Stop Calling It Boring: How Healthcare Inventory Drives Security Strategy

I get it. The word inventory doesn’t exactly light up a room. 

When I brought it up at HIMSS earlier this year, I saw the same glazed-over looks I used to get during physical inventory nights in retail — count this, count that, try not to fall asleep. 

But here’s what I told that audience: imagine trying to run a hospital without knowing what’s in your stockroom. You wouldn’t make purchasing decisions, manage staff, or deliver care without that visibility. So why are we still okay not knowing what’s running across our network? 

Today’s inventory isn’t a spreadsheet. It’s real-time, automated asset intelligence. It tells you not just what’s out there, but whether it’s secure, compliant, and behaving properly. 

Inventory Isn’t a List. It’s Context. 

When I talk about inventory today, I don’t just mean “this is a device with a serial number.” I mean complete context: 

• Here’s the device, where it is, and who’s using it 

• Here’s the software installed and vulnerabilities it’s exposed to 

• And here’s what it’s talking to on the network 

That context tells a story. Not just what you have, but whether it’s safe, where it’s vulnerable, and how it might be putting patient care at risk. 

You can’t segment systems without it. You can’t patch the right assets without it. You can’t even do MFA right if you don’t know what’s out there. 

Modern inventory needs to provide real-time visibility across every connected asset. That includes IT, IoMT, and OT systems. You need deep context like OS versions, patch levels, vulnerabilities, and communication behavior. 

Why the Stakes Have Never Been Higher 

The proposed HIPAA/HITECH security rules made three things clear. First, map your systems. Second, segment your networks. Third, implement real-time patch management. All three depend on strong inventory foundations. 

But these aren’t just compliance boxes. They’re business basics. You can’t secure what you can’t see. You can’t act on what you don’t understand. And you definitely can’t pass audits if your visibility stops at IT endpoints. 

Whether specific rules stick or not, the writing’s on the wall. These capabilities are becoming de facto standards. Organizations treating inventory like a checkbox pay for it later through breach recovery, fines, and downtime. 

The Ownership Problem 

Here’s where it gets complicated: 

• HTM owns medical devices 

• IT owns infrastructure and endpoints 

• Security handles enforcement and monitoring 

• Facilities covers OT and building automation 

No one owns the complete picture. During recent industry discussions, this sparked heated debate among healthcare executives. Outside healthcare, over 70% of CISOs report directly to the CEO. In healthcare? Not even close to 50%. 

The result is fragmented visibility. You get shared accountability that often means no real accountability. 

Moving Beyond Manual Processes 

If you’re relying on spreadsheets, assumptions, or stale audit data, you’re exposed. Whether it’s ghost devices, unmanaged assets, or vulnerabilities quietly waiting to be exploited. 

As one healthcare CTO recently put it: “I want eyes everywhere because it’s all going to be my name splashed up on that website if something bad happens.” 

The solution isn’t just better tools. It’s recognizing that inventory has evolved into asset intelligence. It’s a strategic capability that enables security, operations, and business planning. 

The Foundation for Everything Else 

Strong inventory doesn’t just make you safer. It makes you more efficient, budget-conscious, and credible when leadership asks hard questions. 

Can your CISO immediately isolate an infected device and tell you what it is, who logged in, what it communicated with, and how to contain it? 

Can your CIO track software versions, usage, and patch status across every connected device? 

Can you show your board where the blind spots are? 

That’s why inventory matters. It’s the foundation for segmentation, vulnerability management, incident response, and compliance. 

The Bottom Line: You need to know everything about everything. 

That’s what ORDR delivers, and it’s exactly why I joined the team. 

Our platform gives you real-time, automated, contextual inventory across IT, OT, and IoMT. No spreadsheets. No guesswork. Just full visibility and a clear path to action. 

And honestly? It’s anything but boring. 

If you’re still treating inventory like a static list or assuming your CMDB kind of covers it, it’s time to rethink your approach. 

Want to dig deeper? 

In our recent webinar, I joined leaders from SHI and First Health Advisory to talk about HIPAA, inventory, and the real-world work behind building security from the ground up. 

We don’t sugarcoat it. But we do show how the right foundation makes everything else easier. 

Check it out, or feel free to reach out to me directly on LinkedIn. Always happy to talk shop. 

Let’s stop treating inventory like a chore. Let’s start using it as a strategy.