NIST offers guidance for securing wireless infusion pumps
Federal agency works with several major vendors to develop a standards-based approach and framework to better protect devices from hacking.
The National Institute of Standards and Technology has issued new guidance on securing wireless infusion pumps in hopes of hardening the devices against cyber attacks.
The federal agency issued the instructions in collaboration with the National Cybersecurity Center of Excellence (NCCoE), which is a unit within NIST. The NCCoE has designed a plan showing providers how to use standards-based commercially available technology to protect pumps, patient information and drug library dosing limits.
Several major vendors collaborated with NIST on the report. They include B.Braun, Baxter, BD, Cisco, Clearwater Compliance, DigiCert, Hospira, Intercede, MDISS, PFP, RAMPARTS, Smiths Medical, Symantec and TD Medical.
The plan includes a questionnaire-based risk assessment mapping security characteristics to available cybersecurity standards as well as to HIPAA security rule requirements to apply security controls for pumps and other information systems or networks to which they may connect.
“Ultimately, we show how biomedical, networking and cybersecurity engineers and IT professionals can securely configure and deploy wireless infusion pumps to reduce cybersecurity risk,” NIST’s report contends.
Also See: Pressure grows to increase security of wireless infusion pumps
The new report reflects more than a year of work on infusion pump security by NIST, which called on technology companies in January 2016 to mount a collaborative effort to improve the security of wireless pumps.
Federal agencies and watchdog groups raised awareness of the fact that wireless infusion pumps could be compromised by hackers, increasing risks for patients and also prompting concerns that the networks to which they’re connected could be accessed through cyber attacks. Security on the devices typically is weak and can be easily manipulated by external agents.
“In particular, the wireless infusion pump ecosystem (the pump, the network and the data stored in or on a pump) face a range of threats including unauthorized access to protected health information, changes to prescribed drug doses and interference with a pump’s function,” the guidance states, citing a report of the Association for the Advancement of Medical Instrumentation.
Although connecting infusion pumps to point-of-care medication systems and electronic health records can improve healthcare delivery processes, using a medical device’s connectivity capabilities can pose increased risk, which could lead to operational or safety issues, NIST notes.
In general, wireless infusion pumps don’t interface with a lot of other information systems; they take data and push it to the pharmacy using an HL7 central server, and the data may also go into the electronic health record, says Tom Walsh, president of the Tom Walsh Consulting security practice. But because there are so many different vendors and varieties of pumps, it’s been difficult to devise one approach to protect them.
Part of the vulnerability stems from the fact that vendors often remotely access their devices in hospitals to troubleshoot them. “How do you know it’s the vendor in the device or someone hacking in?” Walsh asks. “The vendor may or may not collaborate with IT or biomedical.”
The full NIST guidance is available here. A model of a network infrastructure is here.
The federal agency issued the instructions in collaboration with the National Cybersecurity Center of Excellence (NCCoE), which is a unit within NIST. The NCCoE has designed a plan showing providers how to use standards-based commercially available technology to protect pumps, patient information and drug library dosing limits.
Several major vendors collaborated with NIST on the report. They include B.Braun, Baxter, BD, Cisco, Clearwater Compliance, DigiCert, Hospira, Intercede, MDISS, PFP, RAMPARTS, Smiths Medical, Symantec and TD Medical.
The plan includes a questionnaire-based risk assessment mapping security characteristics to available cybersecurity standards as well as to HIPAA security rule requirements to apply security controls for pumps and other information systems or networks to which they may connect.
“Ultimately, we show how biomedical, networking and cybersecurity engineers and IT professionals can securely configure and deploy wireless infusion pumps to reduce cybersecurity risk,” NIST’s report contends.
Also See: Pressure grows to increase security of wireless infusion pumpsThe new report reflects more than a year of work on infusion pump security by NIST, which called on technology companies in January 2016 to mount a collaborative effort to improve the security of wireless pumps.
Federal agencies and watchdog groups raised awareness of the fact that wireless infusion pumps could be compromised by hackers, increasing risks for patients and also prompting concerns that the networks to which they’re connected could be accessed through cyber attacks. Security on the devices typically is weak and can be easily manipulated by external agents.
“In particular, the wireless infusion pump ecosystem (the pump, the network and the data stored in or on a pump) face a range of threats including unauthorized access to protected health information, changes to prescribed drug doses and interference with a pump’s function,” the guidance states, citing a report of the Association for the Advancement of Medical Instrumentation.
Although connecting infusion pumps to point-of-care medication systems and electronic health records can improve healthcare delivery processes, using a medical device’s connectivity capabilities can pose increased risk, which could lead to operational or safety issues, NIST notes.
In general, wireless infusion pumps don’t interface with a lot of other information systems; they take data and push it to the pharmacy using an HL7 central server, and the data may also go into the electronic health record, says Tom Walsh, president of the Tom Walsh Consulting security practice. But because there are so many different vendors and varieties of pumps, it’s been difficult to devise one approach to protect them.
Part of the vulnerability stems from the fact that vendors often remotely access their devices in hospitals to troubleshoot them. “How do you know it’s the vendor in the device or someone hacking in?” Walsh asks. “The vendor may or may not collaborate with IT or biomedical.”
The full NIST guidance is available here. A model of a network infrastructure is here.
More for you
Loading data for hdm_tax_topic #better-outcomes...