New IEEE Standard for Securing Biomedical Devices and Data

If you have a transplant Medical deviceIt was connected to a hospital machine, or has been accessed Electronic medical recordsIt may assume that infrastructure and data are safe and protected against Infiltrators. This is not necessarily the case. connected Medical devices The systems are vulnerable to Electronic attacksWhich can reveal sensitive and delay data Critical carePhysically harm patients.

the American Food and Drug AdministrationWhich oversees the safety and effectiveness of the medical equipment sold in the country, the medical devices have been summoned in the past few years Cyber ​​security Fears. And include Partiesand DNA sequence toolsAnd Insulin pumps.

In addition, hundreds of medical facilities have seen RansomWhere the malicious people encrypt the hospital Computer systems And data and then request a huge ransom to restore access. Tedros Adhanom Ghebreyesusthe Global Health OrganizationGeneral Manager, to caution the United Nations Security Council In November on “the devastating effects of ransom And electronic attacks on health infrastructure. “

To help provide better medical devices, equipment and systems Subscription laboratoriesThat tests and leads products to develop them IEEE/UL 2933, Internet data standard (IOT) for Internet (IOT) and between the interfering capacity with Tippss (trust, identity, privacy, protection, safety, and security).

“Since most connected systems use common ingredients outside the cliff, everything can be penetrated now, including medical devices and their networks.” Florence Hudsonchair IEEE 2933 working group. “This is the problem that this standard solves.”

Hudson, a senior member of IEEE, is the CEO of Northeast Data Innovation Center In Colombia. She is also a founder and executive director of the Cyber ​​Security Consulting Company FdhintAlso in New York.

A framework to enhance security

IEEE 2933 was released in September, covering insurance methods Electronic health recordsElectronic Medical recordsAnd in the hospital and Services that can be worn That communicate with each other and with others health care Systems. Tippss is a framework that addresses the various security aspects of devices and systems.

“If you choose to plant Medical deviceYou can kill a person immediately. “Some cultivated devices can be penetrated, for example, 15 meters from the user,” Hudson says. “From discussions with various health care providers over the years, this standard is late.”

Help more than 300 people from 32 countries develop IEEE 2933 standard. The working group included representatives of healthcare organizations, including Draeger Medical Systemsand Health at Indiana Universityand MedtronicAnd Thermo Fisher Scientific. the FDA Other organizational agencies also participated. In addition, there were representatives from research institutes, including Colombiaand European University Cyprusthe The Jevance Stephen InstituteAnd Kingston University London.

“Since most connected systems use common ingredients outside the shelf, everything can be penetrated now, including medical devices and their networks.”

I received the work group IEEE Emerging Standards Association Award Last year for her efforts.

IEEE 2933 before IEEE engineering in medicine and biology Because Hudson says: “It is the engineers who should worry about the methods of protecting equipment.”

She says the standard is dedicated to the entire healthcare industry, including manufacturers of medical devices; Devices and programs and Fixed programs Developers; Patient; Welfare providers and organizational agencies.

Six security measures to reduce electronic threats

Hudson says that security in the design of fixed devices, programs and programs should be the first step in the development process. This is where Tippss come.

It provides a framework that includes technical recommendations and best practices for Related health She says, “Care, devices and human beings.”

Tippss focuses on the six areas of securing devices and systems covered by standards.

• Trust. Create reliable and confident communications between devices. Allow only for devices, people and services for access.
• identity. Make sure to determine the devices and users properly and authenticated. Check the identity of people, services and things.
• privacy. Protecting sensitive patient data from unauthorized access.
• protection. Implement measures to protect devices from cybersecurity and protect them and their users from material, digital, financial and reputation harm.
• safety. Ensure that the devices work safely and do not pose patients with patients.
• protection. Maintaining the general safety of the device, data and patients.

Tippss includes technical recommendations such as multiple factors Ratification; Encryption On levels of hardware, programs and programs; Hudson says that data encryption at rest or in movement.

in Insulin The pump, for example, the data in REST is when the pump collects information about the patient Glucose level. Data in the movement is transferred to the operator, which controls the amount of insulin that must be presented and when it continues in the doctor’s system, and in the end it is inserted into the patient’s electronic records.

“The frame includes all these different pieces and processes to maintain safeguards, devices, and humans are safer,” Hudson says.

Four cases of use

Four scenarios are included in the standard that determines the steps that users will take from the standard to ensure that the medical equipment they interact with is worthy of trust in multiple environments. Includes use cases a Continuous glucose screen (CGM), AIID ISIS, Hospital, House and Hospital scenarios. They include devices that travel with the patient, such as CGM and relief systems, as well as the devices that the patient uses at home, as well as PartiesOxygen sensors, heart screens, and other tools that should be connected to the hospital environment.

The standard is available for purchase from IEEE and first (UL2933: 2024).

Videos on demand for cybers security Tippss

IEEE held a series of Tippss Framework, now available upon request. And include IEEE CYBERSECURITY TIPPSS Industry and IOTS insurance to monitor the topic from a distance in clinical trials. There are also videos on request about protecting healthcare systems, including Cyber ​​security workshop for international health careand Data and device identity, health verification, and intercourse in connected health careAnd Privacy, ethics and confidence in connected health care.

IEEE SA Provides matching tool, Cyber ​​Security Certificate for IEEE Medical Devices. The direct evaluation process contains a clear definition of the range and test requirements for medical devices for evaluation IEEE 2621 The test plan, which helps to manage weaknesses in cybersecurity in medical devices.