Keeping hackers out of hospitals

The humble infusion pump: It stands sentinel in the hospital room, injecting patients with measured doses of drugs and writing information to their electronic medical records.

But what if hackers and identity thieves could hijack a pump on a hospital's information network and use it to eavesdrop on sensitive data like patient identity and billing data for the entire hospital?

It is not a far-fetched scenario. Though it hasn't happened yet, the hacking of wireless infusion pumps is considered a critical cybersecurity vulnerability in hospitals — so much so that federal authorities are focusing on the pumps as part of a wide-ranging effort to develop guidelines to prevent cyberattacks against ­medical devices.

Pumps with Wi-Fi were selected to kick off the new effort because their individual vulnerabilities are magnified by their sheer numbers inside hospitals and clinics.

"Infusion pumps are ubiquitous. At Allina, we have over 3,000 infusion pumps across the system," said Linda Zdon, director of information security and compliance at the 12-hospital Twin Cities health system. "Almost every hospital patient at some point has an infusion pump. So it certainly strikes at an area that has a broad application for most patients, and therefore has a significant impact on health systems."

Allina is one of several local health care players that has been working with the National Institute of Standards and Technology (NIST) since the spring to develop a type of technical analysis known as a "use case" for wireless pumps. The companies' goal is to speed along the development of new standards to harden medical devices against cyberattacks and computer viruses.

Devicemakers say they're already hard at work improving security, but hospitals complain that the ­companies have been moving too slowly on a vulnerability that puts hospitals' information systems at risk.

Patients tend to fear a malicious person would try to steal data or even scramble the dosing instructions for an individual pump. While those risks are real, security experts say they're far less likely than a hack to gain access to a hospital's wider network traffic. For one thing, attacking an individual through their pump would draw attention and close off what could be a potentially lucrative entry point to many patients' data.

Minnesota companies like Allina, Fairview Health Services and HealthPartners are playing a central role in the development of the new federal guidelines through early collaboration with researchers. The NIST project was unveiled earlier this month in a presentation before the University of Minnesota's Technological Leadership Institute. NIST hopes to publish this first set of recommendations as soon as next fall, and then move on to security vulnerabilities in implantable medical devices and large equipment like magnetic-resonance imaging scanners.

Cyber-vulnerabilities are a top-of-mind concern in health care these days. In July, the 200-hospital Community Health Systems revealed in securities filings that a group from China hacked its files and stole information including names, addresses, birth dates and Social Security numbers for about 4.5 million patients. Company officials haven't said how the hackers got into the system.

Recent headlines have been dominated by the international intrigue surrounding the massive hack at Sony Pictures Entertainment, but several people at the NIST meeting in Minneapolis this month compared hospitals' infusion pump vulnerability to what happened at Target Corp. Last year hackers accessed personal data on more than 70 million customers after breaching the retailer's computer system through a digital side-door created for a heating, ventilating and air-conditioning (HVAC) contractor. The retailer's sales immediately slumped and its CEO resigned a few months after the company revealed the breach.

"The infusion pump is to the hospital what the HVAC system was to Target. That is, it becomes the vector to get in," said Ken Hoyme, a computer-security scientist at Minneapolis' Adventium Labs.

Although it's a common fear that talking openly about cybersecurity vulnerabilities will give hackers ideas, experts note that attackers would still need an extraordinary amount of skill and access to a device to pull off an attack.

Gavin O'Brien, one of the lead authors of the NIST report, said public discussion will cause consumers of health-information technology to become better-informed and start demanding more security features.

"Educating enterprises on how to improve their security will benefit the industry," O'Brien said in an e-mail. "To ignore these issues or just talk about them in small circles may not be enough to push the market into building the security into the products."

The FDA — working independently from the NIST study — has been concerned with infusion pumps since it launched a 2010 review of software defects and related issues in response to 56,000 reports of adverse events.

Separately, the FDA last fall convened its first-ever cybersecurity conference for medical devices, including infusion-pump makers. That work is ongoing. Following the FDA meeting, Reuters reported that Homeland Security officials have opened investigations into suspected cybersecurity flaws in medical devices, including an infusion pump sold by Chicago-based supplier Hospira.

It remains to be seen whether the news about hacks at Sony and Target or the NIST will spur more rapid action by devicemakers. But it if doesn't, the companies won't be able to say they weren't warned.

After the Sony hack, Homeland Security Secretary Jeh Johnson issued a statement saying, "This event underscores the importance of good cybersecurity practices to rapidly detect cyber intrusions and promote resilience throughout all of our networks. Every CEO should take this opportunity to assess their company's cybersecurity."

Joe Carlson • 612-673-4779