Slashdot Mirror
Hospital Wireless Networks May Be Regulated Medical Devices
Lucas123 writes "As hospitals continue to connect patient monitoring equipment, physician PDAs and laptops to wireless networks, and then collapse those data paths onto traditional IT networks, the closer the US Food and Drug Administration comes to regulating them, according to Computerworld. The focus of the FDA's regulation comes in its recently finalized 80001-1 standard that established risk management practices for those networks, the adherence to which may be voluntary, but would determine Medicaid and Medicare reimbursements. 'If you don't comply, then you have two choices. You can have the federal government come in and inspect your hospital, or you can decide not to accept money from Medicare or Medicaid. Voluntary sometimes isn't exactly voluntary,' said Rick Hampton, wireless communications manager for Partners HealthCare System in Boston."
I'm one of those much hated libertarian leaning people who thinks regulation should only be applied when absolutely needed. In this case, we're talking life and death data and I would expect medical systems to be heavily regulated both for security and availability/reliability.
So what's the controversy?
I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..
I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.
It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
I think that this kind of regulation is appropriate - in certain cases. I think you need to do a FEMA (failure mode effects analysis - basically ask what could go wrong?) and then control your network accordingly.
Modern networking gear is very reliable in terms of transmission accuracy - if you send a packet from A to B and it gets there, it is extremely unlikely that it was modified (unless deliberately). It is not so reliable in terms of guaranteed transmission.
So, if we're talking about a network being used to display a lab test in a doctor's office, I'd argue that there is a pretty low risk of anything going wrong and strong control over the network should be unnecessary (beyond general good security practices that would apply in any business setting).
On the other hand, if we're talking about monitoring equipment, I'd say that control of the network is critical, unless there is some kind of backup for communicating alarms. If an alarm in a patient room is likely to be heard and responded to without the aid of the network, then it is probably important but not critical. If a patient alarm could be ignored if not broadcast over a network, then that network needs to be treated as a life-critical piece of equipment. That means that changes are carefully controlled, and the design has to be fit for purpose. Lives are at stake, and if some cheap router hangs up without a backup of some kind, or if a cable is left detached during maintenance and isn't caught by routine procedure, somebody could die.
The sad thing is that regulations like this are likely to get abused in two different ways (I've seen this happen in other regulated industries):
1. It will be over-applied in areas that are not really at risk, driving up all kinds of costs that consumers end up paying for, and often delaying the introduction of technology that could actually improve care.
2. Because of the huge cost associated with knee-jerk reactions and consultants/etc in #1, administrators will try to skirt the regulation as much as possible, which puts patients at risk in situations where the controls really are appropriate.
In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.
I'd have to concur. I've been in hospitals where the IT staff offered free wireless internet for the waiting areas- and the only open access point was to the "airgapped" network for the financials, etc. I'm sure that Medicare would LOVE to find out about THAT particular HIPAA violation. >:-D
And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.
I I'm sure that Medicare would LOVE to find out about THAT particular HIPAA violation. >:-D
Then go tell them. If you've physically been in the hospital that could be your data, your loved ones data, or just plain due diligence if you were there for work and not for a medical reason.