Cloud-connected devices need a fresh scan for security issues
Medical devices increasingly represent a weakness in security for most healthcare organizations, which typically use hundreds of diverse devices from dozens of manufacturers.
Equipment ranging from infusion pumps to hospital beds to Bluetooth-enabled devices can be 10 or more years old, working on old, vulnerable operating or application systems, and they’re often in close proximity to patients and essential in providing life-saving treatment.
Because an increasing number of these devices are connected to the cloud, it’s time to take a structured approach to ensuring that security risks are managed closely, said James L. Angle, an information security architect at Trinity Health, a Livonia, Michigan-based Catholic healthcare system.
Angle detailed the growing risk of cloud-linked devices’ security risks, as well as an approach for tightening up defenses based on their proximity to patients during his recent HIMSS20 Digital presentation, Managing the Risk for Medical Devices Connected to the Cloud.
Mitigating device security risks should begin before they’re purchased, Angle said. He outlined five “degrees of separation” medical devices can have from patients, and security professionals’ strategy for strengthening security varies among the different categories. They are:
1: Devices that touch the patient, such as a blood-gas monitor in an ICU
2: Devices that don’t touch the patient, but take vital measurements, such as a blood pressure monitor
3: Devices that don’t touch the patient, but still provide data vital to proper patient diagnosis
4: Devices that are separate and are more of an operational tool vs. one that’s diagnostic or clinical
Before any devices are purchased, security professionals need to be involved, collecting documents such as the manufacturer’s disclosure statement on medical device security, augmenting those formal statements with additional security questions, Angle said. Based on that information, it’s crucial to conduct a risk assessment and threat assessment.
“Pay special attention to [security] controls that the manufacturers say are in place,” Angle noted. “Look at all the related software, both for the device’s operating system and application system. Some of these devices have database software connected to it. Identify all the connections for the data; know where the data is being processed and where the patient data is being stored – in multiple devices on site, network storage media or in the cloud. Each one of those has different security requirements.”
Various organizations provide a technical framework outlining security postures for devices that handle health information – these include the National Institute of Standards Technology, HITRUST and the International Organization for Standardization.
