BLOG

Healthcare’s Space Junk: Medical Device & IoT Security (Part 3 of 5)

Published On September 11, 2018

Blog Post by Brian Selfridge, Meditology Services IT Risk Management Partner

At the beginning of space exploration, lost satellites and flight equipment were probably not high on the space program’s priority list. Once satellites were launched and replaced, then the topic of lost “space junk” emerged. Medical device and IoT inventory management poses a similar issue in our industry. Not knowing where devices are located is a red flag in managing data security; as a treasure trove of data may be resident on the devices themselves.

A strategic direction for managing medical devices should be captured in a formal medical device and IoT security program and strategic plan.

Organizations must build a medical device security and IoT program that aligns with leading industry standards such as those offered by the FDA, NIST, MDISS, HIMSS, ISO and HITRUST. Organizations should not wait for regulators like the FDA to drive enforcement of security standards. Instead, health entities should be active in conversations with regulators about needed data security standards and work collaboratively with the medical device market to ensure appropriate data security measures are factored into product design and implementations

Understanding stakeholder needs is vital to appropriately establish a medical device security program. Motivations for key stakeholders may vary depending on their perspective.

For instance, clinicians and physicians may be most focused on patient safety, while finance may be most focused on impacts to the availability of systems to provide care and receive funding (e.g. ransomware outages have real financial impact when patients must be diverted to other facilities).

IT leadership is often focused on interruption to uptime and availability of devices and systems. Compliance leaders have a high interest in regulatory compliance, avoiding fines and audits.

Not all devices are created equal. Thus, medical devices should be tiered based on clinical safety considerations, the volume of patient records managed by the device and platform, etc. Medical device security programs must prioritize which devices to secure first and then move on to others over time.

One of the biggest gaps with technical solutions is leveraging tools to do medical device inventory discovery and then moving on to more advanced proactive protection capabilities.

Technical solutions like cloud-based inventory and IoT security automation solutions are helping to fill some of the technical security challenge gaps, but the larger challenge is defining the people and processes required to implement a medical device security program.[1]

On the macro level, health organizations should be actively involved in thought leadership with both regulatory and medical device manufacturers. By engaging in the dialogue on data security needs and vulnerabilities, CISOs are in a unique position to help set the industry standards for security of PHI. In 2017, two bills were introduced to address data security on medical devices: Internet of Medical Things Resilience Partnership Act (October 2017) [2] and the Medical Device Cybersecurity Act (August 2017).[3]

For a deep-space view of managing medical device security, download the comprehensive white paper, “Hijacking Your Life Support: Medical Device Security”, March 2017, which outlines the basics of setting up a medical device security program.

You can also download Meditology’s trend report entitled Navigating Through a Changing Cyberspace: 2018 Healthcare Data Security Outlook. It’s packed with trends and strategic advice on handling emerging and continuing threats to securing patient data.