READ TIME | 5 MINUTES
Best Practices: Access Controls for Medical Devices (Part 2)
This three-part series explores key challenges, considerations, technologies and workflows related to providing secure frontline medical device access and use. Previously, in part one of the series, we reviewed medical device security considerations and recommendations from regulators.
Understanding Medical Device Security Risks
Too often, increased security measures can contribute to a decline in provider efficiency, productivity and satisfaction. Introducing additional workflows or cumbersome tasks in the name of security can often have unintended impacts, as clinicians and other users employ workarounds to mitigate frustration associated with new security measures.
For some medical devices, such as patient spot check vitals monitors, clinicians may have to log in multiple times per shift to access the device. In order to mitigate medical device security risks and have a successful access control strategy for medical devices, healthcare organizations must plan for some of the most common workarounds used in healthcare today.
Not Requiring Credentials
The security and compliance risks of not requiring credentials for network-connected medical devices, or for those that store PHI, are limitless. The medical device security risks range anywhere from a HIPAA fine when a patient monitor is left unattended, to an entire network compromise as a networked device is used as a backdoor entry to the HIT infrastructure, or even patient safety concerns in the event an untrusted user pushes incorrect information to the EHR, compromising the integrity of a device’s clinical decision-making support.
Password and Credential Sharing, Leading to Audit Issues
When clinicians are required to manually enter usernames and passwords, they often resort to unsecure activities, such as the sharing of user credentials to remove some of their workflow pain points. This can be done in the form of password sharing between clinicians or in the form of clinicians opting to stay logged in to the devices, creating the potential for inadvertent charting under the incorrect clinician ID. Not only does this activity expose organizations to the risk that an untrusted user can gain access to one of these medical devices, it also interferes with data accuracy as audit logs can no longer be trusted.
Batch Entry and Handwritten Vitals
To optimize the investment in vital signs monitors that can connect in a secure way, hospitals have to configure devices to authenticate clinicians. If the process is viewed as one that creates inefficiency and frustration with the clinical staff, hospitals may configure for less security than is desirable, or see low adoption of the technology with manually charted vitals.
Not Connecting Devices to the Network
Occasionally, in an attempt to avoid common security frustrations, organizations will keep these medical devices off the network. While this may remove some of the most common security concerns, it also prevents healthcare organizations from optimizing the investments they have already made in their connectable medical devices.
To minimize medical device security risks, you must ensure access controls on medical devices are streamlined, convenient and do not interfere with clinical workflows. Having a thorough understanding of common security and compliance workarounds can help organizations avoid dangerous security workarounds before they happen.
Next up we will share part three of the series, where we will evaluate authentication modalities for the care setting.
1. FDA, October 2014, Content of Premarket Submissions for Management of Cybersecurity in Medical Devices, https://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm356190.pdf
2. NIST: National Institute of Standards and Technology
3. Health Care Industry Cybersecurity Task Force, June 2017, Report on Improving Cybersecurity in the Health Care Industry, https://www.phe.gov/Preparedness/planning/CyberTF/Documents/report2017.pdf
4. NIST, June 2017, NIST Special Publication 800-63B, Digital Identity Guidelines: Authentication and Life Cycle Management, http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf
This article provided courtesy of Imprivata.