The healthcare industry has been a popular target for cybercriminals for a long time. In fact, healthcare became the most targeted industry in 2021. Frighteningly, it’s more than patient data that’s being put on the line. There’s a growing concern about cybersecurity for medical devices and what that means for patient safety.
This concern has caught the attention of the Food and Drug Administration (FDA). Starting in October 2023, the FDA will start rejecting premarket submissions for medical devices if they don’t meet cybersecurity requirements.
Understanding cybersecurity in medical devices is crucial for medical device companies and manufacturers. This is not only for patient health and safety, but also for getting your devices approved for future use in the market.
Which Medical Devices Have Cybersecurity Risks (and Why)?
You need strong cybersecurity for any networked medical devices. That’s because hackers can exploit their network connections to compromise the device. Here are some specific examples of medical devices with cybersecurity concerns.
Insulin Pumps
Many insulin pumps are connected to glucose monitors or smartphone apps. Hackers can intercept this connection and render it non-functional with a DDoS attack.
Pacemakers
Pacemakers often utilize wireless connections for remote monitoring. If a hacker intercepts this connection, they can gain control of its settings and cause heart rate abnormalities.
Cardiac Defibrillators
Like pacemakers, cardiac defibrillators also utilize connections for remote monitoring. Hackers can also manipulate its settings and modify the timing and intensity of electrical shocks delivered.
Hearing Aids
Modern hearing aids have Bluetooth capabilities. This makes it easier for people with hearing loss to listen to phone calls and stream audio. The problem is that cybercriminals can inject malware into a hearing aid through this Bluetooth connection. This is usually spyware that could record personal details spoken out loud.
Oximeters
Some oximeters can automatically transmit data to centralized EHR systems. This gives practitioners real-time updates on the patient’s health. Attackers can intercept this transmission and put inaccurate readings on file.
Infusion Pumps
Infusion pumps are connected to internal hospital networks for remote monitoring and configuration. Attackers can infiltrate this network to manipulate dosages or collect patient information from these devices.
Diagnostic Imaging Equipment
Diagnostic imaging equipment is also connected to internal hospital networks. This is generally to facilitate data sharing among healthcare providers. Cybercriminals may deploy ransomware to encrypt diagnostic images and demand payment for their release.
Just How Connected Are Medical Devices?
A study in Germany showed how connected modern medical devices are. The following graph showcases their findings. It highlights that the larger a hospital is, the more connected devices are present. Therefore, it’s reasonable to estimate that larger centers are at a higher risk of cyber breaches.
Source: BMC
How Are Medical Devices Involved in Data Breaches?
The FDA’s concern over cybersecurity and medical devices is primarily driven by potential danger to patient safety. However, hackers are more likely to use medical devices as an entry point into the internal network of a medical facility.
For example, if an insulin pump is connected to a smartphone app and a hospital monitoring system, a hacker can access the pump through the app and the hospital network through the pump. This situation is the most common scenario among compromised devices.
Why Are Hackers Targeting Medical Devices?
Medical devices are usually targeted for a ransomware attack or as an entry point into a facility’s network. Some devices have life-threatening implications which makes people more willing to pay ransom.
Medical devices that are always on a person are also valuable for spyware because they can track everywhere the person wearing the device goes.
| Learn More About Other Medical Device Safety Standards |
How Can We Protect Medical Devices From Cyber Attacks?
The most important question from all of this is, what can we do to protect patients? Going forward, the FDA will require stronger built-in cybersecurity measures, but what can healthcare organizations do in the meantime?
1. Monitor Deployed Devices
Remote monitoring is the reason why many devices are connected to a network in the first place. Train your staff to watch for potential cyber threats alongside possible medical incidents.
2. Increase Network Security Measures
Medical device companies should design devices with network security in mind. For example, incorporating features like data encryption and multi-factor authentication (MFA) into any networked device.
3. Draft Guidance Documents For Staff
One of the top reasons why hackers target health care is lack of staff awareness. Less cyber awareness makes it easier for them to break in. Create cybersecurity protocols for staff like you would for any other safety measure.
4. Boost Testing Standards
It may not be required until October 2023, but medical device companies and manufacturers should incorporate cybersecurity testing into their quality assurance process now. This will get you prepared for the incoming requirements and only make your devices safer.
5. Plan For The Worst-Case Scenario
Prevention should be your top priority, but you should also be prepared to respond to a security breach. Plan risk mitigation and incident response strategies as soon as you can. This way, you’ll know what to do if a cyber attack occurs.
Choose a Development Partner That Makes Cybersecurity For Medical Devices a Priority
Emerging cybersecurity threats can be overwhelming for medical device companies and healthcare providers who aren’t trained tech experts. Yet, cybersecurity could be a life-threatening issue if a critical device is compromised.
RBC Medical Innovations has 25 years of experience working with medical device companies, from OEMs to startups, to deliver safe medical devices. We’ve watched many developments in technology over the years and are well-equipped to adapt to incoming changes.
RBC is rapidly developing medical solutions to ensure products are compliant with the changing cybersecurity guidelines and scrutiny by FDA latest draft guidance related to cybersecurity in 2022. Our Advantage Platforms™ provide a starting point for products in their cybersecurity compliance efforts with previously completed threat modeling, security architectures, third party software components, implantation of security controls, and cybersecurity testing. Although each product will require their own custom cybersecurity compliance plan, the platform advantage allows customers a de-risked foundation compared to from scratch designs
Contact us to learn more.
