Digital healthcare’s twin challenges: Navigating device security and patient safety
As hospitals adopt the use of more connected devices, the risks multiply. Here’s how healthcare organizations can balance innovation with security.
The healthcare industry has embraced the operational and efficiency benefits of digital transformation and the adoption of connected healthcare devices to transform their business and improve patient care. In fact, the average hospital has from 10 to 15 connected medical devices per bed. Add to that things like communications, security and surveillance, access controls, HVAC, vending machines and personal devices.
It’s easy to see how IT and cyber-physical systems infrastructure can grow large and complex. As the number of connected devices increases, so do the potential security risks. Each new device added to the network expands the attack surface, introducing security vulnerabilities and creating new entry points for threat actors.
Unauthorized access to these devices can have severe consequences, compromising patient data, violating regulations and creating compliance issues, disrupting critical healthcare operations and endangering lives. Protecting these devices and maintaining a secure healthcare environment is crucial to ensuring patient safety and safeguarding sensitive patient data.
The landscape of connected devices
Some of the Internet of Medical Things innovations adopted already include wearable health trackers, remote monitoring systems, handheld touchpads, connected surgery equipment, robotic tools, and devices used to support therapeutics, recovery and rehab. These have all introduced new possibilities and advancements in patient care, improving patient outcomes and streamlining healthcare processes.
For example, modern patient monitoring devices enable healthcare providers to keep a close eye on patients' vital signs and health conditions, and be automatically updated if an issue arises. This enables early detection of potential issues and timely interventions, and can help hospital staff optimize their time.
Streamlined processes also have made medical procedures more efficient, with automated systems that facilitate quick access to patient records, seamless communication between healthcare professionals and faster decision-making.
Potential security risks and challenges
A recent study by the Journal of the American Medical Association (JAMA) Health Forum found that ransomware attacks on healthcare delivery organizations in the U.S. have doubled over the last five years, exposing the protected health information (PHI) of more than 41 million patients.
More troubling, research by the Ponemon Institute correlated a 22 percent increase in negative medical outcomes for patients in hospitals hit by ransomware. In fact, the problem is so severe that some healthcare organizations train staff in “code dark” responses to cyberattacks, during which they physically disconnect as many devices as possible from the network when an attack is detected.
The message to security professionals responsible for protecting their organizations’ data and IT estates is clear – connected medical devices, Internet of Things (IoT), operational technology and cyber-physical systems offer numerous benefits, but they come with serious challenges. Understanding those challenges and developing a strategy to address them is imperative.
What’s more, many of the challenges in healthcare are unique to the industry. For example, if the software in an Internet of Medical Things (IoMT) device becomes obsolete and unsupported, but that device is in service providing patient care, it may be vulnerable to attacks. Think of medical devices, which are often used for 10 to 15 years or more, compared with shorter service lives for traditional IT endpoints. This means that the operating systems on medical devices may reach end-of-life some 10 years before the device or equipment itself is retired.
Another challenge lies in the security features of the devices themselves. Some devices may lack robust built-in security measures or fail to receive frequent updates from manufacturers. The FDA also restricts making changes on medical devices, so even if a vulnerability is found, it can’t be quickly patched.
Medical devices in many health delivery environments operate on the same networks as non-medical devices and should be segmented to keep data flows separate. If systems are not adequately protected, these vulnerabilities can be exploited by malicious actors, leading to malware infections, ransomware attacks or unauthorized access to patient information.
The complexity of these networks and ease with which many devices connect to them makes it difficult to identify and manage all the devices and their corresponding connections. In our experience, we have found vending machines and Peloton fitness cycles connected to hospital networks without the knowledge of IT and security teams.
This lack of insight into what’s on your network – and what any specific connected device is doing while there – creates blind spots. Understanding these challenges is essential in developing effective security strategies to mitigate the risks associated with connected healthcare devices.
The importance of visibility
You can’t protect what you can’t see, so achieving visibility into the network to discover, classify and inventory devices in a hospital’s environment is a crucial aspect of maintaining comprehensive security in healthcare settings.
Healthcare delivery organizations need real-time insights into all connected devices across the whole hospital, including those that may operate outside the purview of the IT department. With visibility, teams can promptly detect unauthorized devices, unusual network behavior or suspicious activities that may indicate a security breach.
Much in the same way a physical security camera system installed throughout a building can provide continual visual surveillance of every key door, stairway, elevator or loading dock, healthcare organizations must have a similar level of whole-hospital visibility across their network. By analyzing network traffic and monitoring communication patterns, they can swiftly identify any deviations or anomalies that may indicate a security incident or discover that something unexpected is accessing the network and needs to be blocked.
Best practices for securing facilities
To establish a safe, strong and secure operating environment for a healthcare facility, there are several best practices that the IT team should follow.
Comprehensive device inventory. Healthcare facilities should maintain an up-to-date inventory of all connected devices across the whole hospital, including Internet of Things (IoT), Internet of Medical Things (IoMT), and operational technology devices. This comprehensive inventory provides visibility into the entire ecosystem, enabling effective monitoring and management. It helps organizations identify vulnerabilities or any unauthorized or unknown devices that may pose security risks and then take appropriate actions to update, segment or mitigate them.
Strong authentication and access controls. Healthcare facilities should enforce robust authentication protocols and access controls for connected devices. This ensures that only authorized individuals can interact with the devices, significantly reducing the risk of unauthorized access and data breaches. Strong mechanisms, such as multi-factor authentication and access controls that align with the principle of Zero Trust, should be used to maintain the integrity of the healthcare environment.
However, there is an exception to this. Medical and IoT devices do not perform the typical authentication using 802.1x or multi-factor authentication; they just simply connect into the network. These devices need a different mechanism based on procurement/CMDB records and other methods to verify the legitimacy of the device, by the respective owner of the device, before connecting into the enterprise network.
Software updates and vulnerability management. Connected devices in healthcare require regular attention in the form of software updates and vulnerability patches. Promptly applying these updates is crucial to address known vulnerabilities in the devices' software or firmware. Healthcare organizations should establish a robust process to ensure that all devices are kept up to date, and that actions are taken to identify and protect those that can no longer receive updates.
Network segmentation. Network segmentation can isolate critical healthcare systems from other devices and networks, and from each other, providing an extra line of defense in case of an attack or breach. If a breach occurs in one segment, it is less likely to spread to other critical systems, reducing the potential for disruptions and the impact on patient care.
Policy management. Security policies are developed and established for a reason – to protect a facility’s network and everything that relies upon it. With that in mind, it is important to set up automated systems that apply policies automatically to new devices that enter the environment or to unexpected devices that are discovered. That way, there aren’t holes in the security environment that persist while the team works down their to-do lists.
Educate and train staff. Employees require comprehensive cybersecurity training to protect devices and sensitive data. Training programs should raise awareness about potential threats, educate employees about best practices for device security and data protection, and establish a culture of cybersecurity awareness. Staff members should be familiar with the organization's security policies, understand their roles and be equipped to identify and report any suspicious activities promptly.
Risk assessments. Proactive measures such as conducting thorough assessments of a facility’s network infrastructure, and simulating attack scenarios can be invaluable in helping an IT team gauge the effectiveness of existing security controls. By regularly assessing the system's security posture, organizations can identify and address weaknesses before they are exploited by malicious actors.
Threat and network monitoring. Device security solutions equipped with intrusion detection and behavioral analysis capabilities should be employed to monitor network traffic, detect anomalies and identify potential threats in real-time. These solutions can provide valuable insights and facilitate swift responses to incidents. These advanced security solutions can act as vigilant guardians, continuously safeguarding the healthcare environment and minimizing the potential impact of cyber threats.
Despite the efficiencies and cost savings associated with connecting hospitals and healthcare facilities with the same network, the danger of attack or breach has been increased. Only by proactively taking steps to recognize potential risk points, establish whole-hospital visibility, and implement best practices for securing devices and facilities can potential threats be mitigated. A commitment to comprehensive security across the entire network ensures the continuity of high-quality care, while safeguarding patient well-being.
Pandian Gnanaprakasam is co-founder and CPO of Ordr.