Cybersecurity threat to remote monitoring devices

Dr Tuvia Ben Gal

Major issues are manufacturers often not factoring in cybersecurity, medical guidelines overlooking the matter, and healthcare providers being uninformed about the security risks and unfamiliar with the methods for evaluating those risks, he pointed out during a session at the ESC Digital Summit 2021. 

Focusing on telemedicine, monitoring devices, pacemakers, implantable cardioverter-defibrillators (ICDs), cardiac resynchronization therapy (CRT) devices, and left ventricular assist devices (LVADs), he explained that modern communication technologies for the monitoring and management of patients improve outcomes and reduce costs. The devices allow for monitoring and assessment of a patient’s condition by both unidirectional data transmission from the patient to the healthcare provider and bidirectional communication features. The latter are designed to facilitate active intervention or electronical manipulation of the device with the aim of improving the clinical condition of the patient. However, bidirectional communication is not yet being applied due to unresolved security issues, since the feature would also open potential gateways for unauthorised access. Dr Ben Gal cautioned: 'While healthcare providers are aware of the clinical benefits and downsides of medical devices, they are frequently uninformed of the security risks and unfamiliar with the methods for evaluating those risks.' As a result, many patients remain uninformed because they rely on information supplied by the medical team.

The devices allow for monitoring and assessment of a patient’s condition by both unidirectional data transmission from the patient to the healthcare provider and bidirectional communication features. The latter are designed to facilitate active intervention or electronical manipulation of the device with the aim of improving the clinical condition of the patient. However, bidirectional communication is not yet being applied due to unresolved security issues, since the feature would also open potential gateways for unauthorised access.

Gap in guidelines

Expressing concern that cybersecurity is not addressed in guidelines, Ben Gal posed the question of whether the security risk outweighs the clinical benefit of the device. During the ESC presentation, he outlined what is needed for protection against these security risks to ensure safe telemedicine implementation. These included: 

• collaboration between all parties using remote technology; 
• awareness of cybersecurity issues in telemedicine among the medical team; 
• establishment of institution-wide security standards, such as for data encryption; 
• frequent software updates and antivirus data scanning; 
• using proper authentication; and 
• creating and adopting local cybersecurity regulations.

While he acknowledged the role of public video conferencing platforms, especially during the first phase of the pandemic, the IT expert stressed that going forward, only products specifically assigned for healthcare video conferencing with adequate cybersecurity should be used. 

To illustrate his point, Dr Ben Gal expanded on devices used to monitor heart failure patients. Covering a range of parameters, such as haemodynamic and clinical data, pulmonary artery and left atrial pressure, bodyweight, and lung water content, these devices transmit captured data to a healthcare centre. This data is potentially vital, he explained, as it can initiate a change in therapy, if, for example, a certain threshold in one of the parameters is crossed. Therefore, the data must be protected, not only from transmission-related corruption, but also ransomware attacks encrypting the medical data and demanding payment to unencrypt the information withheld. Any such damage to the data’s integrity can have serious consequences such as interrupting device performance, impacting patient management and potentially causing harm, Dr Ben Gal pointed out. Manufacturers and companies therefore carry a great responsibility to ensure appropriate security of the monitoring device and should be encouraged to publish data on security tools for open review.

Establishing a (safe) remote kill switch for ICDs

Newer pacemaker models, which can transmit data by unidirectional communication for remote follow-up, are equally vulnerable to cyberattack, the expert cautioned – although he noted that fortunately, no cyberattacks have been reported on pacemaker technology so far. 

During the Covid-19 pandemic, another issue has emerged: At a certain point, ICDs must be deactivated for increasingly frail cardiac patients or those developing terminal illness, to prevent the implant from automatically administering dangerous shocks. However, most devices require the patient to be transported to a hospital for the deactivation – a considerable risk, especially for terminally-ill patients. Dr Ben Gal said therefore pointed out the need for remote deactivation functionality of the devices, with strict security procedures in place. 'New pacemakers should include enhanced cybersecurity properties, enabling bidirectional communication between the patient and the medical team,' he said. 

The benefits outweigh the risks

The expert also stated the need to enhance cybersecurity properties in LVADs, which use bidirectional communication for remote device adjustments to help reduce complications and hospital visits. 

While there was a risk of cyberattack, Dr Ben Gal concluded that the benefits these sophisticated devices bring for heart failure patients still significantly outweigh the drawbacks, greatly helping upgrade the quality of care. However, he added: 'Medical agencies should provide clear regulations for cybersecurity in the manufacturing process of every medical device.'

Profile:

Dr Tuvia Ben Gal is the director of the Heart Failure Unit of the Cardiology Department at Rabin Medical Center, Petah Tikva, and Tel Aviv University, Israel, where he is author of multiple peer-reviewed scientific papers and presents works at many national and international conferences.

30.11.2021

• IT (882)
• medical technology (1474)
• monitoring (350)
• security (447)
• telemedicine (267)