Connected medical devices have been around, in various capacities, for the last several decades. However, the current advancements in technology, coupled with Internet of Things (IoT) innovation, has officially and effectively redefined the impact and reliance on these devices throughout the healthcare industry. Seen as an emerging technology and enabler of healthcare, IoT devices have gained significant momentum in medical facilities of every size and across every specialty.
The Importance of IT Security with Medical Devices
New Technologies Could Compromise Network Security for Connected Medical Devices
Unfortunately, cybersecurity efforts focused on the emerging IoT market are still in their infancy. As these connected medical devices continue to flood the healthcare environment manufacturers are focused on delivering products that increase data capture and analysis to enhance courses of treatment and improve the patient experience throughout the care continuum. Perhaps not surprisingly, few IoT devices have been designed with a focus on maintaining the network security and protecting patients’ privacy and sensitive information.
Standardized Cybersecurity Protocol Proves Mission-Critical in the Healthcare Industry
The potential of increased risk from cyber threats and resulting unauthorized data access, data loss or loss of availability in connected medical devices has healthcare executives focused on increasing network security efforts across their organizations. However, these IT professionals aren’t just tasked with maintaining security on the equipment that’s already connected to their networks; they must also have a multi-faceted plan to manage cybersecurity on the new devices continuously making their way into their infrastructure and on to their networks. Healthcare IT professionals must develop a set of standardized and repeatable protocols that drive patient protection and safeguard each user’s medical and personal data. Some considerations include:
Develop a Comprehensive Device Inventory
One of the major challenges healthcare IT departments face with medical device security is not having big-picture intelligence on the total number of devices and types of devices in use throughout their network. Developing a comprehensive catalog of all connected machines, equipment, and devices is critical when creating a security plan to protect these assets. In addition to cataloging current inventory, healthcare IT professionals should also implement a best practice that outlines how to evaluate, add, track, and monitor new products that are being continuously introduced into the network.
Create a Secure Ecosystem
Most healthcare organizations assume that rigorous security testing of a connected medical device is enough to maintain heightened cybersecurity measures. Not true. While evaluating the security levels of a specific product is an important step, it’s also vital to develop a secure ecosystem to further mitigate risk and vulnerability. IT resources within a medical facility should leverage industry-specific standards and recognized best practices to establish and support a secure network infrastructure.
Identify Product Security Before Procurement
Many manufacturers aren’t prioritizing the inclusion of security during production of their IoT devices. However, numerous efforts are underway and are gaining momentum throughout the healthcare industry, as some manufacturers adapt their development efforts to more fully consider cybersecurity. It is very important to ensure that IT and security are involved in the procurement process of these devices. Performing a risk assessment of the technology and understanding the protocols and practices of the manufacturer are key in identifying if the risk profile of the device is acceptable and/or whether additional controls can be put in place to secure the technology before making a final purchasing decision.
Consider Independent Testing
The healthcare industry is struggling with resource shortages across every department, including its IT group. Many healthcare organizations don’t have the resources needed to consistently maintain a proper cybersecurity program. As a result, many healthcare administrators are outsourcing their network security needs to an independent industry expert. An outsourced team has access to top-tier cybersecurity professionals as well as the innovation needed to accelerate and sustain network security.
Leveraging the power of third-party testing and security certification of IoT devices can help reduce cyber threats as well as identify key business assets and outline workflows for process improvement. Most importantly, independent testing demonstrates a provider’s commitment to protecting patient data at all times and helping a medical facility set itself apart from the competition.
