Cybersecurity Focus: Medical Devices

In the last year we have seen the world ravaged by COVID 19 killing well over 2 Million people.  Modern medical solutions have been stretched to their breaking point nearly everywhere during the pandemic.  Something which has helped those on the medical front lines is technology.  Tele-medicine has allowed millions to converse with their doctor via a video call thus reducing risk for all the patients as well as health care providers. Digital prescriptions allow the doctor to directly contact a pharmacy so the patient can just walk in or drive up to and receive their prescription once again reducing COVID risk. The new frontier in medicine is technology.

Today I’ll speak to the connected medical world in which we live and potential risks that you can try to mitigate with planning and vigilance.  In many articles I have written I have spoken about Internet of Things (IoT), which are all those connected devices in your household.  They make life so much simpler and easier but there are risks, but you can mitigate risk with your connected household devices. See my article on Home cybersecurity risks here: https://ericcrichardson.com/2021/01/28/home-the-cybersecurity-dangers-within/amp/

Just like in home devices we have a class of connected devices which can help you manage your medical needs; these are called the Internet of Medical Things (IoMT). These range from more simple devices like pedometers (step trackers) to sports bands or watches up to much more complex devise which could monitor something like fall detection devices. The more complicated devices will generally need FDA approval in the US or other similar organizations in different countries such as Health Canada.  The good news is the federal agencies such as the FDA/Health Canada/Ministry of Health all are evolving and increasing their guidance on cybersecurity before a device even launches and then after it launches.

But there are always things which can be improved. Think about devices you may have in the home that serve medical purposes which a Doctor can read data on and possibly make updates. Things like implantable hart pacemakers or external insulin pumps come to mind. Some of these devices have Bluetooth connections which then communicates with a smartphone and then back to the doctor.  Some devices like CPAP machines use 3G technology to wirelessly connect to a mobile phone network to send data, these can also have Bluetooth connections to allow for configuring. 

Any time you have a connection you have risk, that is what you need to remember.  There have been documented cases of devices being hacked, just do a web search for “Insulin Pump Hack” and you will read about guidance from the US FDA on risks.  The risk is not super high but it’s very real.  If you have a concern the best way of course is to stay at home- why? Bluetooth only has a 30 foot/10 Meter range.

If you are overly concerned and must travel, there are some things you can do–you can purchase “RFID Blocking” clothing, to protect any implantable devices. these garments are designed to stop reading of RFID chips (Radio-frequency Identification) which is a technology to track tags which is a cheap sticker with a special metal on one side forming a small radio transponder. When you check into a hotel often the keycard you get uses an RFID, it is ‘scanned’ at the door.  Well RFID can be scanned at a longer distance depending on how it is configured so if you have anything with RFDI you can block it with these clothes.  RFID blocking apparel has a metallic material in it to block radio signals- it also means you will not be ab le to connect to whatever device you have implanted while you have the garment on but it’s a tradeoff. You can read about  tips you can consider while traveling being a Cyber Secure Traveler here: https://ericcrichardson.com/2021/01/18/the-cyber-secure-traveler/amp/

I’d recommend taking general IoT safety steps first which should help ensure you are already being safe with your connected devices. With a bit of work and planning you can reduce your risk profile quite a bit.

@ericcrichardson

ericcrichardson@gmail.com

Leave a comment