Connected medical devices such as ultrasound and other medical imaging devices make up as much as 74 percent[i] of the devices connected to a hospital’s network. With the number of cyberattacks in the healthcare industry on the rise[ii], ensuring that all devices within a network are secure from cyber threats is an important step in protecting patient health information (PHI) and hospital networks. Adding to the problem, recent data shows that the global healthcare sector has been subjected to an array of new cyberattacks as it deals with the COVID-19 pandemic[iii].
A Valued Workhorse in Ultrasound
By providing real-time visualization, the value of ultrasound as a powerful diagnostic tool is undeniable. It is used frequently to advance the overall quality of traditional physical exams across many clinical areas, and is often utilized for musculoskeletal, cardiac, liver and breast exams. It has also been utilized most recently to assist clinicians with COVID-19 diagnoses. In urgent situations and often over-crowded hospitals, lung ultrasound has been employed as an alternative imaging method with emerging evidence that supports its ability to identify characteristic lesions seen in COVID-19 that are highly consistent with CT imaging, without many of the downsides.[iv] Ultrasound systems can easily be disinfected between patients and increased patient throughput may be achieved. Unfortunately, and despite the clinical advantages, many ultrasound systems may be operating on outdated operating systems and may not be as secure as other devices within a hospital or system, which could make them a target for cyber threat actors.
Designing Cyber Defense for Portable Ultrasound Systems
With the total cost of healthcare breaches in 2019 hovering at $4.0 billion[v], no connected medical device should be left unprotected. To protect ultrasound devices, developing a multi-layered cybersecurity approach secures patient data and health information at the device level and continues on to protect the information as the device communicates with the hospital network, therefore also at the network level. Referred to as defense-in-depth, this type of strategy works using layers, where each layer enhances the overall security of the system. Ideally, the strategy should be customizable to the facility or hospital system’s cybersecurity needs. The security layers should originate with the security on the device itself and its operating software, and move to communications on the network, ending with a seamless integration into the facility’s cybersecurity ecosystem.
Local and Remote Cybersecurity Controls
On the unit itself, personal health information (PHI) should be encrypted in the event of a stolen device or hard drive, and patient data should be permanently removed from the device once it is deleted. Wired and wireless communications from the ultrasound system should also be encrypted as the device transmits patient data and images to the facility’s picture archiving and communications systems (PACS) system and/or electronic health record (EHR) platform.
Additional security controls should be configurable to detail who can access each ultrasound device This can range from clinicians directly using the equipment to experts who may perform remote servicing. There should be considerable flexibility at this level to set specific user roles that dictate permissions to access or manipulate patient data. Managing user accounts, as well as password policies and access restrictions, should be determined at this level in the cybersecurity fortification process.
Optimized Ultrasound Operating System
Most ultrasound devices use a Microsoft Windows® operating system (OS). Compared to older OS versions, recent versions and a specialized version created for the Internet of Medical Things (IoMT), such as Windows® 10 IoT, can be more secure due to contemporary and unique capabilities created for devices embedded within a larger network. Newer features include “hardening”, which allows the manufacturer to restrict the services that Windows® 10 provides to only those that are necessary to operate the ultrasound machine.
Safe Listing is a malware protection feature that only permits trusted applications to run. An optimized operating system should also include a mode that disables the user’s access to the internet and the Windows® desktop, which are common malware vectors for spreading viruses through email services, web browsers and other unsecure applications.
Network Firewall Protection
Every malicious cyberattack requires a point of entry. Fortifying at the firewall layer and blocking unused communication channels reduces any potential points of entry. All unused ports on a system should be disabled, and information being transferred to the imaging network within the hospital or health system should be limited, only able to connect to specific predefined devices, such as PACS or an EHR platform.
Portable, Safe and Secure Ultrasound
Keeping ultrasound machines safe and functional in the face of cyber threats will protect patient data and health information without disturbing daily clinical workflows. Data breaches in healthcare are rising, and so are the resulting financial burdens, amounting to nearly $4.0 million per breach[vi], and $408 per stolen patient record. As reliance on medical imaging devices like ultrasound increases, it behooves hospital and radiology administrators to reexamine and enhance cybersecurity measures for these devices.
References:
[i] https://www.armis.com/resources/analyst-reports/the-forrester-new-wave-connected-medical-device-security-q2-2020/?utm_medium=cpc&utm_source=google&utm_content=&utm_term=%2Bcybersecurity%20%2Bmedical%20%2Bdevices_b&utm_campaign=GS_NAM_Healthcare_BMM&gclid=CjwKCAjw5Kv7BRBSEiwAXGDElZ5XxTRh73ZKh_vw6I4bxC4WIxaBFcNPkHLM6Vr4rhPNwURIy2NgZxoCE1AQAvD_BwE
[ii] https://www.ibm.com/security/digital-assets/cost-data-breach-report/#/
[iii] https://www.biospace.com/article/pandemic-creates-opportunities-for-cyberattacks-on-healthcare-groups-report-shows/#:~:text=Cyberattacks%20on%20Health%20Care%20Groups%20Increase%20During%20COVID%2D19%20Pandemic,-Published%3A%20Apr%2020&text=Over%20the%20weekend%2C%20data%20analytics,with%20the%20COVID%2D19%20pandemic.
[iv] Fiala MJ. Ultrasound in COVID-19: a timeline of ultrasound findings in relation to CT. Clin Radiol. 2020;75(7):553-554. doi:10.1016/j.crad.2020.04.003
[v] https://www.healthcarefinancenews.com/news/healthcare-data-breaches-will-cost-industry-4-billion-years-end-and-2020-poised-to-be-worse
[vi] https://www.healthcare-informatics.com/news-item/cybersecurity/healthcare-data-breach-costs-remaining--highest-408-record/
