Clyde Hewitt MS, CISSP

For over 600 years, physicians have recognized that the practice of medicine requires different specialties. In the 1500s, the Royal College of Physicians was chartered separately from the Royal College of Surgeons, whose lineage dated from the mid-1300s. Six centuries later, the practice of medicine has further specialized. Today, the 

 has 24 different medical boards to license 36 specialties and hundreds of sub-specialties. Unmistakably, there is acceptance that not one medical specialty is the sole source of truth, but more importantly, that advancements in medicine have exceeded the ability of one person to be an expert in all areas. For this reason, physicians are comfortable referring patients to other specialties when the medical condition requires different expertise. 

AAFP tips to prepare your office for coronavirus

Managing a medical practice also requires clinical and non-clinical staff and technology to support routine clinical and business operations. These individuals, just like physicians, have specialties. These individuals, with few exceptions, are not interchangeable, as skills required to manage the different processes are unique. 

There has been an increase in independent and group practices outsourcing the management of electronic health records and patient financial processes to third parties. It was not long after patients’ medical and financial records were moved to electronic systems that criminals and other hackers recognized the value of this data and started hacking into physician computer systems. Identifying cybersecurity risks and then implementing a risk treatment plan is challenging because the threats are constantly evolving. The solution is to leverage individuals with special cybersecurity skills and experience. We should leverage the lessons learned from the American Board of Medical Specialties and seek out specialists to address these unique challenges.  

 has grouped security compliance into administrative,physical, and technical safeguards. Of these requirements, only 22 percent have an information technology focus while the remaining security controls require skills not typically found in the traditional IT staff. The remaining 78 percent of security requirements-those outside of a traditional IT focus-have been identified as a root cause for the majority of reported breaches.  

Seeking the Cybersecurity Equivalent to Medical Specialties

Addressing cybersecurity risks requires unique skills and a repeatable process to quantify and prioritize risk as well as the implementation of new processes and technology to reduce risks to an acceptable level. The National Institute of Standards and Technology (NIST) published the 

 (CSF) in 2013 that offers more clarity than the HIPAA Security Rule, but closely mirrors the required actions. The NIST CSF provides clarity and also takes a chronological approach to the security requirements. Simply stated, the NIST CSF has five objectives, each with many controls:

 your assets, systems, and infrastructures

Technology plays an important part in some of these objectives, but the vast majority (78 percent) are management processes, not technology. To support these requirements, NIST also developed the 

National Initiative For Cybersecurity Education

 (NICE), a framework of six cybersecurity categories defining a total of 24 specialties. Similar to the human lifecycle, these specialties address the life cycle of cybersecurity management. For example, the first step in developing a security program is to conduct a comprehensive risk analysis to identify all the ways threats can either disrupt or steal data. This includes assessing potential weaknesses both inside and outside the organization. This is analogous to a pediatrician’s role as they assess the health of the newborn infant, in that they should also identify risks in the family environment that will support that infant. 

Coronavirus threatens medical practice solvency

Pediatricians often vaccinate their patients, comparable to the NIST CSF requirement to “protect” the infrastructure. We understand that vaccinations are not a one-time event, but ongoing throughout the patient’s life, just as protecting a practice requires updating and changing controls in response to new threats. Physicians often rely on patients to detect illness, but several medical specialties have developed, including genetics and genomics, to help identify issues before symptoms appear.

The last two NIST CSF objectives, respond and recover, are used after cyber incidents have occurred. This requires individuals with specialized forensics skills to identify the threat and understand the damage. Other individuals are needed to manage the recovery process. Physicians have similar specialties, including emergency medicine to respond to immediate threats, then other specialties like pathology and radiology to identify diseases, and finally oncology and surgery to repair damage.

By now, it should be obvious that cybersecurity is a separate specialty than information technology. While the primer is the same, the career paths are different. Practioners in the cybersecurity field take different education paths and obtain different certifications, just as physicians rely on 26 different medical boards to manage all of the specialties. 

As physician practices look to identify and reduce their cybersecurity risks, consider the probability of success and the risk of failure if you pick the wrong specialty to treat your own patient – your practice. 

Articles

Consider the probability of success and the risk of failure if you pick the wrong specialty to treat your practice.

Cybersecurity is as nuanced as the medical specialities

Medical devices are ubiquitous. Many practices store devices in plain sight, but they often remain unnoticed and unsecured, which could result in a security or privacy breach if someone accesses patients’ data.

Even more alarming, newer products are more likely to include wireless connections so patient data can be automatically ingested into the electronic health record (EHR). Others connect directly to apps on tablets, smartphones and general-purpose laptop computers. Having electronic Protected Health Information (ePHI) on various portable devices increases the risk of a data breach through unintended physical access or remotely via wireless networks.

The primary reason for medical device risk is due to a general lack of awareness. Left unmitigated, this unawareness fosters an environment where accountability gaps lead to weak security controls.

If no one is accountable for monitoring device manufacturers’ alerts, then critical software updates may not be installed to address newly discovered technical vulnerabilities. These technical vulnerabilities provide a path for hackers to access patients’ data and/or give them an entry point into the larger network. And if no one is explicitly assigned responsibility of these devices, they could also be stolen, resulting in a reportable breach.

Device manufacturers and the Food and Drug Administration (FDA) have taken notice. In 2016, the FDA released its 

, which recommended a shared responsibility model between manufacturers and users (e.g., physician practices). Sixty-seven percent of medical device makers believe their devices are likely to be attacked over the next 12 months, according to a 

 conducted by the Ponemon Institute. However, only 17 percent of device manufacturers are taking significant steps to prevent an attack, according to the study.

The burden now shifts to physician practices to start monitoring vendor alerts and take measures to protect their devices, such as applying security patches.

However, it’s important to note that not all devices can be patched. The ever-decreasing cost of laptop computers has made them commodities, so healthcare providers generally replace office computers with the latest version of Windows about every four years.

With more expensive medical devices, it is not uncommon to keep these devices in service for 10-15 years, perhaps even longer. Many of these devices also use the Windows operating system as a core, including those based on Windows 2000, Windows 98 or even Windows XP. Microsoft has long since quit issuing security patches for these legacy operating systems, including Windows 7, so it is reasonable to assume security patches or software updates will not be available to address known threats.

Device manufacturers are also not incentivized to use the latest version of software in their new devices. Historically, healthcare organizations have never asked for the software bill of materials (BOM) as part of the request for proposal process. Many vendors have been reluctant to provide it even if asked.

Unlike cars, which change model years every fall, advances in medical equipment models takes several years, so it is possible to purchase a brand-new device that is delivered with an obsolete, even end-of-life operating system. For example, physician practices that purchase a new ultrasound machine that has been on the market for many years may discover the system is built on an unsupportable operating system. Until organizations unify their demands and start qualifying vendors based on their transparency, the problem will persist.

In the meantime, here are five proactive ways practices can protect themselves against data breaches and cybersecurity attacks.

Finding a model to address these vulnerabilities and risks requires management commitment and resources. In order to address the problem, practices must first identify all the medical devices in the inventory and keep that inventory current. Medical devices are difficult to track because they are rarely assigned to one person but rather are used among an office or group.

Once the inventory is maintained, practices must establish a rigorous schedule to check with each vendor or support contractor to identify and apply software updates. Practices should ask the hard questions of vendors, especially when purchasing new equipment, about the underlying software that the systems are built on, e.g., the BOM. Ask vendors for a written commitment to test for and remediate security vulnerabilities.

Practices must ensure that vendors do not perform maintenance without their knowledge - and be sure to specifically address remote access maintenance. Otherwise, practices will have little visibility into what maintenance is being done and if the vendor is accessing or removing sensitive data. Furthermore, do not allow vendors to leave default user credentials, such as usernames and passwords, in the systems.

Be sure to include all medical devices in a cybersecurity management plan. Practically speaking, this means that when practices have internal IT staff or external IT vendors conduct annual technical security checks, include both the medical devices and facility controls systems into their scope of work.

 issued by the Joint Cybersecurity Task Group and the Department of Health and Human Services. This plan provides guidance on the importance of conducting periodic risk assessments and maintaining a risk register of all systems and risks. It also recognizes that since healthcare is the most frequent target of hackers, practices should also have an incident management, response and communication plan.

All of these steps won’t work unless staff members are trained about the importance of protecting patients’ data and systems.

If you need a way to convince your senior leadership about the need for device management, consider this short test.

Obtain a copy of your Could Not Locate list showing all the medical equipment that cannot be found.

From this list, see if you can determine which devices can connect to the network and if staff know which items on the list may contain identifiable patient information.

For every missing device that could contain patient data, ask your compliance team if they have ascertained that there is a HIPAA breach, notified the patients impacted and notified the Office for Civil Rights as required by the HIPAA Breach Notification Rule.

If you or senior leadership isn’t uncomfortable with the results of this litmus test, then your practice may not be providing the appropriate level of resources and attention to known medical device risks.

Clyde Hewitt, MS, CISSP, CHS, ISO 27001 Lead Auditor, Level III Program Manager is an executive adviser at CynergisTek where he specializes on healthcare cybersecurity. He is also the past president and current board member of NCHICA, a not-for-profit healthcare alliance dedicated to the advancement of healthcare technology. He has served as chief security officer for five organizations in the past 20 years since his retirement from the Air Force.  

Your practice is at risk from the devices right at your very fingertips. Learn how to secure the technology you use to keep your patients healthy.

Author | Clyde Hewitt MS, CISSP

Articles

Cybersecurity is as nuanced as the medical specialities

5 ways to better manage medical device risk