por
Lauren Dubinsky, Senior Reporter | April 02, 2021
From the April 2021 issue of HealthCare Business News magazine
It’s important for clinical engineers and biomedical teams to assess their medical device security program and select a risk management solution for their connected devices. But what’s the best way to go about that?
An integrated delivery network, software solution provider, and service provider discussed this topic during the AAMI Summer Learning Series. Cory Brennan, attorney and security adviser at Hall Render Advisory Services, started things off by describing an ideal risk management program.
A risk management program should provide: An active, up-to-date inventory of all connected devices and a vast amount of attributes for each of those devices, including their specific risk profiles; vulnerability and risk prioritization, which includes identifying all active vulnerabilities affecting a connect device and analyzing how those vulnerabilities could be exploited and what the impact of that is; the means to contain and segment a device on the network to isolate it from other devices if its risk profile requires it; consistent anomaly and event detection, as well as continuous intrusion monitoring; communication to the health system to notify the right team when anomalous behavior has been discovered on the network or from a medical device, analyze the risk factors of that anomalous behavior, and provide risk mitigation options right off the bat; assistance with recovery measures after responding to an event or an incident, as well as identifying areas of opportunity for improvement in response time and communication protocols.
“After a program assessment has been completed and the results have been reviewed including any gaps identified, the health system should begin to remediate those gaps and to incorporate security best practices into their overall medical device management program,” said Brennan.
You can then use that program assessment to assemble a team and develop a set of use case criteria to evaluate and select a risk management solution. This involved assembling a team of diverse experts, reviewing proposals from a variety of vendors, doing demonstrations, performing a final evaluation internally and then awarding a contract.
