We live in a world where medical errors are the third leading cause of death behind cancer and cardiac disease, leading to more than 200,000 preventable deaths every year. We have an aging population growing at an unprecedented rate: 8.5 percent of people worldwide (617 million) are aged 65 and older, and this percentage is projected to jump to nearly 17 percent (1.6 billion) by 2050, leading to an anticipated physician shortage of more than 50,000 by 2025. On top of all of this, healthcare costs are projected to increase to over 25 percent of GDP in the United States by 2025. The convergence of these events is pushing the entire industry to begin leveraging technology more than it has in the past.
Many of these challenges can be remedied by leveraging Industrial IoT (IIoT) technology that’s been proven to solve similar challenges in other industries. Could an interoperable, connected healthcare platform that applies the principles of an IIoT connectivity architecture to share data throughout the healthcare system be the cure for our ailing healthcare system?
West Health, now the Center for Medical Interoperability, seems to think so. In 2013 they published a report showing how an interoperable, connected healthcare system could provide nearly $30 billion in industry savings while improving patient outcomes in the process. These connected healthcare platforms provide the foundation for innovation that is needed to make a meaningful data-driven change in healthcare. It’s these platforms that open the door to application developers everywhere to create modality-specific applications using artificial intelligence and machine learning.
So what exactly is a connected health platform and how does it provide a foundation for transformational change in healthcare? First, a connected health platform consists of hardware (gateways and servers) and embedded software components that are designed to take all of the data from any medical device (clinical or remote) and convert the data in a single usable format that gives providers access to a complete data set.
This connected platform will provide a variety of user interfaces, analytics and clinical applications to help users throughout the healthcare ecosystem distill value from this newly-gathered data. The applications range from the early detection of sepsis, to predicting cardiac arrest, to providing business analytics like bed and device utilization. The connected health platform will become the center of an ecosystem for further application development, similar to that of an online app store – but with built-in medical-grade safety and security. The connected health platform must ensure data security and patient privacy by aligning to guidance provided by the FDA on cybersecurity, and meeting the standards defined by HIPAA.
However, these connected health platforms are only as effective as the data they capture, which is determined by the connectivity frameworks they are built upon. Many of the currently deployed platforms are not platforms at all, but a collection of disparate systems that provide silos of individual device data.
These legacy systems have been built using internally-developed, proprietary, message-based communication technology. As the first step towards the development of a connected health platform, modern web services-based communication has been deployed on top of the legacy technology to begin integrating all of the disparate data streams via onsite data centers or the cloud. Although this is a step in the right direction, these platforms are far from complete. Because of the legacy communications infrastructure they are built upon, they are only able to aggregate a portion of the data making these systems a poor fit for true near-patient, real-time clinical decision support – the key to efficiently providing improved patient outcomes.
The Industrial Internet Consortium (IIC) recognized that the healthcare industry, along with many other “mission-critical” industries, was experiencing a similar set of connectivity and data integration challenges, and thus was not realizing the true benefit of the IIoT. In 2017, they set out to provide recommendations for the fundamental connectivity and security requirements of next generation IIoT systems. Its Industrial Internet Connectivity Framework document (IICF) recommends the Data Distribution Service (DDS) standard as the ideal framework for near patient, real-time connected health platform development. DDS provides a highly reliable, secure, real-time interoperable connectivity platform and is proven in other mission-critical environments, such as autonomous vehicles, naval ships and wind farms. These systems all rely on real-time data that allows medical device companies to design a connected health platform for today and the future without the burden of a less performant message-based architecture.
DDS provides a level of reliability, security and interoperable performance that cannot be matched with any other currently available, standards-based technology. By working with standards-based technology like DDS, healthcare developers can develop systems faster, with lower development and maintenance costs. Using an advanced connectivity software framework allows the connected healthcare platform developers to better focus their core competencies, and their customers’ requirements, clinical workflow, analytics and diagnosis.
The next 10 years will be transformational for the healthcare industry. Innovation will be moving at an unprecedented pace. Big tech, medical device vendors, payers and providers will be racing to develop or leverage new technology to better utilize data to improve patient outcomes, lower the cost of care and run more efficient operations. The connected healthcare platform is the future of the healthcare market. Those who embrace this trend and get to market first will transform the industry and establish a model for high-value, lower cost care for generations to come.
Agile companies do things faster and efficiently. In agile development, lean startup models apply agile methods to build high-quality systems that meet any industry, regulatory and other relevant standards such as HIPAA and remain “audit ready.”
Agile companies focus on quick wins, external focus, ruthless prioritization, and continuous development. Agile development relies heavily on constant testing to ensure improvement.
Agile compliance management
Lean development refers to a set of principles that are designed to eliminate waste, build-in quality, create knowledge, deliver fast results, defer commitment, respect people and optimize the whole process. At their core, both agile and lean development focus on efficiency, sustainability, speed, quality and communication.
Companies can deliver software faster when they eliminate inefficient processes. Agile development follows the following 12 principles:
Customer satisfaction
Harnessing change to gain competitive advantage
Delivering working software frequently
Bringing together business and development departments
Supporting talent
Conveying information efficiently
Measuring progress by working software
Promoting sustainable development
Focusing on technical excellence
Maximizing the amount of undone work
Using self-organizing teams to build the best designs, architectures, and requirements
Reflecting and adjusting
How Agile development applies to cybersecurity
Agile development methods align well to cybersecurity because they focus on harnessing change, readjustment and reflection. You see, malicious actors (think black hat hackers) have excelled in agile development. They continuously re-adjust their attacks to maintain superiority and remain one step ahead of defensive mechanisms employed by organizations by improving the quality of their software. To combat these threats, you need to come up with a similar agile security-first approach to protect your information and systems.
What is Agile compliance?
Agile compliance also focuses on the 12 principles of agile development; however, it focuses on threat mitigation and not product development. Furthermore, agile compliance prioritizes customer data security as well as stakeholder satisfaction as the primary product as opposed to customer satisfaction, which is the main focus of agile development.
When it comes to cybersecurity governance, risk and compliance (GRC), data integrity and availability leads to customer satisfaction and confidence. With compliance’s security-first approach, you create an iterative process that includes mitigation, monitoring, and review, which is aligned with your controls and protects your data.
In cybersecurity, an agile compliance program is a security-first strategy that is put in place to protect data. This strategy focuses on your data controls’ quality and ensures that even when industry regulations and standards lag behind threat vectors, your company maintains a secure data environment. Here are the 12 principles:
By Pratik Kirve, writer, blogger, and content writer, Allied Analytics.
Pratik Kirve
Healthcare providers have been considering data confidentiality more than ever. It has become a part of patient experience as the implementation of biometric technology to safeguard patient information adds a layer of trust and confidence. As the popularity of biometric authentication increases among smartphone users, healthcare providers have been utilizing it for various processes, especially security. According to the cybersecurity survey by HIMSS, there has been a significant improvement in awareness regarding cybersecurity among healthcare organizations.
More funding has been allocated to IT departments and the advantage of an increasing number of healthcare-specific solutions have been taken. Though the survey spotted many flaws in the implementation of security measures such as usage of outdated tech in the networks, the awareness, and implementation of security shows organizations have taken patient data security seriously. The survey found that hackers have begun security breaches and organizations need to put better vigilance over the patient data and information.
Various measures have been taken by market players and tech giants to ensure the security of data. Fingerprint reading technology has been released to improve security and offer controlled access. Market players have been collaborating to enable better security through integration of iris biometric information with blockchain network. The industry for healthcare biometrics is booming. According to the research firm Allied Market Research, the global healthcare biometrics market is expected to grow at a considerable CAGR through 2023. Following are some of the activities taking place in the industry:
I hope healthcare organizations delivered lots of TUMS and Advil to their beleaguered cybersecurity teams as a holiday bonus in 2018 – and maybe even a masseuse! With an overload of alerts, attacks and system compromises, it’s safe to say that working in a security operations center (SOC) can take both a mental and physical toll:
From 2010 to 2017, nearly 2,150 breaches involving more than 176 million patient records were reported to the Office of Civil Rights at the U.S. Department of Health and Human Services, according to a study published by the Journal of the American Medical Association (JAMA). During this period, the total number of breaches increased every year (except for 2015), with 199 reported in 2010 and 344 reported in 2017.
By Brad Spannbauer, senior director of product management, eFax Corporate.
Bradley Spannbauer
When it comes to cybersecurity, healthcare organizations are up against a constantly shifting threat landscape. New technologies and techniques, employed by increasingly advanced criminals, require organizations to be proactive in their defense efforts, or they risk being outsmarted by those who seek to expose them. But security threats don’t just come from external sources; risks are just as prevalent within organizations. In fact, the latest edition of Verizon’s Data Breach Investigations Report found that healthcare is the only industry where insiders pose the greatest threat to sensitive data, with 58 percent of incidents coming from within.
Whether malicious in intent or the result of innocent mistakes by healthcare workers doing their best in a high-stress environment, a failure to recognize these risks and apply appropriate safeguards can have grave consequences for healthcare providers. For example, an IBM & Ponemon Institute study revealed that healthcare data breaches cost organizations $408 per record on average, which is more than three times the global average across all other industries. That may not seem like a lot of money, but multiplied by the thousands of records that could be contained on a stolen and unencrypted laptop, it adds up to a significant financial penalty.
It has become clear in the last few years that when it comes to cybercrime, hackers are not fussy about which organization or sector they focus on – if there’s profit to be made, anyone is a potential target.
However, there are of course institutions which will always be of particular desirability to cybercriminals. Financial institutions, banks and retail are among the most targeted because the goal of most cyberattacks is financial gain, and organizations in these industries are the most lucrative targets for cybercriminals. The healthcare sector is also heavily targeted because of the personal data it holds. This data may be stolen and used for different purposes, including fraud. As a consequence, the focus on healthcare institutions by hackers has ramped up in recent years.
This increased attention on the health sector is because of hackers seeing it as an inexhaustible source of money. On multiple occasions, media reports have described leaks of data from medical centers, followed by a ransom demand sent to clinic management and patients.
There are a number of other ways criminals can monetize attacks on healthcare equipment and applications. These include threatening patient health by altering stored information; using stolen data to fraudulently obtain access to medical care or controlled medications; leveraging personal information on patients and their family members; and sabotaging websites and/or infrastructure on behalf of unscrupulous competitors. Attacking healthcare institutions also allows criminals to resell stolen data to third parties such as insurance companies, healthcare providers, banks, and others, who can use this valuable information for a number of purposes (such as advertising, research, or even discrimination based on pre-existing conditions).
One such specific way that criminals can carry out attacks is by exploiting advancements in health technology and equipment in recent years. We’ve seen an increasing number of medical devices such as pacemakers, drug pumps (like insulin infusion devices), implantable defibrillators, and other devices implementing wireless connectivity for doctors to control and fine-tune their work and update firmware. This makes these devices potentially incredibly dangerous for patients. A criminal could research and reverse communication protocols and exploit vulnerabilities in a simple piece of software used in those tiny devices, for example changing the heart rate controlled by pacemakers, injecting incorrect doses of drugs or even making them show the wrong data — leading doctors to the wrong conclusions and causing them to make mistakes in their treatment.
With new technology comes to new terminologies, like cybersecurity. Unfortunately, this new technology also spawns the creation of new methods to bypass security measures. And while data breach may not be a new term or even a new problem, in 2019, it’s become a massive issue, particularly in the healthcare industry.
In 2015 alone, there were more than 750 cyber data breaches, with the top seven cumulatively involving 193 million personal records that were available for hackers to use for fraudulent activities and identity theft. The top three data breaches that year were all in the healthcare industry.
Healthcare records are full of highly sensitive information, from social security numbers and other personal data to medical histories and health insurance information — everything a hacker needs to steal someone’s identity. But besides the wealth of juicy details these records include, it’s the vulnerability that exists in the industry that attracts trouble.
Besides being a repository of vital information that hackers need, the healthcare industry has been particularly vulnerable because of the weak link philosophy. You’ve probably heard that a chain is only as strong as its weakest link. This is also true when it comes to cybersecurity. And it’s something hackers prey on.
According to a 2016 Healthcare Industry Cybersecurity Report, the healthcare industry had the fifth highest amount of ransomware counts of all industries. The report also stated that more than 77 percent of the entire industry was infected with malware. According to the report, the most prevalent weaknesses existed in “health treatment centers, insurance providers, manufacturers and hospitals.” In other words, everywhere.
The authors of the report mention how the industry is facing pressure from both sides ? from hackers who specifically target them and employ different methods in doing so, and from regulatory agencies who are trying to prevent this from happening.
The problem doesn’t rest with the IT departments in most cases, but rather with the employees who aren’t prioritizing, or even aware of, security issues and with those who have been tasked with training and managing them.
“The low social engineering scores,” the report states, “among a multitude of healthcare organizations show that security awareness and employee training are likely not sufficient and this poses a real risk to those organizations.” Hackers know that these employees represent low-hanging fruit. This is why they’ve become such a target.
The main risks, according to the report, are the wireless devices so prevalent in the industry and the amount of information that’s exchanged through them. While these devices are beneficial for their speed and access to information, the way in which they’ve been mishandled and implemented is resulting in added security risks.
How these breaches affect consumers
A survey by Accenture in February of 2017 revealed that healthcare security breaches affect 26 percent of U.S. consumers. And 50 percent of those had their identity stolen, resulting in an average out-of-pocket cost of $2,500 per person. That means for every eight people, one person has had their identity stolen as a result of a healthcare data breach. But perhaps the greater aspect of this problem is reach, as in nearly everyone has health records in the system.
In the largest healthcare data breach to date, Anthem Blue Cross, in January of 2015, had 78.8 million patient records stolen. This included information such as dates of birth, addresses, and social security numbers ? the information hackers most need to steal someone’s identity.
In the case of the Anthem Blue Cross breach, consumers weren’t told about the breach by law enforcement or Anthem themselves. They found out the hard way: by noticing something was wrong on their bank and credit card statements.
How healthcare companies can improve security
The need to take extra precautions when dealing with sensitive healthcare data is obvious. But if the problem was easy to solve, it wouldn’t be a problem to begin with. And unfortunately, for every zig in security measures, there are a hundred hackers ready to zag.
Assess the larger risk as it pertains to the entire system, rather than relying on specific vulnerability analyses.
Always know where your sensitive data is being stored.
Improve training across the board. Impart the risks and precautions to employees, and make certain all understand policies and procedures before handling any consumer data.
Address the issue of third-party vendors. Make sure they’re handling your sensitive data properly.
Reinforce the infrastructure, including all software, with extra cybersecurity measures.
While the theft of information that leads to someone’s identity being stolen is the main risk, it isn’t the only risk. When sensitive medical conditions are made public, it can affect a person’s ability to get or keep a job and their professional and personal relationships.
The impact on businesses and organizations is also dire when leaks occur, as their trust, credibility, and reputation suffer dramatically. They also open themselves up to the possibility of massive fines and lengthy investigations.
The FDA recently issued new guidelines for securing data in medical devices, such as smartphone apps. This is especially important, as the HIPPA (Health Insurance Portability and Accountability Act) Journal has stated that 91 percent of cyberattacks are the result of personalized phishing emails sent to employees.
Abbott and The Chertoff Group, a security and risk management advisory group, have released a white paper that shares key findings from a recent study of 300 physicians and 100 hospital administrators on cybersecurity challenges in the hospital environment. Results found that while physicians and hospital administrators view cybersecurity as a priority, the majority of them feel under prepared to combat cyber risks in the connected hospital.
Chris Tyberg
“Cybersecurity is a shared responsibility across all of us working in today’s healthcare system,” said Chris Tyberg, divisional vice president, product security, Abbott. “Hospitals are critical hubs within this system, and as the use of advanced medical technology and attention to cybersecurity and connected health increases, it is important for us to understand the challenges hospitals face and how we can collaborate on potential solutions.”
The survey revealed several key findings, including:
Cybersecurity is a priority in today’s connected hospital: 92 percent of physicians and 91 percent of hospital administrators say that keeping patient and hospital data secure is a focus of their hospital.
Physicians and hospital administrators feel underprepared to combat cyber risks: 75 percent of physicians and 62 percent of hospital administrators feel inadequately trained or prepared to mitigate cyber risks that may impact their hospital.
Physicians and hospital administrators view medical device cybersecurity as a shared responsibility: 71 percent of physicians and 74 percent of hospital administrators believe cybersecurity is a shared responsibility among all participants in the healthcare system.
Communication about medical device cyber-related vulnerabilities can improve: Only 15 percent of physicians and 45 percent of administrators report having seen or read advisories related to medical device security in the last six months.
Standards are widely desired: 82 percent of physicians and 73 percent of administrators believe there should be industry-wide standards and consistent terminology.
Using these survey insights, Abbott partnered with The Chertoff Group to develop the white paper on connected healthcare security, which outlines key considerations for managing cybersecurity risk in the connected hospital. The white paper, “Building a More Secure Connected Healthcare Environment,” identifies members of the healthcare ecosystem can work together to mitigate cybersecurity risk while preserving the benefits of connected medical devices for patients.
The white paper calls for the healthcare industry to come together to address three key areas:
Industry-wide standards and cybersecurity by design to ensure cybersecurity protections are built into medical device development and that physicians and patients feel confident in the security and safety of the devices they use.
Investment in cybersecurity incident response processes for identifying and responding to vulnerabilities in a timely manner, while supporting safe clinical care.
Improved education, focus and training to increase all stakeholders’ understanding of cyber risk in the healthcare setting.
With new technology comes to new terminologies, like cybersecurity. Unfortunately, this new technology also spawns the creation of new methods to bypass security measures. And while data breach may not be a new term or even a new problem, in 2019, it’s become a massive issue, particularly in the healthcare industry.