Question

Networked Medical Devices:

a. Which medical devices need to be networked?

b. Discuss all of the technologies involved in networked medical devices.

c. Discuss the cyber security concerns with networked medical devices.

d. Discuss the levels of process maturity with respect to networked medical devices. explain in details of all above.

Answer 1

ANS.(a)

A networked medical device includes any device that has the capability of connecting to the Internet, which are generally separated into four groups:

1. Consumer health monitoring (e.g., FitBit)
2. Wearable (e.g., portable insulin pumps)
3. Embedded (e.g., pacemakers)
4. Stationary (e.g., chemotherapy dispensing stations)

   Stationary devices are targeted

   Although it’s scary to think about internally embedded medical devices hacked and altered, the large majority of hackers aren’t terrorists, they’re thieves. They want to make money by stealing mass amounts of patient data, and that’s why stationary devices are the group most at risk from cybercriminals.

1. Homecare cardio-monitoring
2. MRI machine
3. Bedside infusion pump
4. Anesthesia apparatuses
5. Medical ventilators
6. LASIK surgical machines
7. CT scanners
8. Picture archiving and communication system
9. Blood gas analyzer
10. Dialysis machines

    ANS.(b) IoMT technology enables virtually any medical device to collect, analyse, and send data across the Web. Not only can digital devices, such as heart monitors, be connected to the Internet, but so can non-digital items like hospital beds and pills.

    Yes, pills. But more on that in a moment.

    Essentially, IoMT lets medical equipment and healthcare products share data in real time, and with everyone who has a legitimate need for the information. Here is a breakdown of where IoMT is finding applications.

    IoMT Technology

    IoMT is built upon a number of technologies, including advanced sensors, IoT connectivity, and artificial Intelligence (AI). Let’s take a brief look at each to see how they work.

    Medical Sensors

    The decreasing cost of sensor technology has empowered IoMT device manufacturers to build economical connected healthcare products.

    Biosensors make up a healthy chunk of the IoMT product marketplace, with market revenue expected to exceed $29 billion by 2024. These advanced devices rely on a biological material and sensor to detect characteristics of blood, respiration, tissue, and other parts of the body.

    Non-biological medical sensors can measure body temperature, motion, electrical activity of the heart and muscles, and other patient characteristics.

    IoT Connectivity

    Sensing a patient’s health factors is only part of IoMT. For the data to be useful, it must be accessible by computers and people.

    IoMT manufacturers use a vast array of communications protocols to get IoMT data from point A to point B. However, they all accomplish the same objective — getting the IoMT data onto the Internet. Once there, any authorized person or computer can access the data and use it to help provide care for the patient.

ANS.(c)

All legally-marketed medical devices have benefits and risks. The FDA allows devices to be marketed when there is a reasonable assurance that the benefits to patients outweigh the risks.

Medical devices are increasingly connected to the Internet, hospital networks, and other medical devices to provide features that improve health care and increase the ability of health care providers to treat patients. These same features also increase the risk of potential cybersecurity threats. Medical devices, like other computer systems, can be vulnerable to security breaches, potentially impacting the safety and effectiveness of the device.

Threats and vulnerabilities cannot be eliminated, therefore, reducing cybersecurity risks is especially challenging. The heath care environment is complex, and manufacturers, hospitals, and facilities must work together to manage cybersecurity risks.

Medical device manufacturers (MDMs) and health care delivery organizations (HDOs) should take steps to ensure appropriate safeguards are in place.

• Medical device manufacturers (MDMs) are responsible for remaining vigilant about identifying risks and hazards associated with their medical devices, including risks related to cybersecurity.
• Health care delivery organizations (HDOs) should evaluate their network security and protect their hospital systems.
• Both MDMs and HDOs are responsible for putting appropriate mitigations in place to address patient safety risks and ensure proper device performance.

ANS.(D)Maturity of practices, operations and infrastructure in the healthcare domain is of high importance. However, these qualities often vary among healthcare provider units (e.g., hospitals) and in some cases could be far from perfect. Establishing process thinking and achieving quality management is vital to assure service maturity, and to continually improve service maturity in such a complex, dynamic, and multidisciplinary domain.

levels of maturity

Level 0 – Person-Dependent Practices: This is for cases where the activity being performed is not documented. In other words, it is not recorded either in outline or in detail. The activity is entirely person dependent and the sequence, timing and result may vary during repetition. This requires a lot of supervision. There is no guarantee of either achieving the desired result or adhering to timelines. The activity is entirely ad hoc, with little communication between functions. The effectiveness of the activity is entirely dependent on individuals. Knowledge transfer may or may not happen if there is any change in the owner of the activity.

Level 1 – Documented Process: At this maturity level, there is a document that has been reviewed and approved by the supervisor or the approving authority as the standard process. But it may be doubtful that the activity being performed is as per the document. This is may be because of a process drift or some drastic change since the document was drafted.

Level 2 – Partial Deployment: Here, the activity that is documented is being deployed, but there is inconsistency in the deployment. The process may not be deployed in totality. That is, it may not be deployed at all the intended locations, or though all functions, or by all the intended owners, or all the activities defined in the process are not being performed. This would mean that the document has not been designed to cater to such variations. There is inconsistency in results of different process owners.

Level 3 – Full Deployment: At this level, there is no inconsistency between the documented process and the deployed process. The process documented and deployed caters to all the intended locations, owners and all the activities that need to be performed. The process also shows seamless linkage between functions and other processes wherever there needs to be any interaction. This means that the process shows greater consistency of actions and better communication between functions.

Level 4 – Measured and Automated: The process has set itself goals such as adherence to timelines, customer satisfaction, cost, etc. The process also is being measured against its goals. The process is system-driven by enablers such as using enterprise resource planning or customer resource management or any other custom-made software.

Level 5 – Continuously Improving: The goals set for the process are being analyzed for achievements and improved regularly. The timelines, cost targets, satisfaction levels are being achieved regularly and the targets also are being tightened by using continuous quality improvement techniques such as Six Sigma, Kaizan, etc. The enabling system also is being improved and being made error-free by strategies such as poka-yoke