Hospitals lack consistent cybersecurity plan for networked medical devices
Large hospital systems could have around 85,000 medical devices connected to its network, which translates into a broad attack surface, report warns.
Photo: Morsa Images/Getty Images
Even as hospitals continue to face cyberattacks that risk patient harm, Medicare lacks consistent oversight of networked device cybersecurity in hospitals, according to a report from the Department of Health and Human Services Office of Inspector General.
The report warned that CMS' survey protocol lacks guidance regarding requirements for networked device cybersecurity. It recommended HHS work with CMS to incorporate cybersecurity as part of its hospital quality oversight process.
WHY THIS MATTERS
Hospitals often do not include device cybersecurity in their emergency-preparedness risk assessments, nor do they – or does CMS – plan to update their survey protocol requirements to address networked devices or general cybersecurity.
"CMS told us that it is revising the Interpretive Guidelines for both the emergency preparedness CoP and the physical-environment CoP, but it said that its time frames have been delayed because of the COVID-19 pandemic," the report stated. "Although CMS does not plan to address cybersecurity of networked devices in this revision, we ask that it reconsider."
Networked medical devices can range from wearable health monitors to more complex web-connected systems that communicate with clinical laboratory analyzers such as laboratory information systems.
Large hospital systems could have around 85,000 medical devices connected to its network, which translates into a broad attack surface with multiple points of entry for hackers to potentially exploit.
"Although they are distinct from hospitals' electronic health record systems, these devices may connect to the same network as a hospital's EHR system, and thus can be connected to the EHR system as well as to other devices on the same network," the OIG warned. "As a result, networked devices that lack proper cybersecurity may have vulnerabilities that could lead to adverse outcomes."
Safeguards for connected medical devices could include plans for managing software updates and patching on devices themselves as well as approaches such as network segmentation. All these methods could fit within hospitals' broader cybersecurity frameworks.
The report recommended the CMS instruct surveyors to ask hospitals if they considered the cybersecurity of networked devices when they conducted their hazard-vulnerability analyses, as has previously been encouraged.
THE LARGER TREND
The findings come at a time when hospitals are seeing a major spike in cyberattacks, including a September 2020 attack on Universal Health Services, which operates about 400 facilities. That attack resulted in an outage of health information technology over multiple days.
One month later, HHS and the FBI warned of increased and imminent ransomware attacks on hospitals. Soon after, researchers observed a nearly 50% spike in attacks against healthcare organizations.
The first known ransomware attack to affect networked medical devices occurred in 2017, when the WannaCry ransomware attack impacted radiological devices in some hospitals.
The cost of a healthcare breach is about $408 per patient record, and that doesn't include the loss of business, productivity and reputation, a health security expert said in 2019.
The OIG also recommends hospitals follow guidance developed by organizations such as the National Institute of Standards and Technology, a non-regulatory agency of the Department of Commerce, or the Health Information Trust Alliance (HITRUST), a private company, to ensure they meet minimum cybersecurity requirements.
The Food and Drug Administration, which regulates medical devices throughout their entire product life cycles, from premarket approval to post-market availability and use, considers cybersecurity for networked medical devices to be a shared responsibility between device manufacturers and healthcare providers.
ON THE RECORD
"It is more important than ever that hospitals have a plan for securing their networked devices – which can number in the tens of thousands in a large organization – before those devices are compromised in a cyberattack," the report concluded.
Twitter: @dropdeaded209
Email the writer: nathaneddy@gmail.com
