When it comes to public health and saving a patient’s life, tampering with digital devices is simply unacceptable. Cybersecurity for healthcare facilities is subject to extremely stringent standards and protocols. The very nature of the work these systems and software deal with makes them critical to a hospital’s success.
In a world where smart hospitals are becoming more and more connected, advances in technology are pushing the limits of what medical devices can do. When government protocols begin falling behind real-world scenarios, hospital administrators find themselves with large shoes to fill.
“The benefits brought to a wide range of industries by the IoT are not in doubt,” is the general consensus researchers have come to, according to a 2019 report. “However, greater connectivity opens organizations and their customers up to a myriad of additional vulnerabilities that must be considered from the outset.”
Although no system will ever be foolproof, (and thinking so is simply being naïve), there are steps that every hospital administrator, IoT engineer, and software developer must keep in mind when creating, deploying, and monitoring healthcare applications.
Assessing Medical Devices Before Purchasing
When the latest in medical equipment is announced, it can be easy for hospital administrators to get swept up in the benefits marketing sells them on. They may sometimes forget to consult chief information security officers when making purchasing decisions, or only include them in the final stages of discussion.
It is always in the best interest of healthcare providers to take the time to properly assess a new potential medical device before making a purchase decision. All departments involved should be consulted. Apart from the medical professionals who will be using this equipment, a hospital’s IT department can assess if the device will be able to join the hospital’s existing IoT network and connect with other devices without compromising security. They can also see how adaptable the device’s software is, whether it will need firmware upgrades, how it can be connected to other tools, and much more.
In some cases, IT administrators may be able to see through the marketing promises made by a vendor and recommend a tool that will not compromise the integrity of the hospital’s cybersecurity network. They may also be able to recommend devices that provide the same level of quality from another vendor, but with enhanced security features. Sometimes, these alternatives may even cost less than the initial device.
When a device is properly assessed by all parties, risks to security can be minimized and the right technology investments can be made for a smart hospital.
Make Security a Part of the Design Lifecycle Process
There’s an unfortunate trend in IoT application development where security is treated as an afterthought by both developers and the organizations implementing digital healthcare tools. IoT cybersecurity cannot be treated like a final coat of paint. It must be part of the development process from the very beginning of the product development phase.
The stats are sobering. Only 49 percent of healthcare organizations make security part of the product design lifecycle process. 52 percent of them do not any form of mobile app protection. By neglecting the importance of cybersecurity for connected medical devices, smart hospitals leave themselves vulnerable to hacking attacks and create a digital infrastructure that will constantly be left with weak spots.
Over time, patching and repatching these spots becomes an expensive endeavor. These are capital expenses that can force a smart hospital to play catch-up instead of investing in new tools that improve patient care.
Ensure that IT administrators can take control of devices if necessary and that vendors take security concerns seriously. When a patient’s life in on the line, security cannot be considered an afterthought.
Establish Medical Device Deployment Standard Protocols
It can be easy to overlook the security aspects of a healthcare IoT project when deadlines are running tight and deployment is being fast-tracked. That’s why having an established medical device deployment protocol in place ahead of time is so important. By creating a set of rules that need to be followed during an IoT deployment, a smart hospital is able to get vendors, software developers, IT administrators, and engineers on the same page and assure that a level of quality is present at every phase.
These protocols prevent any one party from glossing over an important step that keeps the network secure. They also provide a reference guide for developers and engineers, so that they can assess whether the device will be able to join the hospital’s IoT network and adhere to its security standards.
Although some security protocols will be dictated by a government body, like the Health Insurance Portability and Accountability Act (HIPAA) in the United States, it is crucial that your IT department go even further. Government regulations are important, but they often fall short in the fast-moving realm of healthcare technology. Staying ahead of the curve will allow your smart hospital to better defend itself from cyberattacks.
Understand and Mitigate Healthcare Cybersecurity Risks
Only a fool believes that their system is impenetrable. Once this reality has been accepted, it’s time to start thinking realistically about what kind of risks your healthcare network is vulnerable to, which ones you can easily fend off, and how you can best protect your hospital.
When it comes to super hospitals and medical research facilities, it’s important to remember that you’re no longer just a convenient target for the average hacker looking to make a quick dollar through a ransomware attack. You must think bigger. Think coordinated hacking efforts with possible financing from foreign governments. These are more sophisticated attacks and the people engaging in them have more and more resources behind them.
With hospitals becoming more and more connected, cyberattacks have become a perfect opportunity for cyberterrorists to cripple an enemy nation’s digital infrastructure. Although a hospital network’s administrators may never be able to stop every attack, there are protocols they can follow to minimize the damage done and keep patients safe.
Keep critical parts of the network secure by ensuring that control over the network is always in the hands of the hospital’s IT department. With control over the network, IT administrators can configure the various devices connecting to the network without having to worry about endpoint security and ensure proper EPP systems are in place. They’ll also be able to purge unwanted devices or users from the network before they have a chance to infect crucial systems.
Establish and Push for Good Healthcare Cybersecurity Habits Amongst Personnel
When it comes to security, you’re only as strong as your weakest link. That’s why it’s so important to keep hospital staff and employees actively engaged in the cybersecurity process. When everybody does their part, security gaps become smaller, and so do the risks of an attack.
Establish a strong security culture amongst hospital staff and encourage best practices on a daily basis. Create workshops and onboarding courses that emphasize the importance of
patient data and being secure when working on a hospital’s network. Make sure that basic protocols and systems are in place, such as firewalls for any computer connected to the internet. Force hospital staff to switch their passwords at regular intervals via an automated system. Instill basic habits like locking a computer before walking away from it.
If doctors or nurses decide to use their own personal mobile devices for work, ensure that they are encrypted or force them to use an encryption app provided by the hospital. The more devices that are added to a hospital’s network, the more entry points a hacker can exploit. That means that any new devices being added to the network must have adequate security measures in place. Mobile devices and electronics should also have an override system installed. That way, access can be controlled, and data can be deleted by IT administrators if ever a device were to be stolen or lost.
Good cybersecurity begins with the user. When hospital staff are kept up-to-date and know the best practices, the risks of an attack or data breach decline significantly.
Although there’s no such thing as a foolproof healthcare network, there are steps that smart hospitals can take to limit the damage cyberattacks can cause while allowing medical professionals to do their jobs uninterrupted.
For more on IoT technology and how it helps smart hospitals stay agile and secure, explore the Schneider Electric Exchange community.
Keep the conversation going! Tune in to Schneider Electric’s new Podcast Series for Everyday Extraordinary Healthcare focusing on Resiliency. Start listening.
Visit, Share, Ask your questions and get expert answers in Exchange Solutions for Healthcare Forum!
Sources:
82% IoT Devices of Health Providers, Vendors Targeted by Cyberattacks
Top 3 Ways to Succeed with Healthcare IoT, Mobile Device Strategies
Why IoT Devices Are a Worthy Investment for Hospitals
