Last June, the Food and Drug Administration (FDA) released a guidance on the "content of premarket submissions for management of cybersecurity in medical devices." This guidance suggested that device makers incorporate security features into their products to limit access to only trusted users, determine trusted content, and use fail-safe and recovery devices. FDA called on the manufacturers to consider threats such as hacking, malware and other vulnerabilities of device software and to work with providers on use cases.
"The cybersecurity guidance has definitely gotten the attention of some of the manufacturers," said Russell Jones, a report author and a partner in Deloitte's life sciences and healthcare division, in an interview. "The FDA has made it clear, with the guidance and the additional communications they've published, that this is an area of importance."
However, he told InformationWeek Healthcare, many device makers are still not ready to include these security features in their purchasing agreements with healthcare providers. Although providers and manufacturers have begun collaborating on this issue, he said, they have a long way to go.
[ Are apps the answer to doctors' hectic schedules? Read Healthcare Apps Could Be Doctor's Best Friend. ]
Also, the Deloitte report noted, healthcare organizations have had difficulty in developing risk-mitigation strategies for devices that are more than five years old and run on proprietary operating systems. "These legacy devices are difficult to test for vulnerabilities because off-the-shelf security scanning tools do not exist," the paper said. In cases where hospitals lack spare devices of the same kind, these products can't even be taken offline for testing, Jones added.
Other devices that run on "well known commercial operating systems" have the same vulnerabilities as other types of systems connected to a network, the report said.
For both these and the legacy devices, the most extreme risk mitigation method is to quarantine the medical devices from the rest of the hospital IT system. But, partly because of the complexity of running multiple systems that aren't networked, Deloitte suggested that organizations do this only where it's appropriate.
"We recommend that organizations consider quarantining, and if it doesn't make sense, fall back to other types of controls, such as detection controls and sim systems," Jone said. "That may be the best you can do to see whether there has been activity that suggests hacking or unauthorized access to medical devices."