May 6, 2024

Expert Q&A: Managing Cybersecurity Challenges in Healthcare

This Q&A addresses key concerns regarding healthcare cybersecurity challenges, including AI, medical device security, budget-friendly strategies, and organizational engagement. It is an excerpt from a Cybersecurity Insider Program webinar. Experts represented included a Director of Security Operations (CloudWave), a former CIO and Cybersecurity Risk Consultant, and the CIO of Lake Regional Health System.

Question: What is the best way to manage some of the challenges AI brings to medical devices?

Expert Panel Response: Dealing with the challenges posed by AI in healthcare will be an ongoing and evolutionary process that requires a multifaceted approach. AI undoubtedly adds another layer of complexity in securing medical devices, especially considering that they now communicate with EHRs just as other systems and servers do.

As AI technology continues to evolve and be incorporated into an increasing number of advanced devices, organizations must adapt their security strategies to stay ahead of potential threats across the board. Failure to do so could result in data breaches, compromised patient safety, and regulatory non-compliance.

As an industry, we need to constantly strategize and remain vigilant to stay ahead of potential attacks on AI-enabled medical device systems. There isn’t a single approach that can address all the challenges, but a comprehensive medical device cybersecurity program can help ensure that the right strategies are in place to mitigate the risks. Approaches to consider include:

• Implement Robust Security Measures: Ensure adherence to industry standards for AI systems and medical devices, including encryption, secure communication protocols, and compliance with regulatory requirements.
• Regular Audits and Penetration Testing: Address weaknesses before they are exploited by conducting regularly scheduled audits and penetration testing to proactively identify vulnerabilities in AI-enabled medical devices.
• Ensure Data Integrity: Certify the integrity and quality of the data used to train and operate AI systems. Implement measures to detect and mitigate data poisoning attacks, such as anomaly detection algorithms and data validation processes.
• Protect the Environment: This involves implementing network segmentation, conducting assessments of medical devices before integrating them into the network, and maintaining secure parameters.
• User Education and Training: Educate and train users and developers about potential AI-related threats and attacks. This fosters a security-conscious culture within the organization and empowers individuals to play an active role in maintaining cybersecurity.

The ultimate goal is safeguarding the patient. Considering how AI-enabled medical devices and cybersecurity measures can impact patients is essential.

Question: How can organizations ensure compliance and security with medical devices?

Expert Panel Response: Ensuring compliance and security with medical devices requires proactive measures. For example, to emphasize the importance of cybersecurity in medical device management, it is necessary to build cross-departmental relationships and establish a coalition involving IT, clinical engineering, biomedical, supply chain, compliance, and other relevant departments. Incorporating medical device security into an organization’s overall cybersecurity strategy and governance structure can improve its ability to mitigate potential risks and maintain compliance with regulatory standards.

Furthermore, fostering relationships with medical device vendors is essential to encourage collaboration on cybersecurity initiatives. Hold vendors accountable for complying with security requirements and regulations.

Start implementing best practices around monitoring and protecting. Conduct cybersecurity risk assessments on medical devices to identify vulnerabilities and prioritize security measures. To facilitate effective security management, maintain an accurate medical device asset inventory, including model numbers and software versions. Finally, policies and procedures specific to medical device cybersecurity should be created and implemented, defining roles, responsibilities, access controls, and incident response protocols. You can download the Medical Device Cybersecurity Field Manual to get started on defining your organization’s medical device strategy.

Question: How can organizations prioritize cybersecurity investments when facing budget constraints?

Expert Panel Response: Prioritizing cybersecurity investments requires a strategic approach tailored to the organization’s unique needs and resources. To identify potential areas of investment, it’s crucial to have a clear grasp of the current threat landscape and consider the types of risks and their potential impact on your environment.

Understand the basics and start at that point. Do a full infrastructure assessment to identify cybersecurity gaps and set the strategy and priorities. Consider implementing a cybersecurity maturity model such as the CloudWave Sensato Cybersecurity Capability Maturity Model (C2M2). Utilizing a cybersecurity capability maturity model instead of just a risk assessment allows you to quickly identify cybersecurity gaps, prioritize and allocate resources, and manage business risk. The model can efficiently and effectively produce actionable findings to help create a foundation for strategy and investment.

Develop a comprehensive cybersecurity strategy that outlines priority areas for investment and aligns with long-term business objectives. Consider that implementing the necessary tools may take more than a fiscal year, so concentrate on the tools that address the gaps in your security. Additionally, educate the board and senior leadership team about cybersecurity’s significance and its positive impact on the organization’s operations. Emphasize the potential consequences of cyber threats and why investing in cybersecurity is crucial.

The goal is to have a thorough yet lean cybersecurity program that optimizes each aspect for maximum effectiveness. One way to prioritize cybersecurity investments when facing budget constraints may be to outsource cybersecurity skills to a dedicated partner, as it’s essential to have the capability to monitor systems 24/7 to identify threats and respond rapidly. Furthermore, while tools are important, they provide little value without an internal team or qualified partner to monitor and react appropriately.

Question: How can organizations ensure cybersecurity is understood as a collective responsibility beyond the IT department?

Expert Panel Response: To foster a culture of cybersecurity awareness and accountability throughout the organization, you must promote cross-functional collaboration by encouraging  IT and other departments to work in concert for decision-making processes related to technology procurement, risk management, and incident response. This enhances the collective security of a healthcare organization and empowers each individual, making them feel part of a unified effort.

Including clinicians, nursing staff, and ancillary department heads in cybersecurity discussions is vital to highlight the importance of protecting patient data and operational continuity. Furthermore, senior leadership and the board should receive regular updates and education sessions on cybersecurity risks, mitigation strategies, and the potential impact on organizational objectives.

Emphasize the organizational impact by illustrating the potential consequences of cyber threats on patient care, financial stability, and regulatory compliance, as well as the corresponding need for collective responsibility in cybersecurity. By involving stakeholders from various departments and levels of the organization, enterpises can foster a culture of cybersecurity awareness and collaboration, enhancing overall resilience against cyber threats.

Register here to join the Cybersecurity Insider Program and access the complete webinar recording and get access to future live educational cybersecurity webinars. If you have any additional questions or would like to discuss your cybersecurity strategy with one of our experts, please email customersfirst@gocloudwave.com.