News | Cybersecurity | February 27, 2018

Can Your Cardiac Device Be Hacked?

ACC Electrophysiology Council discusses potential dangers and offers advice to patients and physicians

Can Your Cardiac Device Be Hacked?

February 27, 2018 — Medical devices, including cardiovascular implantable electronic devices, could be at risk for hacking. In a paper published online in the Journal of the American College of Cardiology, the American College of Cardiology’s Electrophysiology Council examines the potential risk to patients and outlines how to improve cybersecurity in these devices.

Cybersecurity in the medical field refers to the integration of medical devices, computer networks and software. While there have been no actual clinical reports of malicious or inadvertent hacking or malware attacks affecting cardiac devices, recent reports have discovered this possibility. Reasons for hacking include political, financial, social and personal motives. Devices can be hacked locally or remotely. The U.S. Food and Drug Administration (FDA) has issued both pre-market and post-market guidance for the security of medical devices, and legislative proposals related to medical device security have been advanced in the U.S. Congress.

“True cybersecurity begins at the point of designing protected software from the outset, and requires the integration of multiple stakeholders, including software experts, security experts and medical advisors,” said Dhanunjaya R. Lakkireddy, M.D., professor of medicine at the University of Kansas Hospital, a member of the Electrophysiology Council and the corresponding author of the paper.

Medical devices have been targets of hacking for over a decade. The increasing number of medical devices using software has created the need to protect devices from intentional harmful interference on their normal functioning. Advanced wireless communications between healthcare providers and patients’ devices have created the theoretical possibility for the deactivation of features, the alteration of programming, and the delaying, interfering or interrupting of communications.

There are a number of possible clinical consequences that may result from the hacking of a cardiac device. In patients with pacemakers, concerns mostly consist of oversensing or battery depletion. For patients with implantable cardioverter-defibrillators (ICDs), it is possible for hackers to interrupt wireless communications, inhibiting the value of telemonitoring and allowing any clinically relevant events to go undetected by the system. Oversensing may inhibit pacing or result in inappropriate or life-threatening shocks. Battery depletion can lead to a device being unable to deliver therapies during life-threatening arrhythmias.

“At this time, there is no evidence that one can reprogram a cardiovascular implantable electronic device or change device settings in any form,” Lakkireddy said. “The likelihood of an individual hacker successfully affecting a cardiovascular implantable electronic device or being able to target a specific patient is very low. A more likely scenario is that of a malware or ransomware attack affecting a hospital network and inhibiting communication.”

The council said that cybersecurity needs should also be addressed during product testing both pre- and post-market. Because cybervulnerabilities can emerge quickly, strong post-market processes must be in place to monitor the environment for new vulnerabilities and to respond in a timely manner. The council suggests that firmware may be useful in devices with possible vulnerabilities. Physicians who manage cardiac devices should be aware of both documented and possible cybersecurity risks. Systems should be established to communicate updates in these areas quickly and in an understandable way to the rest of the clinical team that manage patients with devices.

The council members said they do not feel that enhanced monitoring or elective device replacement is necessary at this time.

“Given the lack of evidence that hacking of cardiac devices is a relevant clinical problem, coupled with evidence of the benefits of remote monitoring, one should exercise caution in depriving a patient of the clear benefit of remote monitoring,” Lakkireddy said.

For more information: www.onlinejacc.org

Related Cybersecurity Content

Raising the Bar for Medical Device Cyber Security

The State of Healthcare Cyber Security

FDA Seeks Management of Cybersecurity in Medical Devices

Cybersecurity Threats in Medical Imaging

 

Related Content

FDA and DHS Expand Partnership on Medical Device Cybersecurity
News | Cybersecurity | October 30, 2018
The U.S. Food and Drug Administration (FDA) and the U.S. Department of Homeland Security (DHS) will be implementing a...
Medtronic is issuing a software update to address a safety risk caused by cybersecurity vulnerabilities associated with the internet connection between the Carelink 2090 and Carelink Encore 29901 programmers used to download software from the Medtronic software distribution network (SDN) . This update is a voluntary recall correction by the manufacturer to address the safety risk caused by the cybersecurity vulnerability.

Medtronic is issuing a software update to address a safety risk caused by cybersecurity vulnerabilities associated with the internet connection between the Carelink 2090 and Carelink Encore 29901 implantable EP device programmers.

Feature | Cybersecurity | October 17, 2018
October 17, 2018 — The U.S.
Philips Warns of Cybersecurity Vulnerabilities in IntelliSpace and iSite PACS Products
News | Cybersecurity | April 16, 2018 | Jeff Zagoudis, Associate Editor
Philips Healthcare last week issued a proactive advisory warning to its iSite and IntelliSpace picture archiving and...
MDISS Launches 'WHISTL' Network of Medical Device Security Testing Labs
News | Cybersecurity | August 23, 2017
The Medical Device Innovation, Safety and Security Consortium (MDISS) recently launched the first of more than a dozen...
HHS Unveils Improved Web Tool to Highlight Recent Health Information Breaches
News | Cybersecurity | August 21, 2017
The U.S. Department of Health and Human Services (HHS), Office for Civil Rights (OCR) recently launched a revised web...
Healthcare cybersecurity concerns have increased dramatically as EMRs and medical devices become more digitally connected.

Healthcare cybersecurity concerns have increased dramatically as EMRs and medical devices become more digitally connected.

Feature | Cybersecurity | August 18, 2017 | Dave Fornell
August 17, 2017 — Cybersecurity has become a growing concern in healthcare as patient data, medical systems and impla
The FDA is concerned about cybersecurity of ICDs and cyber security of other medical devices.
Feature | Cybersecurity | August 16, 2017 | Dave Fornell
There is growing concern among patients and regulators that medical devices, especially implantable electrophysiology
Logicalis Healthcare Solutions lists the top cybersecurity issues for CIOs at HIMSS17.
News | Cybersecurity | February 10, 2017
February 10, 2017 — With the Healthcare Information and Management Systems Society’s annual meeting (HIMSS17) schedul
The FDA wants to regulate cybersecurity of ICDs and other medical devices.

The FDA has concerns about the cybersecurity of implantable medical devices with wireless connections for patient monitoring or adjustments to how the device functions. Changing the function of an implantable cardioverter defibrillator (ICD) using wireless access to the device could present a major patient safety issue.

News | Cybersecurity | December 29, 2016 | Dave Fornell
As wearable and implantable patient monitoring or therapy devices become more sophisticated with advanced wireless co
Overlay Init