Table of Contents
You are working in a clinic, and your patient is sharing personal information and symptoms. One of the monitors might be recording the conversation, and you will never know.
Hospitals are full of screens, from waiting-room signage to operating room monitors. Most of us don’t think of these devices as computers with microphones and network access, but many of them are programmed to be. In September 2026, allegations against tech company LG showed what that can mean for the healthcare industry.
The Investigation
The investigation into LG, which was published by Gamers Nexus, Level1Techs, and independent security researchers, analyzed network traffic and firmware on several LG televisions. They reported extensive device and network discoveries, ACR tracking, and security weaknesses that could make a compromised TV far more dangerous.
Although LG claims that voice recordings can be made on its devices using the wake word, whether the device is on or off, the study found that audio was captured even when the TV was unplugged. Device connectivity is another consideration for smart devices and can potentially harm healthcare businesses. During the investigation, Gamers Nexus found that the LG TVs “found dozens of unrelated devices, including smartwatches and phones of our staff…which might explain how LG ads can claim it knows about 363 million addressable secondary devices in the US.” However, LG officially claims that 216 million smart TVs have been sold worldwide so far.
The Technology Behind It
Automated content recognition (ACR) has been built into many smart TVs. It is a technology that can identify the media playing on a compatible device. This means a TV can take small audio or video samples of what is on screen and turn them into digital fingerprints. These fingerprints are then matched against a reference library of known programs, ads, and media. The technology can tell what appeared, when, and for how long. It can also distinguish whether the source was broadcast, streaming, or a connected console. Although ACR does not track who is watching or using the devices, the same hardware that samples the screen is alongside the microphones and network access.
Bluetooth adds another layer, and healthcare is already invested in it. Bluetooth mesh networking is where devices relay messages through one another to extend range across a building. It is already used in healthcare environments, but there are concerns with the way it interacts with wearable devices worn by clinicians, nurses, and patients across hospitals and clinics. Bluetooth wearables like smartwatches, fitness trackers, and earbuds can discover and sync with nearby Bluetooth-enabled devices, as was found by Forbes last year.
Security researchers surveying bluetooth low energy mesh networks have also noted that intrusion detection of these networks is still in the early stages of research. In clinical and hospital settings, that means a gap in security tooling on top of growing numbers of connected devices.
The lesson for healthcare is the same as for monitors. Any device with a microphone and a wireless connection can become a listening point. Healthcare organizations of all sizes should be cautious about every Bluetooth device that enters a clinical space. Patients can help by turning off Bluetooth when they enter a doctor’s office. Clinics can reinforce this with signage and check-in reminders.
What ACR Means for Healthcare
LG is a large player in consumer electronics, and it has been working its way into environments like healthcare. In hospital and clinic settings, the most prominent technology consists of lobby signage, kiosks, tablets, and operating room and surgical monitors. If connected displays like these share any behaviors described above, a hospital faces the following three problems.
1. Conversations
Waiting rooms, recovery rooms, and ORs are where patients and clinicians talk about treatments, diagnoses, and medications. If a device in the room captures or stores audio, even by accident, it would be capturing very sensitive data.
2. Screen Content
One of the fundamentals of ACR is to sample what is being displayed. Signage boards and kiosks are harmless. The smart monitors that display charts, imaging studies, or schedules are showing protected health information.
3. A Foothold on the Network
The researchers in the investigation noted that smart TVs can map nearby devices on the local network. Compromised TVs could serve as an entry point for probing other devices. In hospital and clinical settings, “other devices” include imaging systems and clinical workstations.
Overall, the primary consideration for smart devices like LG monitors in healthcare is compliance with regulatory bodies. HIPAA regulations, which require patient and treatment confidentiality, could be violated if the smart devices in your clinic are recording voice or screen activity. Want to know more? Read our blog on HIPAA compliance for smart devices in healthcare.
What Healthcare Organizations Can Do Today
Though the risk is present and should not be ignored, there are many things that healthcare organizations of all sizes can do to strengthen the security of their organization in terms of smart devices.
Below is a breakdown of 6 things you can do today to make your smart devices safer to use in a healthcare setting.
1. Take Inventory
Take inventory of every smart display, TV, tablet, and kiosk and find out which ones have microphones, ACR, or cloud connectivity. Record the device location, model, firmware version, and whether it has a microphone or camera. Also, check whether ACR or voice features exist, what network it’s on, and who owns it.
2. Turn off ACR
Turn off ACR, voice recognition, viewing-data collection, and personalized advertising on any smart display in a clinical or patient-facing area. On smart devices, ACR can be turned on or off in the system settings app. Here, one can also find personalized advertising settings and turn them off, as these settings are cited as one of the biggest concerns in the GamersNexus investigation.
3. Segment the Network
Put displays and kiosks on a separate VLAN and set firewall rules that block them from reaching clinical systems and internal networks. Only necessary outbound traffic should be allowed in the network, and UPnP should be turned off on the routers. If a display cannot be isolated, you should remove it from your network.
4. Patching
Record and track each display’s firmware version, and check for security updates on a regular schedule. You can also ask vendors how long each model will be supported so you can stay on top of your updates. Lastly, it is important to replace displays that no longer receive updates.
5. Ask Vendors What is Collected
Before buying or renewing a device, you can ask the vendor what the product collects, where the data goes and how long it is kept. Also, you should consider if the device has a microphone or screen-sampling feature. Vague answers to these questions should be noted and considered in the purchase phase.
6. Involve your Privacy and Compliance Officers Now
Ask your privacy and compliance officers to add smart displays to your HIPAA risk analysis and risk register. They can also decide in advance who investigates if a display turns out to be recording or compromised.
The Key Takeaway
This problem is not limited to LG. Connected devices with microphones, cameras, or screen-sampling features can become surveillance tools, intentionally or not. Healthcare businesses and professionals should not treat displays as furniture. They are networked computers inside our most private spaces and need the same level of security as any other endpoint.
