The integration of digital health services into the traditional healthcare system has ushered in numerous benefits for healthcare providers, systems and patients. These technological advances improve the speed, quality and accessibility of care, and help to address the shortage of healthcare workers and resources. However, with the rise of interconnected medical devices and telehealth services, the number of cyberattacks targeting the healthcare industry has also experienced a worrying surge.
According to reports from the US Department of Health and Human Services Office of Civil Rights, breaches of unsecured protected health information have affected over 42.7 million individuals in the US so far in 2023. This is up 50% from the same period in 2022 (28.4 million) and already surpasses the total number of individuals affected for all of 2021 (39.9 million). Although the number of reported cybersecurity breach events in 2023 has slightly declined to 338 breaches from 390 breaches in the same period in 2022, the staggering increase in affected individuals suggests that hackers are targeting larger networks, necessitating heightened vigilance and security measures.
Hackers attempt to exploit various entry points, ranging from physical medical devices both inside and outside of medical facilities to gaining unauthorised access to networks from any connected device, medical or otherwise. The implications of such attacks can be far-reaching, affecting patient privacy, interrupting healthcare services and jeopardising the safety and effectiveness of medical devices. GlobalData’s technology sentiment poll in Q2 2023 further substantiates these concerns, revealing that 41% of participants expect cybersecurity to be a significant disruptor to the healthcare industry.
To address the mounting cybersecurity risks, the FDA introduced new guidelines for medical device manufacturers in March 2023. These guidelines require manufacturers to submit a plan to monitor, identify and address post-market cybersecurity vulnerabilities when applying for new pre-market authorisations. This aims to enforce a minimum level of security for the entire lifespan of new devices.
Recent cybersecurity vulnerabilities in prominent companies such as Medtronic (Paceart Optima cardiac device data workflow system) and Becton Dickinson (Alaris infusion pump system) show that routine testing to identify and address weaknesses before they can be exploited are essential to securing medical devices. Despite the improvements in guidelines for new devices, the healthcare industry must remain vigilant in addressing vulnerabilities in existing systems.
For example, older devices may lack critical security patches, run outdated or unsupported operating systems or have limited compatibility with modern cybersecurity solutions. Additionally, networks involving medical devices (and often personal devices such as computers and mobile devices) are susceptible to weaknesses in firewall configurations, unsecured connections, insufficient passwords, poor authentication protocols and outdated software.
To further fortify the industry’s cybersecurity defences, technologies such as blockchain, zero-trust architecture and cloud security could become powerful tools in healthcare. Blockchain helps to decentralise operations and secure the storage of sensitive healthcare information, while zero-trust architecture continuously verifies user identity and device trustworthiness before granting access to critical data and systems. Cloud security can also be used to proactively monitor and respond to potential threats effectively.
As the healthcare sector progresses towards a more interconnected landscape, collaboration with cybersecurity experts, adopting robust security practices and continuous investment in advanced cybersecurity measures will be essential to stay ahead of emerging threats. New technologies and regulations will be vital to safeguard patient information and ensure continuous, safe and secure care.
