Cybersecurity in Medical Devices: Paranoia, or a Tangible Threat?

In October 2014, the United States Department of Homeland Security investigated two dozen suspected cases of cyberthreat in hospital equipment and medical devices, bringing healthcare giants such as Medtronic Inc., Hospira Inc., and St Jude Medical Inc. under the scanner. The potential flaws revealed by officials could prove to be lethal if the medical devices industry doesn’t pull up its socks and improve software security. 

In October 2014, the United States Department of Homeland Security investigated two dozen suspected cases of cyberthreat in hospital equipment and medical devices, bringing healthcare giants such as Medtronic Inc., Hospira Inc., and St Jude Medical Inc. under the scanner. The potential flaws revealed by officials could prove to be lethal if the medical devices industry doesn’t pull up its socks and improve software security. 

Earlier, in April 2014, THOTCON 0x5-2014, held in Chicago, was an eye-opener not just for those who attended the annual hacking conference but for the global healthcare and medical devices industry. Scott Erven, head of information security at Minnesota, U.S.-based Essentia Health stunned the audience by showing them how easy it was to hack into hospital equipment. Right from sending shocks to a patient’s heart by manipulating Bluetooth-enabled defibrillators to altering medical records causing doctors to misdiagnose – Erven proved that just about anything was possible in the absence of a cyber-secure hospital setting.

These two incidents not only garnered much publicity, but also set the alarm bells ringing for the medical devices industry that’s rapidly embracing interconnectivity. On one hand, the introduction of wireless, network-connected devices has revolutionized healthcare in ways no one would have dreamed possible. Yet, the electronic transformation of the medical industry has brought with it a frightening level of vulnerability. The vast database of patient information, and crucial and private details such as residential address, social security number, and bank details is open for hackers to manipulate.

When the US Food and Drug Administrationin October 2014 released a nine-page document of guidelines on how to manage the risk of cybersecurity in medical devices, many believed that the step was too little too late. The FDA guidelines state that medical device manufacturers seeking approval for a new device should detail the potential cyberthreats it has considered, detected, and tackled. Coming at a time when even iconic media houses such as Sony Pictures Entertainment Inc. are hacked into, the set of FDA norms is a good place to start.

However, the danger of hacking into hospital equipment is a problem that needs to be tackled right at the prototype and design stage. Countermeasures can be expensive and time-consuming. More importantly, they can change very little of any damage that may have been done. The basic flaw, as pointed out by Chris Peterson, co-founder of an independent security intelligence company based out of Colorado, is that healthcare providers have so far been focusing on fighting adversaries attacking from the outside rather than strengthening internal security.

Healthcare Providers at Loggerheads

Like any other matter concerning thegeneral public and implementation of norms and regulations, there’ll always be forces swimming against the current. There’s a whole set of people within the healthcare and medical devices industry who feel that the issue of cybersecurity – while not premature – is being taken a little too seriously. These individuals or group of healthcare providers have been less than enthusiastic about the FDA initiative regarding cybersecurity, stating that there have not yet been any “obvious” implications on national security.

A 2012 episode of the television series Homeland shows the vice president of the United States being killed by a terrorist who hacked into his pacemaker; how plausible is this exactly? The argument here is:So far, there’s been no actual and active incidence or threat against medical devices to justify the hype surrounding cybersecurity in the medical devices domain.

Secure Access to Medical Devices – Is It Feasible?

Another point that medical device manufacturers and users put forth is the issue of limited access to devices and authentication of users.While the idea of protecting a medical device by restricting access only to trusted users and using some sort of identification or password is warranted, what happens in a case of emergency? These security controls hinder the use of the devices in situations where a patient may need immediate intervention.

So the question still remains: Is mandatory cybersecurity in the medical devices industry viable? Have we reached a stage where we will live in constant fear of a cyberattack? Or has the FDA jumped the gun?

cybersecurity / shutterstock