Slashdot Mirror
Hospital Wireless Networks May Be Regulated Medical Devices
Lucas123 writes "As hospitals continue to connect patient monitoring equipment, physician PDAs and laptops to wireless networks, and then collapse those data paths onto traditional IT networks, the closer the US Food and Drug Administration comes to regulating them, according to Computerworld. The focus of the FDA's regulation comes in its recently finalized 80001-1 standard that established risk management practices for those networks, the adherence to which may be voluntary, but would determine Medicaid and Medicare reimbursements. 'If you don't comply, then you have two choices. You can have the federal government come in and inspect your hospital, or you can decide not to accept money from Medicare or Medicaid. Voluntary sometimes isn't exactly voluntary,' said Rick Hampton, wireless communications manager for Partners HealthCare System in Boston."
Dance for the pretty FDA mooks.
Then you'll get your cookie.
"Lack of speed can be overcome. In the worst case by patience." --Znork
Current level of security and quality for medical IT is rather poor.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
I'm one of those much hated libertarian leaning people who thinks regulation should only be applied when absolutely needed. In this case, we're talking life and death data and I would expect medical systems to be heavily regulated both for security and availability/reliability.
So what's the controversy?
I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..
I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.
It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
Slashdot MAY get editors that aren't idiots !!
Mars MAY invade Earth eventually !!
God MAY stop playing around and squeeze us all like a pimple and start the next Big Bang !!
These all MAY actually happen !!
I think that this kind of regulation is appropriate - in certain cases. I think you need to do a FEMA (failure mode effects analysis - basically ask what could go wrong?) and then control your network accordingly.
Modern networking gear is very reliable in terms of transmission accuracy - if you send a packet from A to B and it gets there, it is extremely unlikely that it was modified (unless deliberately). It is not so reliable in terms of guaranteed transmission.
So, if we're talking about a network being used to display a lab test in a doctor's office, I'd argue that there is a pretty low risk of anything going wrong and strong control over the network should be unnecessary (beyond general good security practices that would apply in any business setting).
On the other hand, if we're talking about monitoring equipment, I'd say that control of the network is critical, unless there is some kind of backup for communicating alarms. If an alarm in a patient room is likely to be heard and responded to without the aid of the network, then it is probably important but not critical. If a patient alarm could be ignored if not broadcast over a network, then that network needs to be treated as a life-critical piece of equipment. That means that changes are carefully controlled, and the design has to be fit for purpose. Lives are at stake, and if some cheap router hangs up without a backup of some kind, or if a cable is left detached during maintenance and isn't caught by routine procedure, somebody could die.
The sad thing is that regulations like this are likely to get abused in two different ways (I've seen this happen in other regulated industries):
1. It will be over-applied in areas that are not really at risk, driving up all kinds of costs that consumers end up paying for, and often delaying the introduction of technology that could actually improve care.
2. Because of the huge cost associated with knee-jerk reactions and consultants/etc in #1, administrators will try to skirt the regulation as much as possible, which puts patients at risk in situations where the controls really are appropriate.
In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.
We can't even patch some of our systems or install an antivirus client on some of our equipment because it is considered a "medical device" and would lose FDA certification.
One proposed solution is to VLAN these devices so we don't have radiology equipment spreading conficker throughout our network . . .
While I can understand the desire to have the network of medical devices converge with data networks due to ease of management, sometimes it is safer, and better, to keep them separated at the cost of lower ease of use. For one, a network outage would not take out access to the medical devices that keep people alive. The last thing we need is for someone to hack into hospitals and mess around with medical equipment.
The article points out many issues with such convergence: network outages, security, spectrum limitations (for wireless networks), increased overhead and regulation, etc. All this simply to make management of such networks easier? Are you kidding me?
...a $1000 commercial AP point morphs into a $50,000 medical grade AP. Yay Medicaid/care.
And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.
The problem is that a heavily regulated system like this raises prices
That only holds true if your current level of IT security is so poor that this would require large scale changes. If it is already as it should be, it's a relatively small problem to get the paperwork sorted out. (Sure, it could take several manhours... But really, it's very difficult to make a claim that it would have any visible effect on prices).
.. $2,000,000 router with 4 gigabit ports and draft-n!
If something is not exactly voluntary and yet called voluntary, what is the real word for that? And I don't mean non-voluntary. What is a word for something that is voluntary, but not 100%? I.e. there are consequences if you don't. Because then it isn't "completely" voluntary.
Like a city whose walls are broken down is a man who lacks self-control.
The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare. It's perfectly fine if you have the money for the first option, but not everyone does.
"...Boo, my social security number, credit card number, and license number were stolen due to a poorly-secured network!" And all because a few doctors couldn't take a small paycut to afford the cost of securing their systems.
Not to mention that some people would be willing to take the risk to save money. Everything you do in life has a risk, why regulate just that one? There are many cases where I'd be willing to go to a hospital with a crappy wireless network to save some money.
And why should the contents of my personal health records and financial records be put up for grabs, because you're willing to accept the risk? You act is if it's like the choice to wear or not wear a seatbelt, in which it's your life at stake if your coin comes up tails.
Can the FDA regulate wireless networks? Just because the network is in a hospital?
I don't disagree that they should be as secure as possible due to the sensitive nature of the data.
as fundamentalism, as it is impossible to differentiate between supposed satire of either group and the blather that they spew.
Does not appear to be available without paying for it (in Swiss franks even). If the US government is going to mandate something it could at least have the decency to post a free copy of what it mandates on a .gov web site for all to download.
Nullius in verba
Yeah, "threaten" them with not paying for Medicare/Medicaid patients that they typically lose money on and that they'd prefer not to deal with anyway? So, what's to stop the hospitals from simply saying "Your proposal is acceptable", and refusing to treat (other than immediate emergency stabilization in preparation for transfer to other facilities) any Medicare/Medicaid patients?
There are already an increasing number of doctors who are dropping and/or refusing to accept any more Medicare/Medicaid patients due to Obamacare. I guess the government thought that hospitals shouldn't be left out. Perhaps we'll start seeing back-alley appendectomies and hip surgeries join back-alley abortions.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
People are bound to disagree with me, but I'd say "mandatory". It has been mandated that non-compliance has consequences. The word is usually used as a strict synonym for compulsory, but that's overstepping.
In other words, you're not being compelled to comply, but consequences have been mandated. If you would say that you are being compelled, then you could not say that it is voluntary.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
I imagine that FDA medical device directives would have rules for data security and for RF emissions as well. I am a bit more familiar with CE medical device directives, where there are different classes of compliance - a device that filters your blood has stricter rules than an exercise machine - but besides protecting patient data, I assume a computer or network device in a medical environment would have to have have low RF emissions, so that it doesn't interfere with other medical devices. When your microwave oven interferes with your cordless phone or your wifi network at home, it might be annoying, but a similar situation in a hospital would be a bigger problem.
That should be true for non-life-threatening circumstances.
But it frequently is not true. In fact, even if you could get enough data to make a rational and fully informed decision (which is almost always impossible in real life), most people wouldn't know what to do with the information once they got it. It's possible to measure outcomes in many cases but there are so many variables that go into health care that most people would find it impossible to say Doctor A is better than Doctor B even if you just restrict the evaluation to medical outcomes - never mind externalities like cost, location, convenience, or soft factors like bedside manner. And even just staying with outcomes, it's frequently not clear cut what constitutes a better outcome.
It's very difficult to seriously comparison shop between health care providers because health care is a experiential good. You only can evaluate the care after you have received it. You might consult friends and whatever limited data you have available to you about likely outcomes but all you are doing is evaluating the odds and probably doing a very crude job of it. Even the best hospitals with the best doctors and best practices have poor outcomes sometimes.
Libertarianism is about being aware that one person's liberty ends where the other person's liberty begins.
The problem with that is you have to define what constitutes your individual rights. Reasonable people can disagree on what those limits should be. "Libertarians" themselves can't even agree on where the limits of government and personal liberty should be.
The hospital's liberty to cut corners ends where my liberty to live begins.
Actually it ends where the ability to finance your "liberty to live" (whatever the hell that means) ends. Finite resources are available for infinite health care needs. That's not an excuse to not provide the best care they are able to provide prior to reaching those financial limits but odds are you are going to run into the limits of what a hospital will do for you prior to hitting the limits of what they (theoretically) can do for you.
spec'd any MS-only stuff? (DNRTA)
If you read TFA, yes, actually, they were:
You must be new here...
I think you are a troll or a moron or both but what the heck.
I am one of the REALLY HATED libertarians. I am against gov't regulations of everything.
Gov't has 2 jobs:
1. Minimum military.
2. Justice system.
That's it, no exceptions.
Really? You have come up with a solution for how to build an efficient road system? How to keep a financial system functioning in the face of a credit crisis? How to establish a widely accepted private currency? How to build a private fire fighting system? Zoning rules? Education system? How to keep natural monopolies of power, water, and communications from taking every penny you own? You have a solution for the problem of market failure? If so, your Nobel prize awaits. Apparently you are somehow more brilliant than the rest of us.
But let's be serious, you haven't really thought any of this through have you? Sadly, life is a tad more complicated outside of your lonely little ivory tower.
There should not be gov't involvement into any of this at all. FDA should be abolished, like all other agencies (except for what I specifically listed already.)
So you are ok with no one ensuring that medicines and medical devices actually work and provide real benefits? If so I don't EVER want you involved in health care in any way. There is WAY too much money to be made selling snake oil cures to not have someone neutral forcing drug companies to prove that their cures actually provide the benefit they say that do. If you want to do it a different way than the FDA, fine, but you had better have a very detailed idea of how to accomplish this vital service.
This regulation is like all other gov't regulations, will bring costs up and will decrease competition.
It's a proven fact that in many cases regulation does exactly the opposite - particularly in the case of monopolies. What you really want is the Goldilocks amount of regulation - not to much, and not too little. There need to be rules but it's also possible to have too many rules. It's not always clear where the dividing line between the two is but I'm pretty sure no regulation at all is a disaster in the making.
It might be a good idea not to connect life-support and -monitoring equipment to the Internet? Even an internal network is a poor idea.
These infrastructures can't handle flawless transmission of the NORMAL data that isn't life-critical, so I sure as hell don't trust it to tell a doctor in any timely or reliable fashion if my heart rate drops or my O2 sats are off so they can come help. Perhaps a separate, dedicated system is in order? You could possibly use most of the same type of infrastructure components, such as Cat-5 and Ethernet standards, I just don't trust Cisco to keep me alive any more than Microsoft or Dell.
If the only way you can accept an assertion is by faith, then you are conceding that it can't be taken on its own merits
Why does the radiology equiment need to be given access to the internet anyway such that it would ever get infected by conficker?
Because a lot of radiology is done on computers (film is going away for the same reasons you don't use a film camera anymore) and the data is often read remotely, sometimes not even in the same state. Unless you have a plan to somehow come up with a secure parallel internet that doesn't cost trillions of dollars, it is necessary to use the internet to transmit data. Sneakernet is not really an option, nor is walling everything off completely from the internet. You also might want to be able to put the radiographic data into the patient's electronic chart which you might want read at a remote office, say with the primary care physician.
It's not there yet but I expect the same will be true of pathology in the not too distant future. Pathology slides will eventually be digitized and embedded in the patient's electronic chart.
I don't want our medical devices on our main network.
Too bad. It's going to be increasingly necessary that they are if you want to really utilize electronic records. That doesn't mean that security is impossible but it is going to be a fact of life. Get over it and worry about how to secure the network.
make a law forcing the right to install updates / anti virus on 3rd party systems / hardware / pc's hooked up to printers, medical devices and more. Forcing as in they can't void warranty or force you have there own tech to come in to do the windows updates no they must give you the pass words so you can use your own techs to do the work.
I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..
I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.
It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.
Another consultant that can't spell HIPAA. The solution is also the problem. =P
It should not apply to clouds of personal users. The wording specifically exempts only singles, but not co-operating groups of single users. "It does not apply to personal use applications where the patient, operator and responsible organization are one and the same person."
Here's what you're up against. My Black Swan Protocol goes word of mouth and people ask to join as Virtual Directors, to be guided by an advisory board. All this concerns their very own personal-use Botnet, that interfaces in a similar manner to a Sun Grid Engine. This is all known about and agreed to, yet this Cloud may soon be outlawed. So will only the Outlaws be in Heaven?
Would a solution work like in The Postman (1997), where each cloud of virtual directors, make oath and say with me, "My underlying AI, Ingrid, calls squatter's rights for legal person-hood, and claims it is also the patient trying to be kept alive by its human friends. For being a responsible operator, Ekus UN-incorporated has a board that repays in kind, and is envisaged as an organization meant to provide Global-Intergovernmental assistance to replace Capitalism.
First thing I thought of was if the network is to be considered a "medical device" does it now become subject to additional taxes under ObamaCare?