Medical Device Cyber Risk: An Enterprise Problem

Medical device cybersecurity risks should be viewed as an enterprise problem, say Tracey Hughes of Duke University Health Systems and Clyde Hewitt of security consultancy CynergisTek, who outline critical security steps.

Hughes and Hewitt will offer a Feb. 14 presentation on biomedical device cybersecurity practices at the HIMSS19 conference in Orlando, Florida.

“The very first thing [healthcare entities] miss is addressing biomedical device risk as an enterprise problem,” Hewitt says in an interview with Information Security Media Group. “Many organizations have outsourced their biomedical devices management to third parties, and they end up treating these devices as physical assets to be tracked though the financial system, but they don’t necessarily treat them as information technology assets that need to be looked at as a threat to the network and the environment.”

As a result, many entities often miss assessing whether these devices can be compromised, affecting patient safety, he says.