If you caught Monday’s Morning Read, you know that the Food and Drug Administration on Friday issued an alert warning that Hospira’s Symbiq Infusion System smart pumps could be vulnerable to hackers.
According to the FDA:
Hospira and an independent researcher confirmed that Hospira’s Symbiq Infusion System could be accessed remotely through a hospital’s network. This could allow an unauthorized user to control the device and change the dosage the pump delivers, which could lead to over- or under-infusion of critical patient therapies.
With the Rise of AI, What IP Disputes in Healthcare Are Likely to Emerge?
Munck Wilson Mandala Partner Greg Howison shared his perspective on some of the legal ramifications around AI, IP, connected devices and the data they generate, in response to emailed questions.
While the FDA said that neither it nor device-maker Hospira, which Pfizer is in the process of acquiring, was aware of any actual cyberattacks or adverse health events related to this risk, the regulatory agency said that should stop using the devices as soon as possible.
Hospira said in 2013 that it would phase out the Symbiq device in favor of the more modern Plum A+ infusion pump.
The FDA action is not an outright order or ban, but a strong recommendation. The FDA did offer stopgap technical suggestions for addressing the potential security hole, but not a permanent fix.
The first step users should take, the FDA said, is to disconnect Symbiq infusion pumps from their networks. This carries its own risks, the alert said:
A Personalized Approach to Medication Nonadherence
At the Abarca Forward conference earlier this year, George Van Antwerp, managing director at Deloitte, discussed how social determinants of health and a personalized member experience can improve medication adherence and health outcomes.
Disconnecting the affected product from the network will have operational impacts. Disconnecting the device will require drug libraries to be updated manually. Manual updates to each pump can be labor intensive and prone to entry error.
Experts in the field of IT security see this as a wider issue than just a flawed line of medical devices. It speaks to concerns about the Internet of Things, as this is the first time the FDA has ever suggested healthcare providers stop using a product due to a cybersecurity vulnerability.
Jeff Brandt of Accenture offered this:
Time to set it up, IoT is beyond IT, a new way of thinking Cybersecurity Vulnerabilities of Hospira Symbiq Infusion System: FDA…
— jeffbrandt (@jeffbrandt) August 3, 2015
Victor Ake, co-founder and vice president of customer innovation of San Francisco-based identity management company ForgeRock, provided a long statement to the media.
This is another example of how in the IoT world, companies still are failing to see the importance of identity and access management (IAM) as part of security. IAM is everywhere. The concept of private networks is non-existent, a network per definition equals to “being exposed.”
If in a situation like this we add contextual authentication and authorization, then hacking these systems becomes more difficult. For example adding presence, geo-location and or persistent authentication. It would also be helpful to be able to define what resources are valid, and under what conditions. For example, even when there can be many library services available in a hospital, only some of them can service a pump, depending on the conditions, like types of libraries depending on the model, the prescription and the human user that has the pump connected.
This is yet another example of an industry that needs the help of identity and access nanagement experts to get in the area of IT platforms, because at the end of the day, a pump or, in general, health devices, is now also an IT platform.
A “thing,” a human and a service have identities. They need to authenticate in every relationship they keep and relationships need to be validated. First we need to be sure that the parties in the system are authentic, i.e., not cloned hardware, and then we need a mutual authentication process. The pump in this case is talking to a service endpoint without verifying the authenticity and without doing a mutual authentication. IAM is everywhere and not constrained to a human identity. This is a good example where we see relationships between humans, devices and things — a scenario we see more and more often.
