The Hackable Body: How Severe is the Threat?

There never has been a real-world case of medical device hacking. Yet concern is high, and that’s a good thing—proactivity when the stakes are this high certainly is better than reactivity. The medical device industry knows that in an age where wireless devices increasingly are being connected to central information centers, hacking not only is a possibility, but also a real risk. Regulators are paying attention to the issue as well.

On Oct 3. at AdvaMed 2012 The Medtech Conference, a panel discussed the “hackable body” and whether this issue is one in which companies should be paying more attention. Moderating the panel was Arezu Sarvestani, west coast bureau chief of medical device news website MassDevice. Joining her were Dale Nordenberg, M.D., founder of the Medical Device Innovation, Safety and Security Consortium; Lynnette Sherrill, deputy director of the health information security division of the U.S. Department of Veterans Affairs; Brian Fitzgerald, deputy director of the electrical and software engineering division at the U.S. Food and Drug Administration’s (FDA’s) Center for Devices and Radiological Health (CDRH); and Santhosh Nair, general manager of the intelligent systems group at Wind River, a software company now owned by Intel Corporation.

Although there has not been an actual case of medical device hacking, in October 2011 security software company McAfee Inc. revealed it had exposed a weakness in a Medtronic Inc. insulin pump by “ethically hacking” the device (performed specifically to demonstrate it could be done). This incident, and the rise in mobile health products, has prompted a close review of such devices and their security.

Considering the facts, Sarvestani wanted to know the appropriate level of concern that should exist in the industry.

Nordenberg outlined questions device manufacturers should ask themselves; among them are the breadth of a device’s exposure, its potential impact, and the ability to prevent a potential adverse impact.

According to Nordenberg, there are about 1 billion patient encounters with physicians or other medical care professionals annually, both inpatient and outpatient. Those encounters do not include exposure to medical devices—sometimes, a patient receives a X-ray, and other times, as in an emergency room visit or a stint in the intensive care unit, a patient comes into contact with hundreds of devices and pieces of equipment.

“From an epidemiological perspective, if you’re not looking for something, you’re not going to find it,” Nordenger said regarding breaches of device security. “The fact that we haven’t found anything doesn’t mean anything. We haven’t established systematic surveillance for hacking. We don’t have the necessary infrastructure systems to quantify that.”

“From an FDA perspective, it falls into realm of reasonably foreseeable risk,” replied Fitzgerald. “Not long ago, we’d never have thought [hacking] would be intentional.”

Nair highlighted that medical devices primarily are designed to be safe and effective. Unlike technology designed for entertainment, for instance, medical devices specifically are meant to heal or save lives, so safety is a given. The notion of additional “security” does not instinctively come into play. Technology in other industries such as aerospace, which is much more advanced, must undergo constant certification to ensure the security of software and components. “We have a long way to go,” Nair said of medical devices, “but we’re going in the right direction.”

Sherril outlined some of the ways in which enterprise (non-embedded) medical devices and equipment used in veteran care already have successfully manually managed security systems, but Nair pointed out the problem with that: “When you have a secure, manually managed system, there is no incentive to upgrade, and intended use of medical devices gets very outdated very quickly. It causes different kind of problems, and that’s common in any industry—unintended consequences.”

Sherrill agreed. “For years in the energy sector, those devices were isolated like medical devices, not intended to connect to networks. As soon as you do that it opens the door [to vulnerability].”

Sherrill was referring to the cyber-attack on Iran’s nuclear energy plant in 2010. The virtual “worm” reportedly was capable of assuming control of systems at the plant. This is disastrous enough in terms of a nuclear plant, but in terms of medical devices, the direct result could potentially lead to death, or at the very least, an invasion of privacy.

Last year, three senior U.S. House of Representatives Democrats– Rep. Donna F. Edwards (D-Md.), Anna G. Eshoo (D-Calif.), and Edward J. Markey (D-Mass.)—requested a report from the Government Accountability Office (GAO) on wireless medical device security.

The GAO report, “Medical Devices: FDA Should Expand Its Consideration of Information Security for Certain Types of Devices,” released last month, found that both the FDA and medical device manufacturers have responded slowly to this emerging threat. “FDA has not considered information security risks resulting from intentional threats,” the GAO concluded in its report. More specifically, the agency failed to consider “intentional threats” in the pre-market approval and evaluation of two devices that were successfully hacked—an implantable cardiac defibrillator and an insulin pump. The GAO report also noted that the FDA has not utilized available resources from other government agencies such as the National Institute of Standards and Technology, which maintains a federal computer security vulnerability database and provides guidance and standards related to computer security.

Because technology and reactions to it tend to change very quickly, the GAO may not have reported on the most recent actions of the FDA. “We now routinely ask what the manufacturer has done for confidentiality, security, and so on for cleared devices,” Fitzgerald said. “For PMAs [premarket approvals], we ask for that plus a lot more information and technical specifications.” He also said the FDA is developing better procedures for determining appropriate device security, and bringing in employees with the skills and expertise necessary for this new shift in device examination.

Fitzgerald also admitted the FDA’s market surveillance needs to improve: “Currently we have a passive reporting system—the MAUDE [Manufacturer and User Facility Device Experience Database] system relies on certain criteria and triggers to be met, and these clinical outcomes are triggered by keywords. We end up being blind to the field. We have a chunk of the CDRH that actively monitors this passive system, but cyberthreats do not routinely show up—just a handful.”