Medical devices vulnerable to hackers, new report says

In an episode of the television series "Homeland," a terrorist organization assassinates the vice president of the United States by wirelessly hacking into his pacemaker. Although the scenario was fictional, the underlying premise is not.

Life-saving medical devices abound in today's world, and many of these devices are connected wirelessly to hospital networks, making them vulnerable to cyberattacks. For example, a malicious person could hack into a pacemaker, causing the device to apply lethal electrical stimulation, or an insulin pump, causing it to deliver a deadly dose of the hormone.

"Just like any other piece of Internet technology, medical devices are susceptible to the same cyberthreats you hear about all the time on the news," said Russel Jones, a partner at the consulting firm Deloitte, which released a report on Sept. 23 on the subject of cybersecurity in medical devices.

As more and more medical devices go online, device manufacturers and health care organizations will need to address security issues to keep patients and their health information safe. [Image Gallery: The BioDigital Human]

So far, there have been no known incidents of a hacked medical device injuring or killing a person, but researchers have demonstrated that these events are possible "with the right level of skill and understanding," Jones said.

In the Deloitte study, consultants interviewed representatives from nine health care organizations, in areas spanning from information technology to clinical engineering. The participants answered questions about the regulation, risk management and security of networked medical devices.

The majority of organizations surveyed felt their organizations had strategies and frameworks for managing cybersecurity risks. However, there were differences in the degree of preparedness and approaches for handling cyberthreats.

One way to protect information sent to or from a medical device is to encrypt it. The problem is, encryption takes up valuable processing time on the device. The challenge, Jones said, is to develop encryption that addresses cyberrisk without impacting the functionality of the device.

In June, the U.S. Food and Drug Administration (FDA) released draft guidance for cybersecurity concerns. The FDA's previous guidance from 2005 was pretty vague, but the new draft lays out specific concerns that must be addressed when applying for FDA approval for new devices.

Ensuring cybersecurity in medical devices will require collaboration, Jones said. "This is going to be a problem that's jointly solved by health care systems, providers, device manufacturers and the FDA," he said.

Fox News Health