Digital health: managing cybersecurity risks

The internet of medical things (IoMT) - the collection of medical devices and applications that connect to healthcare information technology systems through online computer networks - is greatly expanding with the growth of digital health devices. Digital health devices can bring many benefits such as remote patient monitoring, increased patient accessibility, improved patient experiences and outcomes, improved accuracy, easier logistics and reduced healthcare cost, but they also bring an increased risk to patient safety due to cybersecurity threats and medical device hacking (also known as medjacking).

When developing a new digital health device, as well as maintaining an existing device, securing the device from cybersecurity attacks is critical. There is rapid growth of cyber threats - unauthorised access, thefts of sensitive data, corruption of data, disruption of medical care, all of which could impact the safety of patients and device users. For example, as far back as 2017, the FDA alerted the radio-frequency-enable device manufacturer, St. Jude Medical, of a flaw in their devices that attackers could exploit to send malicious programming commands that could result in the draining of pacemakers�� batteries, local device memory storage issues, unauthorised modification of patients�� heartbeats, or the administration of inappropriate electric shocks. In 2023, the Cybersecurity and Infrastructure Security Agency warned Medtronic that their intracardiac devices also have security flaws within their wireless communication protocols which could result in a cybercriminal stealing, deleting, or modifying device data.¹ A few of the most vulnerable devices are infusion and insulin pumps, wearables, MRI systems, smart pens, implantable cardiac devices, wireless vital monitors, smart thermometers and temperature sensors.²

Both the European Union (EU) Medical Device Regulation (MDR) and the United States Food and Drug Administration (FDA) recognise the importance of cybersecurity and emphasize risk management to ensure device user/patient safety and data integrity. Proactive and ongoing security risk assessment and vulnerability management are expected to be performed by manufacturers as well as incorporating secure software development practices and incident response plans. It is critical to perform pre-market cybersecurity risk management and post-market cybersecurity risk management.

Managing cybersecurity risks in medical devices, both pre- and post-market, can be described via three key pillars:

Security Risk Assessment
Security Architecture
Security Testing

Security Risk Assessment consists of the assessment of the cybersecurity risks of the digital health device. The assessment is to be done during initial design and continually re-assessed throughout the lifetime of the device as the threat landscape will be continually evolving. Security Risk Assessment involves threat modelling and cybersecurity risk assessment both pre and post market. It looks at the exploitability of risks and vulnerabilities, including those related to third-party software and interoperability, across the total product life cycle.

The next pillar, Security Architecture, consists of the design and implementation of appropriate controls to mitigate risks identified from the Security Risk Assessment. It involves developing security architecture views and incorporating a set of risk controls related to authentication, authorisation, cryptography, integrity of code/ data/ execution, confidentiality, event detection/ logging, resiliency, recovery, updatability, patchability and others as applicable.

The final pillar is Security Testing to demonstrate the effectiveness of the risk controls incorporated within the Security Architecture. Testing of cybersecurity controls goes beyond standard software verification and validation with the addition of vulnerability and penetration testing.

It is also very important that in clinical investigations, as well as throughout the lifetime of the Software as a Medical Device (SaMD), cybersecurity incident response plans and remediation processes need to be in place to effectively manage any cybersecurity incident. The plans and processes need to include timely communication with affected parties, containment of the incident, and implementation of appropriate remediation measures to prevent future occurrences.

91�� has worked with many clients to identify and address critical gaps within risk management processes and documentation. If you need assistance with establishing a Security Risk Management program for your device that aligns with the three key pillars identified by the FDA, 91�� can help.

Contact us to learn more about how we can support your digital health device cybersecurity risk management needs.

References:

¹ https://hitconsultant.net/2024/07/12/cybersecurity-vulnerabilities-in-implantable-medical-devices/

² ; https://www.globalsign.com/en/blog/medical-devices-hackers-target

91��

In this section

Connect with us

91����