By Kayla Matthews, HealthIT writer and technology enthusiast, Tech Blog
Twitter: @ProductiBytes
Any time a medical professional works with patient information, they must carefully follow HIPAA regulations and standards, including those that protect patient data. Medical devices — which can store, analyze and transmit patient data — often need to be specially designed to be HIPAA compliant. Staying compliant with HIPAA, however, can be complicated.
As we become more connected, transferring data from network to network is becoming easier and easier. While this accessibility can make medical devices more effective than ever, it can also pose significant challenges for medical device manufacturers needing to stay obedient.
Here is what healthcare professionals need to know about medical devices and HIPAA compliance.
Designing Medical Devices for HIPAA Compliance
The Health Insurance Portability and Accountability Act (HIPAA) defined a privacy rule regarding how medical professionals can store and handle protected health information (PHI) — personally identifiable information like social security numbers, names, addresses and demographic data. The HIPAA privacy rules also apply to medical devices, and their manufacturers must follow HIPAA compliance — otherwise, companies risk fines or more severe punishments.
Only the medical devices that transmit, receive or record health information need to be HIPAA compliant. In these cases, equipment must protect patient information — even if that information should, theoretically, only be available to the doctor or medical professional who prescribed the device.
Today, medical devices must be designed to handle information in a way that ensures data is only flowing from the patient to authorized parties — and, if a device is receiving information, it can only do so with the patient’s consent.
This is on top of the other strict regulations that medical devices can be subject to — like FDA compliance and high levels of quality assurance, among other things.
HIPAA compliance can be difficult enough and requires careful design to ensure only authorized parties can access patient information. However, the rise of cybercrime has presented a new problem for medical device manufacturers — how to keep data protected when hackers are trying to break into medical devices.
Cybersecurity and Data Privacy
The health data and personally identifying data that medical devices transfer could be valuable to cybercriminals and can even be intercepted if not properly encrypted. Most hackers will likely be after the large stores of personal information in medical record systems that they can use for crimes like identity theft.
Hackers break into secured networks by exploiting the weakest component of that network’s security — often, unsecured devices with network access. If medical devices communicate with an electronic health record system, this information could be at risk if someone compromises the device. This breach would expose the information of the patient who owns the device — as well as potentially all patients with information stored in the system.
These attacks certainly wouldn’t be the first time medical providers have fallen victim to cybercrime. In 2019 alone, more than 35 million individuals had their records compromised, stolen or otherwise accessed by unauthorized parties. The healthcare industry is a serious target for cybercrime, and the proliferation of insecure medical devices could provide a new avenue of attack for hackers and other cybercriminals.
Medical device designers will need to implement security protocols that defend their designs against attacks and also encrypt incoming and outgoing data to protect it from hackers.
Improperly shielding medical devices from cyberattacks also presents risks beyond falling out of compliance.
Pacemakers are one of the most famous examples of devices that could seriously harm patients if compromised by hackers. In 2007, Vice President Dick Cheney had the wireless function of his pacemaker disabled because doctors feared terrorists might hack into the device and render it inoperable.
Hackers could attack other devices that directly administer medicine or treatments in the same way. Some might even hold these devices hostage with ransomware that asks patients for money and threatens them with device failure if they refuse to pay.
Designing HIPAA-Compliant Medical Devices
Medical devices need to be HIPAA compliant, which can pose a serious challenge for manufacturers — especially as cybercrime becomes more common.
In the future, devices will need to withstand cyberattacks and encrypt personally identifying information. Otherwise, designers may risk falling out of compliance and risking patient info — or worse, if devices that administer medical treatment are compromised.