The Leading Business Education Network for Doctors, Financial Advisors and Health Industry Consultants

By Staff Reporters

***

***

INFORMATION TECHNOLOGY CONSIDERATIONS FOR MEDICAL DEVICES

In 2013, the Food and Drug Administration (FDA) issued its first cybersecurity safety communication, followed in 2014 by final guidance. It struck a reasonable balance between new regulations (almost none) and guidance (in the form of non-binding recommendations).

In 2015, the Federal Trade Commission (FTC) released a staff report entitled Internet of Things: Privacy & Security in a Connected World, in which it recommend that Internet of Things (IoT) style devices, which of course include medical and clinical devices, need to maintain a good security posture. It’s worth noting that the FDA, FTC, and other government regulators are centering on a few key guidelines. The following recommendations come directly from the FTC report.

Companies should build security into their devices at the outset, rather than as an afterthought. As part of the security by design process, companies should consider:

• Conducting a privacy or security risk assessment
• Minimizing the data they collect and retain
• Testing their security measures before launching their products
• Companies should train all employees about good security, and ensure that security issues are addressed at the appropriate level of responsibility within the organization
• Companies should retain service providers that are capable of maintaining reasonable security and provide reasonable oversight for these service providers.
• When companies identify significant risks within their systems, they should implement a defense-in-depth approach, in which they consider implementing security measures at several levels.
• Companies should consider implementing reasonable access control measures to limit the ability of an unauthorized person to access a consumer’s device, data, or even the consumer’s network.
• Companies should continue to monitor products throughout the life cycle and, to the extent feasible, patch known vulnerabilities

According to colleague Shahid N. Shah MS, the FTC report and FDA guidelines are remarkably consistent. When thinking of cybersecurity and data privacy, engineers tend to think about authentication, authorization, and encryption. Those are the relatively easy topics. For safety-critical devices, however, things are much more difficult and need to encompass a larger surface of questions, including but not limited to:

• Asset Inventory: Is the device discoverable, and can it associate itself with standard IT inventory systems so that revision management, software updates, and monitoring can be automated?
• Cyber Insurance: Does the device have enough security documentation to allow it to be insured by standard cyber insurance riders?
• Patching: How is the firmware, operating system (OS), or application going to be patched by IT staff within hospitals (or the home for remote devices)?
• Internal Threats: Has the device been designed to circumvent insider (hospital staff, network participants, etc.) threats?
• External Threats: Has the device been designed to lock down the device from external threats?
• Embedded OS Security: Is the device sufficiently hardened at the operating system level, such that no extraneous software components, which increase the attack surface, are present?
• Firmware and Hardware Security: Are the firmware and hardware components sourced from reputable suppliers and free of state-sponsored spying?
• Application Security: Is the Microsoft Security Development Lifecycle (SDL) or similar software security assurance process integrated into the engineering process?
• Network Security: Have all network protocols not in use by the device been turned off so that they are not broadcasting?
• Data Privacy: What data segmentation, logging, and auditing is being done to ensure appropriate data privacy?
• HIPAA Compliance: Have proper steps been followed to ensure Health Insurance Portability and Accountability Act (HIPAA) compliance?
• FISMA Compliance: If you’re selling to the federal government, have proper steps, such as use of Federal Information Processing Standard (FIPS) certified encryption, been followed to ensure Federal Information Security Management Act (FISMA) compliance?
• Data Loss Prevention (DLP): Is there monitoring in place to ensure data leakage outside of the device doesn’t occur?
• Vulnerabilities: Have common vulnerabilities such as the Open Web Application Security Project (OWASP) Top 10 been reviewed?
• Data Sharing: Are proper data sharing agreements in place to allow sharing of data across devices and networks?
• Password Management: Are passwords hardcoded into the device or made configurable?
• Configuration Protection: Are configuration files properly check-summed and protected against malicious changes?

ASSESSMENT

It is vital to perform a security assessment on a healthcare practice to understand the environment, identify risks and perform risk mitigation. A one-time security assessment with risk mitigation is not sufficient in 2025. This is a continuous process that needs to be performed religiously to maintain a secure and compliant practice.

COMMENTS APPRECIATED

Refer, Like and Subscribe

***

***

Filed under: "Ask-an-Advisor", Experts Invited, Funding Basics, Glossary Terms, Health Law & Policy, Information Technology, Insurance Matters, Research & Development | Tagged: AI, asset inventory, cyber insurance, Cyber Security, cybersecurity, data, data privacy, DLP, FDA, FIDMA, FIPS, firmware, FISMA, FTC, Health Information and Management Systems Society, HIPAA, HIT, Information Technology, internal threats, IoT, IT, Medical Devices, operating system, OS, OWASP, Password, password management, patching, risk mitigation, SDL, security, Shahid N. Shah MS, software, Technology | Leave a comment »