fault arrives as a word, “broken”, with nothing behind it. Establishing what is actually happening means assembling people who each hold one piece: the nurse who saw the symptom, the engineer who knows the device, the network team who can say what the enterprise side is doing, the vendor who will speak only for their own component. The commissioning of a new fleet of devices can put thirty people on a single call. And when something does go wrong between two vendors’ equipment, each can say, truthfully from where they sit, that their part is working. The vendors point at each other. The hospital, which has no independent way to settle it, carries the delay, the risk and the cost.
We saw both ends of what follows. At one end is the resolution that only looks quick once someone can establish what is actually happening. A monitor lost its connection. Because a batch of devices had recently gone down together, everyone assumed the same cause, and the network team was pulled in to chase a network problem. When we looked at the device itself, the answer was not the network at all. Its own network card was failing, a part inside the device, which clinical engineering could swap out on the spot. The assumption had sent the wrong team looking in the wrong place; looking at the device settled it in minutes and put the fix back in the hands of the people who could actually make it.
At the other end is what happens when no one can establish the truth at all. We watched one of those run for well over a year.
A fault no one could prove
A hospital had finally funded the replacement of a fleet of safety-critical bedside devices in critical care. The existing fleet was years past its recommended service life, and was being kept going by cannibalising units for parts, with an engineer spending close to all of their time keeping just enough of them alive. These are not nice-to-haves. When an acute care team cannot get the devices a patient needs, the pressure is immediate and it is human: the clinical staff carry it, the patient carries more, and clinical engineering takes the heat, even when the fault sits somewhere they cannot reach. The replacement was overdue, expensive and genuinely urgent.
The new devices arrived months late. When they were finally prepared for use, they would not connect to the patient system, even though the purchase had been made on the understanding that they would. Working out why took months of back-and-forth on its own. The cause, when it finally surfaced, was almost mundane: the manufacturer had moved from a proprietary protocol to the open standard that regulators rightly encourage, and the integration everyone had assumed would simply work, did not.
Fixing it needed one party to write a small piece of connecting software. Months passed without it. Meanwhile the device maker and the patient-system vendor each blamed the other, and because the hospital’s money sat with one of them, no one had a commercial reason to force the matter. One party even used the deadlock as leverage to push the hospital toward an expensive migration it had not planned to make for years.
The devices were finally commissioned well over a year after they arrived. Through all of it the hospital held the risk and had almost no lever to pull.
The deeper problem underneath the politics was simple.
No one could independently prove where the integration actually broke.
Each account was plausible and self-serving, and none could be checked against the behaviour of the equipment itself. In the absence of independent evidence at the boundary where the device met the network and the patient system, the strongest commercial position won, and the argument outlived the outage by a year.
Catching it early
With independent evidence at that boundary, of what the device was actually doing, a stand-off like that becomes a decision: one account everyone can check, instead of two that served their authors. But the deeper lesson is about timing. A buyer’s leverage is almost all spent the moment the order is signed; after that, no one in the chain is paid to fix your problem. The cheapest moment to find an integration fault, by a wide margin, is before you buy, the one point at which the buyer still holds every card. The same testing that locates a live fault can catch an integration red flag while a fleet is still a proposal. Pre-commissioning checks are not caution; they are the last point of real leverage.
Commissioning is the other half of it. Medical devices are very often set up by hand, one at a time, and manual setup at scale is manual error at scale: the same device configured a little differently across a fleet, hardened in some places and not in others, with no single record of how any of it was done. The same approach that establishes how a device behaves can carry its commissioning too, so every unit comes up the same way, hardened the same way, and written down, with the operator deciding each step. In the estates we know, that removes a whole category of error that, today, no one owns.
The part we came to value most
The work, we realised, was not only finding the fault. It was translating it.
The same fault has to be told three different ways before anything moves. To the nurse at the bedside: the monitor has stopped sending to the patient system, so observations need to be taken by hand until it is fixed. To clinical engineering: there is a communications fault between the device and the clinical systems, here is where it sits. To the IT team: here are the test results, this is what is failing and these are the systems that can and cannot be reached.
One fault, in three languages, so that each person can act on the part that is theirs.
Being able to speak all three is rarer than it sounds, and it is most of what let us help. Evidence that only one team can read is half the job; evidence every team can act on is the rest.
The volume is only going one way
Only a fraction of medical devices are connected today, and the faults that live between systems do not rise with the number of devices. They rise with the number of connections between them, which climbs much faster. What we watched teams absorb was the early part of that curve, not the peak. The ability to get to the bottom of these faults matters now, and it will matter more.
Why this travels
The acronyms are particular to hospitals. The shape is not. The same division of labour shows up everywhere under different names: an IT and security function that owns the network, an operations function that owns the equipment, and the connected devices sitting between them. Energy and data centres draw that line in their own vocabulary; they still draw it. Wherever many vendors and many teams meet around equipment no one wholly owns, the fault lives in the gap, and the argument about whose fault it is outlasts the outage. It is why we built Iris to make that gap legible: to give everyone in the room the same evidence, in language they can act on.
It is also why we are now looking at energy and at data centres, where the same pattern is sharper, the estates are larger, and the cost of a fault no one can prove is measured in more than a delayed delivery.