Slashdot Mirror
Remote Access System Hacking Is No. 1 Patient Safety Risk (healthitsecurity.com)
Hackers attacking healthcare through remote access systems and disrupting operations is the number one patient safety risk, according to the ECRI Institute's annual Top 10 Health Technology Hazards for 2019. From a report: ECRI Institute said it published 50 cybersecurity-related alerts and problem reports in the last 18 months, a major increase over the prior period. "Remote access systems are a common target because they are, by nature, publicly accessible. Intended to meet legitimate business needs, such as allowing off-site clinicians to access clinical data or vendors to troubleshoot systems installed at the facility, remote access systems can be exploited for illegitimate purposes," the report warned.
The ECRI report [PDF] said that once hackers gain access through these systems, they can move around the network, install ransomware, steal or encrypt data, or hijack computer resources for cryptocurrency mining. "The consequences of an attack can be widespread and severe, making this a priority concern for all healthcare organizations," said ECRI Health Devices Program Executive Director David Jamison. "In critical situations, this could cause harm or death." The report recommended that healthcare organizations identify, protect, and monitor all remote access systems and points of entry, and adopt cybersecurity best practices, such as a strong password policy, maintaining and patching systems and software, and logging system access.
The ECRI report [PDF] said that once hackers gain access through these systems, they can move around the network, install ransomware, steal or encrypt data, or hijack computer resources for cryptocurrency mining. "The consequences of an attack can be widespread and severe, making this a priority concern for all healthcare organizations," said ECRI Health Devices Program Executive Director David Jamison. "In critical situations, this could cause harm or death." The report recommended that healthcare organizations identify, protect, and monitor all remote access systems and points of entry, and adopt cybersecurity best practices, such as a strong password policy, maintaining and patching systems and software, and logging system access.
I always thought it was the antibiotic resistant bacteria, incompetent doctors, and greedy hospital boards and administrators.
Shouldn't all the access issues be covered under existing acts like HIPAA?
Two Factor Authentication should be the minimum requirement for remote access to anything in a hospital or within a patient...
One time I took a friend to the ER and she wasn't injured and couldn't really represent herself. The nurse who was going to check us in couldn't get the job done because her tablet kept getting a BSOD. All IT systems can go down, but goddamn, wouldn't you think that having Windows in the ER would be beyond "asking for it" ? I'm not the biggest fan of AIX, but at least the other ER I took her to could check her in, they used an AIX based patient system. Unbelievable. I bet they have insecure-as-hell Android and iOS systems handling patient records, too. What's the advantage of that? Nurses can take selfies while the system is down (or being spied on by Russians and Chinese) ?
Medical errors are the greatest risk in the real world. They are the third leading cause of death in the US.
https://www.hopkinsmedicine.org/news/media/releases/study_suggests_medical_errors_now_third_leading_cause_of_death_in_the_us
I get yelled at by Doctors all the time, because we force things like multi-factor authentication, auto locking system after 10 minutes, forced encryption on devices, when deploying new software having to do a full security review, often rejecting the coolest product for a boring old one, just because it meets security standards, setting up the network so you just can't plug in any device anywhere....
However no matter how much security we try to put in place, the Doctors who think they know better and think this security is for the Registration Staff, will find ways around it and not report it back, so it can be addressed.
There is more harm in having data missing or stolen, then having to take an extra 20 seconds to log in.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
I can't understand why all parts of the network should be accessible remotely? At least they should keep the critical systems offline, and just part of a separate, internal network. So the solution is simple, but why are these people not able to see it?
"It is no measure of health to be well adjusted to a profoundly sick society." - Jiddu Krishnamurti
"Hacking" can mean anything at all. Easy way to the top of the threat list, no?
But not useful. As usual from msmash.
800,000 went to US hopsitals for non-life threatening reasons and died before leaving the death houses. Sounds like they kill people there. A LOT! Organ harvest? Jobs got his liver REAL FAST! INVESTIGATE!
A coworker's daughter has one, and the software has locked up several times requiring her to remove the battery to get it working again. It's also required several software updates. If it failed and provided too much insulin, it could easily kill her.
Worked in the medical device industry and all security of all hardware and software is very poor.
In fact, the security of medical devices and lab information systems is so bad, anyone with a high school education can figure out how to break into, or brick a device or lis in under 5 minutes.
Oh, and the device manufacturers have intentionally ignored security as its not needed for FDA and/or UL approval.
Find a medical device which DOES NOT have an exposed USB port. Its difficult to do.