Managing Cybersecurity Threats

MassMEDIC Webinar Recording

Connecting medical devices to the Internet of Things has far-reaching benefits including improved healthcare delivery and reduced costs to all stakeholders. However, with these benefits, there are risks.

Cybercrime is an increasing threat to the safety of medical devices and the security of patient data. Implementing a robust security plan involves all stakeholders in the Healthcare Ecosystem. Medical device manufacturers must address both safety and data security risks, while hospital IT teams need strategic plans in place to control Personal Health Information and address vulnerabilities of hackers entering their IT system.

Leading off the discussion around safety and privacy, we will hear the story of a significant cyber attack waged by the activist group ‘Anonymous’ on Boston Children’s Hospital. Panelists from the frontlines of Medical Device Development, Cybersecurity Preparedness and Response, and Hospital IT Systems will provide well-informed guidance around the challenges of the complex and evolving threat of cybersecurity within the healthcare ecosystem.

In this interactive forum, attendees will hear: ·

• Lessons learned from a massive cyber attack against Boston Children’s Hospital, including the processes and infrastructure they have in place to ensure patient data privacy and safety
• Expertise in Medical device cybersecurity and preparedness and response
• Initiatives on Threat Based Defense and Cyber Threat Intelligence
• Steps to consider during product development to mitigate cyber security risks

Take Aways:

• The importance of a robust threat assessment & mitigation plan
• Specific actions to take in 3/6/9 months
• What resources are available to help

Discussed Resources:

• Medical Device Defined
• FDA, Pre-market
• FDA, Post Market
• IEC 62304
• IEC 14971 and IEC TR 800021
• National Institute of Standards, NIST 800-30
• Common Vulnerability Scoring System, CVSS
• GDPR- General Data Protection Regulations
• HIPAA-Health Insurance Portability and Accountability Act
• MITRE Corporation
• Digital Health Council
• Cybersecurity Toolkit for Digital Health
• CVSS Rubric for Applying CVSS to Medical Devices
• Medical Device Cybersecurity Regional Incident Response Playbook