Free EMR Newsletter Want to receive the latest news on EMR, Meaningful Use, ARRA and Healthcare IT sent straight to your email? Join thousands of healthcare pros who subscribe to EMR and HIPAA for FREE!!

Balancing Simplicity With the Exploding Challenges of Medical Device Security

Posted on December 3, 2018 I Written By

The following is a guest post by Gus Malezis, President and CEO of Imprivata.

The digitization of healthcare has allowed healthcare organizations to utilize robust technology such as network-connected medical devices to help improve both patient care and provider experience across the entire care continuum. Within this Internet of Medical Things (IoMT), medical devices can track and monitor patient stats, provide diagnostic information, help ensure lifesaving care delivery, and even make recommendations on treatment and clinical decision support – all while communicating directly with healthcare IT systems to ensure more complete and accurate patient medical records.

With these benefits of digitally connected medical devices, however, we now must consider and address a series of issues that are introduced with network connectivity and automated data integration; issues that relate to patient health and safety, cybersecurity, and compliance.

Simply put, advanced network-connected technology opens these devices to the risk of exploitation and compromised patient safety from both internal and external threats. Whether it’s an uninformed patient making changes to an unlocked infusion pump, someone stealing valuable protected health information (PHI) stored on an unattended device, or a cybercriminal using a network-connected medical device to gain backdoor access to a hospital’s entire network or disable the function of the devices (for the purpose of extracting ransomware), medical devices are now a source of risk for both healthcare organizations and patients. Compounding this issue is the fact that medical devices frequently run outdated operating systems and applications, all of which are difficult, or even impossible, to patch or otherwise protect with other standard security measures.

By 2020, the number of IoT devices is expected to reach 20.4 billion, and the number of IoMT devices is expected to reach 161 million. These numbers of incremental networked devices are truly staggering, which proportionally increases the risks of hacking, compliance, and health and safety. Clearly, healthcare IT can no longer afford to manage medical devices under current security protocols.

How locking down affects provider workflow

To address this threat and mitigate the risk posed by IoMT devices, organizations naturally look to implement security systems and tools that will safeguard the devices, enable only authorized personnel to interact and adjust/calibrate the devices, and safeguard access to patient records, clinical applications, and other sensitive data. Before implementing such solutions, however, healthcare organizations should consider several factors – particularly those relating to workflow.

Unlike other industries, healthcare can’t simply lock down information by building multi-layer security. Additionally, the focus is always on patient care, so minutes…and even seconds…truly matter, and clinicians need fast, unimpeded access to patient information. Layering in cumbersome security protocols has the potential to introduce new workflows, or create barriers to care. It is therefore critical that healthcare systems designers and architects consider several key factors when evaluating security options.

For starters, think about workflow integration: Any security tool should allow for optimal workflow efficiency among users, and that means the clinical staff and providers should not need to be “trained” on something new, or adopt a new workflow. Ideally, this means finding flexible and easy-to-use security tools that meet current existing workflows and preferences. Choosing easy-to-use options allows for security to be transparent so providers can focus on patient care, not on technology. For example, clinicians are accustomed to Tap-in and Tap-out (TITO) technology as a means of accessing HIT windows-based systems. This same workflow should be integrated and facilitated in anything new, thereby enabling secure and compliant access by utilizing a current and well known and adopted workflow. This is a win-win-win…the clinical staff win by using the same workflow, while IT, Cybersecurity, and Compliance teams also achieve their goals.

Another key factor is extensibility to other workflows: The need for security stretches across a number of different business and clinical workflows and applications. Healthcare organizations should look into a solution that provides the extensibility to meet all workflow needs, with the same consistent and transparent workflow model.

Addressing this challenge requires fast, efficient, and secure authentication for all devices that require security, including medical devices. For medical devices already requiring user authentication, appropriate security tools can improve efficiency by replacing the cumbersome manual entry of usernames and passwords with fast, automated authentication through the simple tap of a badge. Here we want to leverage the same consistent and transparent workflow model.

This way, organizations can optimize their use of interconnected medical devices to improve the delivery of care. They also maintain security and meet regulatory compliance requirements while ensuring efficiency for providers and giving them more time to focus on patient care.

Focusing on physical security and ID/Access control can enable the right balance — something that’s uniquely necessary in healthcare. A healthcare organization’s medical device access security plan should be part of a comprehensive identity and multifactor authentication platform for fast, secure authentication workflows across the healthcare enterprise. The medical device piece should combine security and convenience by enabling fast, secure authentication across enterprise workflows while creating a secure, auditable chain of trust wherever, whenever, and however users interact with patient records and other sensitive data.

As organizations are tuning in to the unique challenges of the IoMT era, it’s time to implement foundational security best practices with modalities that are tailored specifically to clinical workflows. Doing so achieves the balance necessary to ensure both security and flexibility.

About Gus Malezis
Gus Malezis is the President and Chief Executive Officer of Imprivata. Gus is widely recognized as a visionary leader in the information technology security industry where he brings more than 30 years of experience driving innovation and growth while building market leading organizations. Prior to joining Imprivata, Gus was most recently the President of Tripwire, a leading global provider of endpoint detection and response, security and compliance solutions. In his career, Gus has built a strong track record of delivering growth and innovation for leading technology and security companies such as Tripwire, McAfee, and 3Com.

IoT Cartoon – So Much Healthcare – Fun Friday

Posted on February 2, 2018 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

SAP shared a really great IoT cartoon that illustrated a wide variety of ways that our devices (and yes, everything is becoming a device) will be connecting and communicating with us. What was surprising to me when I saw it was how many of them had something to do with our health.

Obviously we still have some work to do with how our devices communicate with us. However, this was a funny look at the future of what’s being monitored and communicated to us.

Healthcare Cybersecurity Cartoon – Fun Friday

Posted on July 21, 2017 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

This week’s Fun Friday comes from the #IoMTchat (Internet of Medical Things) and was shared by Rasu Shrestha. This cartoon has so many good elements including the great password sticky note. As in most humor, this isn’t too far from the truth.

Rasu is spot on in his tweet too. Key to cybersecurity in healthcare is understanding employee behaviors and motivators. You’ll never change the culture and improve cybersecurity if you don’t understand your employees’ needs.

The “Disconnects” That Threaten The Connected World

Posted on January 11, 2017 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

I’m betting that most readers are intimately familiar with the connected health world. I’m also pretty confident that you’re pretty excited about its potential – after all, who wouldn’t be?  But from what I’ve seen, the health IT world has paid too little attention to problems that could arise in building out a connected health infrastructure. That’s what makes a recent blog post on connected health problems so interesting.

Phil Baumann, an RN and digital strategist at Telerx, writes that while the concept of connecting things is useful, there’s a virtually endless list of “disconnects” that could lead to problems with connected health. Some examples he cites include:

  • The disconnect between IoT hardware and software
  • The disconnect between IoT software and patches (which, he notes, might not even exist)
  • The disconnect between the Internet’s original purpose and the fast-evolving purposes created in the Connected World
  • The disconnects among communication protocols
  • The disconnect between influencers and reality (which he says is “painfully wide”)
  • The disconnects among IoT manufacturers
  • The disconnects among supply chains and vendors

According to Baumann, businesses that use IoT devices and other connected health technologies may be diving in too quickly, without taking enough time to consider the implications of their decisions. He writes:

Idea generation and deployment of IoT are tasks with enormous ethical, moral, economic, security, health and safety responsibilities. But without considering – deeply, diligently – the disconnects, then the Connected World will be nothing of the sort. It will be a nightmare without morning.

In his piece, Baumann stuck to general tech issues rather than pointing a finger at the healthcare industry specifically. But I’d argue that the points he makes are important for health IT leaders to consider.

For example, it’s interesting to think about vulnerable IoT devices posing a mission-critical security threat to healthcare organizations. To date, as Baumann rightly notes, manufacturers have often fallen way behind in issuing software updates and security patches, leaving patient data exposed. Various organizations – such as the FDA – are attempting to address medical device cybersecurity, but these issues won’t be addressed quickly.

Another item on his disconnect list – that connected health deployment goes far beyond the original design of the Internet – also strikes me as particularly worth taking to heart. While past networking innovations (say, Ethernet) have led to rapid change, the changes brought on by the IoT are sprawling and almost unmanageable under current conditions. We’re seeing chaotic rather than incremental or even disruptive change. And given that we’re dealing with patient lives, rather than, for example, sensors tracking packages, this is a potentially dangerous problem.

I’m not at all suggesting that healthcare leaders should pull the plug on connected health innovations. It seems clear that the benefits that derive from such approaches will outweigh the risks, especially over time. But it does seem like a good idea to stop and think about those risks more carefully.

Healthcare Is Going to Benefit from the Confluence of Consumer Technologies

Posted on December 28, 2016 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

Next week is the annual CES conference in Las Vegas. It’s a unique event that brings together 170,000 people across 4 of the largest conference venues in the world. It’s enormous and a little hard to process.

Having attended for the last ~11 years, it’s been amazing to see the pace of progress with so many technologies. Remember that it’s only been about 9 years since the iPhone was launched. While smartphones and tablets have gotten so much better over this time period a whole slew of other consumer technologies have as well.

Looking forward to CES, it’s amazing to see the development of things like: 3D Printing, Virtual Reality, Augmented reality, IoT (Internet of Things…or as I like to call it Smart Everything), voice recognition, AI, robotics, sensors, etc etc etc. It’s an exciting time to be in an industry where so many things are developing so quickly.

Maybe I’m skewed because I’m a blogger in healthcare, but it’s really amazing how healthcare sits at the confluence of so many of these technologies. The overlap that’s going to happen between augmented reality, 3D printing, AI, sensors and new things we barely understand is going to be extraordinary.

I recently saw a 3D printing conference for healthcare. While 3D printing is very exciting for healthcare, it wouldn’t be nearly as exciting if we didn’t have all of the other innovations in cameras, storage, data sharing, virtual reality, etc. We needed evolutions and innovations in all of these spaces for the other technologies to really work well.

I’ve often said that the most interesting things in healthcare happen at the intersections. I think that’s particularly true in the digital health space. As I head to CES, I’ll be watching for this type of crossover of technologies. I think this year we’re going to see a lot of companies utilizing multiple technologies in ways we’d never seen previously.

Securing IoT Devices Calls For New Ways Of Doing Business

Posted on June 8, 2016 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

While new Internet-connected devices can expose healthcare organizations to security threats in much the same way as a desktop PC or laptop, they aren’t always procured, monitored or maintained the same way. This can lead to potentially major ePHI breaches, as one renowned health system recently found out.

According a piece in SearchHealtlhIT, executives at Intermountain Healthcare recently went through something of a panic when connected audiology device went missing. According to Intermountain CISO Karl West, the device had come into the hospital via a different channel than most of the system’s other devices. For that reason, West told the site, his team couldn’t verify what operating system the audiology device had, how it had come into the hospital and what its lifecycle management status was.

Not only did Intermountain lack some key configuration and operating system data on the device, they didn’t know how to prevent the exposure of stored patient information the device had on board. And because the data was persistent over time, the audiology device had information on multiple patients — in fact, every patient that had used the device. When the device was eventually located, was discovered that it held two-and-a-half years worth of stored patient data.

After this incident, West realized that Intermountain needed to improve on how it managed Internet of Things devices. Specifically, the team decided that simply taking inventory of all devices and applications was far from sufficient to protect the security of IoT medical devices.

To prevent such problems from occurring again, West and his team created a data dictionary, designed to let them know where data originates, how it moves and where it resides. The group is also documenting what each IoT device’s transmission capabilities are, West told SearchHealthIT.

A huge vulnerability

Unfortunately, Intermountain isn’t the first and won’t be the last health system to face problems in managing IoT device security. Such devices can be a huge vulnerability, as they are seldom documented and maintained in the same way that traditional network devices are. In fact, this lack of oversight is almost a given when you consider where they come from.

Sure, some connected devices arrive via traditional medical device channels — such as, for example, connected infusion pumps — but a growing number of network-connected devices are coming through consumer channels. For example, though the problem is well understood these days, healthcare organizations continue to grapple with security issues created by staff-owned smart phones and tablets.

The next wave of smart, connected devices may pose even bigger problems. While operating systems running mobile devices are well understood, and can be maintained and secured using enterprise-level processes,  new connected devices are throwing the entire healthcare industry a curveball.  After all, the smart watch a patient brings into your facility doesn’t turn up on your procurement schedule, may use nonstandard software and its operating system and applications may not be patched. And that’s just one example.

Redesigning processes

While there’s no single solution to this rapidly-growing problem, one thing seems to be clear. As the Intermountain example demonstrates, healthcare organizations must redefine their processes for tracking and securing devices in the face of the IoT security threat.

First and foremost, medical device teams and the IT department must come together to create a comprehensive connected device strategy. Both teams need to know what devices are using the network, how and why. And whatever policy is set for managing IoT devices has to embrace everyone. This is no time for a turf war — it’s time to hunker down and manage this serious threat.

Efforts like Intermountain’s may not work for every organization, but the key is to take a step forward. As the number of IoT network nodes grow to a nearly infinite level, healthcare organizations will have to re-think their entire philosophy on how and why networked devices should interact. Otherwise, a catastrophic breach is nearly guaranteed.

Wearable Health Trackers Could Pose Security Risks

Posted on February 1, 2016 I Written By

Anne Zieger is a healthcare journalist who has written about the industry for 30 years. Her work has appeared in all of the leading healthcare industry publications, and she's served as editor in chief of several healthcare B2B sites.

Last October, security researchers made waves when they unveiled what they described as a 10-second hack of a Fitbeat wearable health tracker. At the Hack.Lu 2015 conference, Fortinet security researcher Axelle Apvrille laid out a method for hacking the wearable through its Bluetooth radio. Apparently, Aprville was able to infect the Fitbit Flex from as much as 15 feet away, manipulate data on the tracker, and use the Flex to distribute his code to a computer.

Fitbit, for its part, denied that its devices can serve as vehicles for infecting users with malware. And Aprville himself admitted publicly that his demonstration was more theoretical than practical. In a tweet following the conference, he noted that he had not demonstrated a way to execute malicious code on the victim’s host.

But the incident does bring attention to a very serious issue. While consumers are picking up health trackers at a breathless pace, relatively little attention has been paid to whether the data on these devices is secure. Perhaps even more importantly, too few experts are seeking ways to prevent these devices can be turned into a jumping-off point for malware. After all, like any other lightly-guarded Internet of Things device, a wearable tracker could ultimately allow an attacker to access enterprise healthcare networks, and possibly even sensitive PHI or financial data.

It’s not as though we aren’t aware that connected healthcare devices are rich hunting grounds. For example, security groups are beginning to focus on securing networked medical devices such as blood gas analyzers and wireless infusion pumps, as it’s becoming clear that they might be accessible to data thieves or other malicious intruders. But perhaps because wearable trackers are effectively “healthcare lite,” used almost exclusively by consumers, the threat they could pose to healthcare organizations over time hasn’t generated a lot of heat.

But health tracker security strategies deserve a closer look. Here’s some sample suggestions on how to secure health and fitness devices from Milan Patel, IoT Security Program Director at IBM:

  • Device design: Health tracker manufacturers should establish a secure hardware and software development process, including source code analysis to pinpoint code vulnerabilities and security testing to find runtime vulnerabilities. Use trusted manufacturers who secure components, and a trusted supply chain. Also, deliver secure firmware/software updates and audit them.
  • Device deployment:  Be sure to use strong encryption to protect privacy and integrity of data on the device, during transmission from device to the cloud and on the cloud. To further control device data, give consumers the ability to set up user and usage privileges for their data, and an option to anonymize the data.Secure all communication channels to protect against data change, corruption or observation.
  • Manage security:  Include trackers in the set of technology being monitored, and set alerts for intrusion. Audit logging is desirable for the devices, as well as the network connections and the cloud. The tracker should ideally be engineered to include a fail-safe operation — dropping the system down to incapability, safely — to protect against attacks.

This may sound like a great deal of effort to expend on these relatively unsophisticated devices. And at present, it just may be overkill. But it’s worth preparing for a world in which health trackers are increasingly capable and connected, and increasingly attractive to the attackers who want your data.

Measuring Patient Discomfort Using Brainwave Activity

Posted on December 30, 2015 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

Digital health opportunities are popping up everywhere and in every part of the nation. The IoT Journal (Internet of Things) recently profiled a hospital down the street from me who is exploring IoT’s potential to bring drug free relief to patients. Here’s a short excerpt from the article:

Until recently, when health-care providers wanted to gauge the level of discomfort a patient was enduring, they typically had to ask that individual to rate his or her pain—for example, on a scale of 1 to 10—and then use that information to plan treatment accordingly. If they wanted to ease the patient’s pain, they needed to administer medication.

Several months ago AccendoWave released an alternative solution that does not require medication and is personalized to each patient. The system was released in June 2015, says Martha Lawrence, AccendoWave’s founder and CEO, and has since been tested at several facilities. The company has spent seven years researching its solution for assessing patient discomfort levels, and is now using a headband that measures electroencephalography (EEG) activity and prompts a tablet PC to provide content aimed at reducing that discomfort.

The AccendoWave headband, which has seven EEG sensor leads built into it, transmits its brain-wave measurements to the tablet via a Bluetooth connection. The tablet, a Samsung Tab 4, uses its built-in AccendoWave software to process patient brain-wave data and then display diversionary content, including games, music, video clips and full-length movies. If, as a patient views a specific piece of content, the brain waves change to indicate increasing comfort, that content remains on the screen. If the content does not appear to have a positive effect on the brain waves, the software continues to select other content until it displays something appealing to the patient.

Pretty interesting approach. The article does note that they don’t use the brainwave data to determine how much medication to administer. They just use it as a way to assess the system’s effectiveness. They also do patient surveys to assess the impact of the device on a patient’s comfort. The article says that since the hospital implemented the system in the hospital, “1,600 patients have used the device to date, and more than 450 have completed surveys…More than 90 percent of responders reported viewing the system in a positive light.”

I’ve seen these EEG sensors for a while and they’re pretty neat. However, I always wondered how they’d actually be implemented and how they could be used to benefit patient care. No doubt it’s still early in their efforts to use and assess brainwaves, but it’s a pretty interesting solution to tie brain wave activity to soothing images. I’ll be watching to see how this evolves.

Future of Mobile Devices Infographic

Posted on November 18, 2015 I Written By

John Lynn is the Founder of the HealthcareScene.com blog network which currently consists of 10 blogs containing over 8000 articles with John having written over 4000 of the articles himself. These EMR and Healthcare IT related articles have been viewed over 16 million times. John also manages Healthcare IT Central and Healthcare IT Today, the leading career Health IT job board and blog. John is co-founder of InfluentialNetworks.com and Physia.com. John is highly involved in social media, and in addition to his blogs can also be found on Twitter: @techguy and @ehrandhit and LinkedIn.

The explosion of mobile devices and other connected devices is really quite astounding. It’s the start of what people call the IoT and it’s going to change everything including health care. You can see that in this Mobile Future infographic below. The thing that stood out to me was that 44ZB of data will be exchanged between connected devices by 2020. For those not familiar with ZB, that’s 1 trillion Gigabytes! Wow! Now that’s big data.

A Look at the Mobile Health Future Infographic