Slashdot Mirror
Hospital Wireless Networks May Be Regulated Medical Devices
Lucas123 writes "As hospitals continue to connect patient monitoring equipment, physician PDAs and laptops to wireless networks, and then collapse those data paths onto traditional IT networks, the closer the US Food and Drug Administration comes to regulating them, according to Computerworld. The focus of the FDA's regulation comes in its recently finalized 80001-1 standard that established risk management practices for those networks, the adherence to which may be voluntary, but would determine Medicaid and Medicare reimbursements. 'If you don't comply, then you have two choices. You can have the federal government come in and inspect your hospital, or you can decide not to accept money from Medicare or Medicaid. Voluntary sometimes isn't exactly voluntary,' said Rick Hampton, wireless communications manager for Partners HealthCare System in Boston."
I think the quality of classic IT in a hospital isn't that bad. The status of our Windows network isn't that bad. There are issues, but I don't think we're any worse than any other industry. What is bad is the Biomed side of the house. The medical equipment stores patient data with no authentication or auditing capabilities. The systems that are based on off the shelf hardware and software (e.g. Windows PC hooked up to a medical device) can't be patched because the vendors won't certify the systems with those patch levels and turn around and blame the requirement on FDA approval.
The point is that I'm not forcing you to go to my hospital, but with these regulations, you want to force me to go to yours.
And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.
Well, since you ask...
I manage firewalls for several hospital chains. One of the main reasons that their radiology stuff is connected to their main network is that those images are all stored digitally, and need to be available all over the place (Dr.s' offices, etc., that may or may not be at the physical location of the hospital. Also, most hospitals these days don't have a radiologist sitting around in the ER all night/weekend, any more. They contract with a remote one, so they also have to be able to send those images elsewhere (over a VPN to the imaging service, for example). Often those systems are at least firewalled in a DMZ, but I have yet to see them on a completely separate network (although some clients are making noises in that direction).