Examining the Research Gap in Cybersecurity for Healthcare IoT in Nigerian Tertiary Hospitals

Connected medical devices and healthcare IoT systems are being deployed in Nigerian tertiary hospitals without adequate security assessment, creating patient safety risks and data breach vulnerabilities that the academic literature has not documented. This study examined the research gap in healthcare IoT cybersecurity in Nigeria through systematic review and original field assessment. A systematic scoping review of eleven databases identified 156 publications from 2019 to 2024 on healthcare IoT security, of which zero addressed Nigerian contexts. Original field assessment at five tertiary hospitals in Enugu, Lagos, Abuja, Kano, and Maiduguri comprised structured interviews with 25 clinical engineers and passive network scans of medical device segments. Field assessment identified 847 connected medical devices across the five hospitals. Seventy-three percent used default or factory credentials. Firmware update processes were absent for 61 percent. Network segmentation separating medical devices from general hospital networks was implemented in only one hospital. Awareness of medical device-specific threats was present in only 12.0 percent of clinical staff interviewed. The study identifies critical security gaps and five research priorities for healthcare IoT security in Nigeria, proposes minimum security requirements for connected medical devices in Nigerian hospitals, and recommends the Federal Ministry of Health establish a regulatory standard for medical device cybersecurity in collaboration with NITDA and NAFDAC.

Keywords: healthcare IoT, medical device security, hospital cybersecurity, Nigeria, research gap