Trust me, I’m a medically trained device

On the morning of the 27^th of June 2017, Stanford Medicine and Duke University School, welcomed a few volunteers into their offices. Every participant had to sign a consent form before they could collect two devices that will monitor their biomedical stats for the next few years (heartbeat, activity, sleep pattern etc.). The project is a 4-year collaboration with Verily Life sciences, a subsidiary of Alphabet, where researchers want to develop a platform that combines the output from the wearable sensors of 10,000 participants, genomic data and other medical information.  Over time, they hope to predict diseases, identify new symptoms, and tailor treatment to individual patients. Leveraging the Google computing infrastructure and its Cloud Platform, which meets the required standards around data safety, privacy and security, the team is keen to minimize cyber risk. In the case of wearable technology, the cyber risk may be that patient data could become public or medical history could end up deleted or tampered with, disrupting treatment or years of work.

Whilst the latter outcome is very negative, there are often ways to address some of  these failures, either by using the latest backed up physical data, or rerunning tests on the patients to identify the corrective action plan.  Remediation could come at a high financial and reputational cost to the healthcare provider, as we saw with the #wannacry ransomware which destabilized the National Health Service (NHS) in England Scotland, this year.

In some cases, though, remediation may not be possible at all. This is particularly relevant in the case of implanted microchips, where the threats are time critical. Think of a wirelessly controlled microchip implanted under the skin of an osteoporosis patient, which administers drug to him on a periodic basis. A bad-intending cyber attacker could induce an overdose to the patient which could be fatal.  In the case of Vice President Dick Cheney, these threats were real. Cheney famously suffered five heart attacks, and had wireless pacemaker implanted as a result. But in 2013, he decided to disable the wifi on his heart pacemakers following rumors of an assassination attempt.

Whilst these hacks were considered more likely to be targeted 5 years ago, there is a wider concern today around public safety.

Indeed, earlier this year, the US Food and Drug Administration announced that cybersecurity vulnerabilities were identified in St. Jude Medical’s cardiac device. Interestingly, the issue was not with the device itself but with the in-home transmitter connected to it which shared data with the medical team, to update them on the heart condition of the patient. So what was the issue? The problem was that, the transmitter could also send commands to the pacemaker enabling any bad actor to interfere.  The announcement forced their stock price immediately 4.9% down.

In the UK, similar concerns were also being raised. In 2016, Oxford University and University College London, studied a neurostimulator, an IoT device that helps regulate nerve signals and treat Parkinson symptoms or Tourette. Once again, the academic bodies found that the device was vulnerable to attacks: a hacker could switch off the device or wear down its battery resulting in severe impact on behavior, cognition as well as causing physical pain.

So what needs to be done?

1. Understand what data you have: Companies and organizations need to have a centralized record of the data they hold, dictionary to accompany them and a way to establish clear lineage. Establishing data governance is key. Just this month, the Information Commissioner’s Office warned the NHS over an agreement they struck with Google Deepmind, to share 1.6 million kidney patient records, which they consider to be ownership of the ICO as opposed to the NHS.
2. Acknowledge the risk and act: Medical bodies involved with patient data need to have their security features independently assessed at least once a year to ensure they can withstand an attack. Where the infrastructure is deemed inadequate, a solution needs to be defined and funded to enable timely remediation. That could require the adoption of robust identification verification systems: Centrally managed identity platforms with strong encryption that can host large amounts of data.
3. Provide training: All functions involved with patient data (administration, executives and IT) require training. A recent Information Systems Audit and Control Association report, indicated that the training budget for healthcare bodies is currently $2,500 or less per year, with one in four bodies receiving less than $1,000. Considering the risks involved in healthcare IoT security, this is clearly inadequate.
4. Collaborate: sharing updates and best practice within the industry will strengthen the response to threats and enable cheaper more robust joint-programs to combat cyber threat

 

Bibliography

Harm, K. (2012, Feb 16). Microchip Implant Gives Medication On Command. Retrieved from Scientific American: https://www.scientificamerican.com/article/microchip-implant-medication/

Harm, K. (2012, Feb 16). Microchip Implant Gives Medication On Command. Retrieved from Scientific American: https://www.scientificamerican.com/article/microchip-implant-medication/

Klein, A. (2017, Jan 21). Alert: you’re about to catch something. New Scientist, p. 16.

Maxmen, A. (2017, Jul 6). Giant Health Studies Try to Tp Wearable Electronics. Nature, p. 13.

Moffatt, S. (2017, Jul 24). Life-or-death decisions: How do we safeguard healthcare IoT? Retrieved from Tech Target: http://internetofthingsagenda.techtarget.com/blog/IoT-Agenda/Life-or-death-decisions-How-do-we-safeguard-healthcare-IoT

The biggest healthcare breaches of 2017 (so far). (2017, Jul 20). Retrieved from Healthcare IT News: http://www.healthcareitnews.com/slideshow/biggest-healthcare-breaches-2017-so-far?page=13

Trust me, I ‘m an algorithm. (2017, Jul 15). New Scientist, p. 5.

Vaas, L. (2013, Oct 22). Doctors disabled wireless in Dick Cheney’s pacemaker to thwart hacking. Retrieved from Naked Security: https://nakedsecurity.sophos.com/2013/10/22/doctors-disabled-wireless-in-dick-cheneys-pacemaker-to-thwart-hacking/

Verily Launches Landmark Stusy with duke & Stanford as First Initiative of Project Baseline. (2017, Apr 19). Retrieved from Verily.com: https://static.googleusercontent.com/media/verily.com/en//press/articles/BaselinePressRelease.pdf