The Security Risks of Medical Devices

 Beth Israel Deaconess has been outspoken about the risks of malware on FDA 510k approved medical devices such as radiology workstations, echocardiogram machines, and patient monitors.

Although these devices appear to be "appliances" that you simply plug into the network and use for patient care, they are actually sophisticated computers, often running outdated versions of operating systems and applications that are not resilient against purposeful attacks.

For example, we have devices from a major manufacturer that internally use Windows NT as the operating system and Apache 1.0 as the web server.    Patches are no longer available for these old versions of software and they cannot be updated to protect them from malware.   Instead, we build hardware firewalls around the devices, creating "zero day" protection which mitigates risk by preventing internet-based attacks from reaching the devices.

In the past, manufacturers have claimed they cannot upgrade or patch software to enhance security because changing the device would trigger a new FDA 501k approval process.

Hence they have left the protection of the devices to the CIOs who manage hospital technology infrastructure.

In the past, when I've asked major device manufacturers to provide me a functional diagram of the ports and protocols used by their products that would enable me create tightly controlled firewalls, I've been told that the manufacturers do not have this information.

I've spoken to the FDA about this issue and they have advised me that device manufacturers have a responsibility to secure their products and there is no 510k re-certification needed when security patches are added.  The FDA has wisely stated that there is shared responsibility.   Device manufacturers must coordinate the updates and changes with hospital IT leaders and business owners.    We have had circumstances where manufacturers serviced devices without IT knowledge and left them in a vulnerable state.

In November 2009, the FDA issued Reminder from FDA: Cybersecurity for Networked Medical Devices is a Shared Responsibility that reminded device manufacturers, hospitals, medical device users facilities, healthcare IT and procurement staff, medical device users, and biomedical engineers of the 2005 guidance as well as simple ways to protect against cybersecurity threats. 

I've also talked to the FDA about including security penetration testing in the 510k process so that devices cannot be brought to market unless they are secure at baseline.

They have assured me that such regulations are in the planning phase.   It is true that existing FDA regulations for device safety and efficacy never presumed that purposeful malware attacks would be an issue.

Here are other valuable references from the FDA

 FDA issued guidance  in 2005, Guidance to Industry – Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software which answers question about pre-market review as well as other manufacturer responsibilities, such as validating software changes before releasing them.

At the same time as the guidance, the FDA issued Information for healthcare organizations about FDA’s “Guidance for Industry: Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software”  that describes FDA’s concerns about cybersecurity and what the guidance document covers.

In April 2005, the FDA hosted a webinar on the cybersecurity. The transcript is available here.

If your device manufacture claims the device cannot be patched due to FDA restrictions, refer them to these references and demand that devices be secured in collaboration with hospital IT staff and business owners.    It a world of escalating malware, manufacturers have a duty to keep devices secure and safe.

It’s Time for a National Patient Identifier

Here's a guest post from  Meg Aranow, Principal at Aranow Consulting LLC.

Some of us remember that the early HIPAA discussions included the concept of a national patient identifier.   As legislators and administrators attempted to find the right balance between the risks and rewards of automation, ultimately the patient identifier was thought to pose too much privacy risk.  I think that was the right decision in 1998.  But is it right in 2013?

The risk-reward playing field has been significantly altered by the infusion of federal stimulus money to hasten the implementation of data exchange among collaborating providers of care.   Clinically misidentified patients are patients who are not associated with their own medical histories or are mistakenly associated with someone else’s medical histories.  These patients have a heightened risk for inappropriate and potentially dangerous care provision.  This potential has always existed within our institutions, but the prevalence increases as our collaborative models are extended.  When clinic records are shared with the collaborating specialty clinic, and then shared with hospital and then the post- acute facilities we increase both the opportunity to deliver great care, and the risk of misidentification occurring somewhere in the chain.

Washington administrators are considering a new set of standards to routinize matching algorithms in an attempt to reduce patient mismatches.  To dictate standard matching criteria will compromise the very privacy safeguards they sought to maintain by eliminating the patient identifier in the first place.  Standardized criteria is a weak substitute for an identifier – it weakens privacy protections  and doesn’t actually solve the underlying problems of errant patient identification which stems from intentional or unintentional misreporting and recording of patient demographics.

Undoubtedly there are risks with a national patient identifier.  We need to continue our efforts to bolster security and privacy.  Unfortunately today security awareness and breaches both seem to be on the rise.   Most CIO’s are acutely aware of the security standards they must meet and report that they are making incremental progress against multi-year agendas…perhaps foreshadowing a point in the future where breaches of PHI will become increasingly rare.   Additionally, medical identity theft is estimated in the billions – Ponemon Institute suggests a high end of $30B per year.  Making more money available for preventative measures rather than paying for the penalties and remedies for the lapses seems like a worthy paradigm shift.  Strong, reasonably funded security and privacy requirements with repercussions for mistakes and abuse may be the path to finding the new balance of risk and benefit for a collaborative medical system based on a national patient identifier.

A patient identifier, separate and distinct from the social security number, and used as one factor in multi-factor authentication at the point of registration for services would assist in the accurate identification of patients at the point of care.  The persistent use of the patient identifier in the private and public HIEs will streamline and make more accurate efforts to share data among collaborating clinicians and public health entities.

Building Unity Farm - Naming the Landscape

I'm a great admirer of Edwin Way Teale's Pulitzer prize winning work about his travels across the United States during the four seasons and about his last 20 years of life on an old farm in northeast Connecticut.

I was recently asked to keynote a conference at the Mohegan Sun and took the road less traveled so that I could visit Teale's property, which is now an Audubon preserve.

Trail Wood is very similar to Unity Farm -  We have woodland, meadow, wetland, streams, and pasture.     I've created about a mile of trails thus far and we're busy crafting place names like Forgot-me-not marsh, Bluebird meadow, and Old Cart Path.

As I mentioned in my Tuesday post, the mapmaker of the Teale property will help me create a similar map for Unity.

Here are the features we'll need to name:

Paddocks - we have one for the males and one of the females

Pasture - we have a large grassy pasture which is available for our animals to graze from May to October.   We halter and lead a gender specific group from paddock to pasture in the morning and lead them back at night.

Duck Pond - we're building a duck pond this Summer for the Indian Runner ducks we'll raise this Spring.

Orchard trail - a 5 acre trail that begins at the barnyard, travels near vernal ponds, and climbs a drumlin before passing the neighboring apple orchard and descending into the most dense, oldest forest we own - 150 year old cedars, 100 foot pines, and maples.   This trail passes by
 *A hollow containing our Shinto Jinja - the shrine which houses the kami (the spirit of Unity Farm)
 *Deep forest - the oldest trees
 *Top of the drumlin - an ideal place for viewing the sunset or apple blossoms in the spring

Firefly trail - in the Summer, the fireflies congregate near a bridge I built over a seasonal wetland.    Although it's covered by the forest canopy there are many low bush blueberries, and moss covered rocks along the trail that connects the Orchard Trail to the Old Cart Path trail.  We need to name the bridge and wetlands.

Old Cart Path trail - this trail connected the original 200 acre farm property with downtown Sherborn in the 1700's.  It follows old rock walls and winds through old cedars staying fifty feet from the border of our marsh.

Marsh trail - this trail borders our northern woodlands through a dense pine grove and crosses a bridge (pictured below) on its way to our cattail grove and the football field sized forget-me-not marsh.  The trail ends where another bridge crosses the stream to a large wildflower meadow filled with bluebirds.   I recently built bluebird nest boxes and a bluebird feeder, which I'll describe in a future post.   This Spring, we're adding bee hives under the swamp maples in the meadow near the stream and bridge.    We need to name
 The north wood
 The pine grove
 The stream/bridges
 The cattail marsh
 The forget me not meadow
 The bee hive area

Orchard - This year, we're clearing an acre of poplar (as I described last week) and expanding our orchard to include additional apple, apricot, cherry, peach, pecan, and plum trees as well blueberries and raspberries.    We selected the species very carefully to ensure a staggered harvest over an extended growing season.   Here is the detail.   We're also adding additional wildflowers to the meadow to support the bees.  We'll have to name the new orchard on our map.

We purchased the property a year ago this month.    Edwin Way Teale had 20 years to develop and name the features of Trail Wood.   As soon as my first map is ready, I'll post it on the blog.

The February HIT Standards Committee Meeting

The February HIT Standards Committee focused on the Committee workplan for 2013.

Farzad Mostashari offered introductory remarks.   He noted that we need to build the foundation for stage 3 while also focusing on the implementation of stage 2.   The industry is feeling overwhelmed with meaningful use, ICD10, and ACO formation all occurring simultaneously.   Ensuring we get stage 2 right is our first priority.

A consistent theme in rest of the meeting was the need for more time to build the technology foundation for future stages of meaningful use.   As Jon Perlin put it, we cannot order the Christmas ornaments until we have the tree.

Doug Fridsma provided an overview of the S&I Initiative progress and presented the draft HITSC workplan with subcommittee assignments.    Doug and ONC staff took the 5 general categories of work, each with 5 themes that we discussed at the January meeting and organized the work based on the maturity and readiness of the standards needed.

Arien Malec offered an even better approach than ordering the work based on standards availability.  He said:

"What I would like to see is a coordinated statement between HITPC and HITSC that outlines the following elements:
1. Capability that needs to be broadly adopted to support national goals
2. Programmatic alignment for that capability (e.g., MU3/4, ACO/PCMH, etc.) both at the Federal/state and commercial levels
3. Suggested timeline for adoption of the capability (where the timeline includes stakeholder alignment, standards development, technology development, deployment, and adoption)

From that overall plan, we can derive the individual HITSC work plan."

The committee discussed this and agreed with his proposal.  The next step will be for the HITSC workgroup chairs and the policy committee to reaffirm the priorities of Meaningful Use stage 3 then we'll reorder the categories and themes of standards work  to align with policy imperatives.   We will also develop a timeline and may suggest to ONC that a stage 3 NPRM not be issued in 2013 to enable foundational technology work to be done first.

Next Jodi Daniel presented an overview of the public comment to the Policy Committee RFC. Comments on Meaningful Use issues were summarized by Michelle Consolazio Nelson.   Comments on Information Exchange were summarized by Kory Mertz.   Comments on Quality Measures were summarized by Jesse James.  Comments on Privacy and Security were summarized by Will Phelps.

Next I summarized, the recent Health Information Exchange Hearing with these slides.    Many made comments that View interoperability is gaining in popularity in addition to push (Direct) and pull (NwHIN Exchange)

Finally, Doug Fridsma and Jodi Daniel updated the group on ONC activities, ensuring coordination with Policy Committee initiatives.

It's clear that we have significant work ahead.  By next month, we'll have scope, timelines and resource proposals for getting it done in support of national priorities.

The Kindness of Strangers

I've been described as an eternal optimist who sees the best in everyone and everything.

Of course, I realize that humans can be territorial, selfish, competitive, dishonest, and mercurial, but I never let that bother me.

A few days ago, I was dropping off recycling at the Natick recycling center (has a special bin for styrofoam) and found it closed so I tried turning around in its unplowed driveway.  My Prius got stuck.   A Natick city employee drove by in a plow and told me that I was stupid for trying to drive there.   I asked for his advice/help but he told me I must have failed driving school and got back in his plow to watch me struggle.  Upon freeing myself, I drove to the Sherborn recycling center and the Sherborn city employees helped me empty my car and even told me how to properly recycle styrofoam in Sherborn.  It restored my faith in humanity and I'll never recycle in Natick again.

Last week I wrote about mushroom cultivation.    To help me figure out how best to layout my growing area, I emailed a local farmer, Leo Mondragon and his wife Marie.  They helped me immediately and offered to drop by my property to offer more detailed advice.

This Thursday, I'll write about my efforts to name the various topographic features (forget-me-not marsh, bluebird meadow, old cart path etc.) on Unity Farm.   A few weeks ago I walked the Connecticut property described in Edwin Teale's A Naturalist Buys an Old Farm.   At the bottom of the Audubon map of Teale's home, I noticed the name Bob Breau.  I emailed him for advice on creating trail maps for Unity Farm.   He offered to help me do it and will be visiting in March.

I've found similar kindness in the business world.   When I have a question about a tricky policy or technology problem, I email the people with experience.  90% of the time I get a helpful response.

Of the 1500 emails I receive every day, generally 100-200 are people seeking advice, which I answer by sending an article or relevant blog post.  If I cannot answer the question, I forwarded it to someone who can.

By helping those who need my advice, I believe my Karma improves and increases the likelihood of a response when I need the kindness of people I do not know.

This weekend I visited my parents in Los Angeles to help my father at home after his recent hospitalization. During each retail interaction I had (Home Depot for sprinkler repairs, Pacific Sales for a new refrigerator, Ralphs for groceries), I shared that I was visiting from Boston to help my parents with home maintenance.   Each clerk offered me special discounts and extra assistance.

Although there are days when life feels like a Dilbert cartoon, a page from a Steven King novel, or a chapter of Catch 22, I remain impressed that it is still possible to find the kindness of strangers.  The economy has its ups and downs, the planet is struggling with too many people competing for few too resources, and politics around the world make tasks harder than they need to be.

However, the kindness of strangers is one thing that is up to us.  I chose kindness when managing my dogs and today during my many meetings, I'll chose kindness even in those less than pleasant encounters that involve debates about resource allocation, priority setting, or service levels.    Anger and emotion may win the day, but kindness wins over the long haul of life.

Building Unity Farm - Planning for Mushroom Cultivation

In a few weeks, my wife and I will be taking down approximately 30 poplars which are growing near the house and barn.   Poplars grow to 75 feet and these trees are within 50 feet of structures.   We've lost many poplars in recent storms because the wood is soft and the roots are shallow.   We'd rather remove them before they fall into the house.

What are we going to do with the soft wood from 30 trees that are not suitable for firewood?

The answer - grow mushrooms.

I know that soft wood is an ideal growing medium for growing Oyster Mushrooms (Pleurotus ostreatus)

But what strain should I use?   Should I grow them on logs or wood chips?  What's the best growing environment and how much moisture is needed?

I contacted my friends at Fungi Perfecti and asked these questions.   Their response:

"You would probably be most successful if you grow the mushrooms on the poplar logs.  Also, you want to use wood that has been dead for 2 weeks to 6 months. After you cut your wood you want to keep it out of contact with the soil until the logs fruit, to avoid contamination.

As to which species you should use, we recommend both pearl oyster and blue oyster.  The only difference is that the blue oyster prefers cooler fruiting temps.  By inoculating some logs with pearl oysters and some with blue oysters you will have a longer fruiting season in the fall and in the spring.

I have attached to this email a .pdf copy of our plug spawn instructions so that you can review them and get more information on what is involved in log cultivation. If you have any more questions after reviewing these, please feel free to contact us."

For a local perspective, I contacted local (Petersham, MA) mushroom farmer Leo Mondragon at Forest Harvest  to ask his advice.

He recommended that we cut down the poplars now before the sap runs, as the wood will be moister and more amenable to inoculation.

He recommended we stack the logs in the shade of the forest and we use a high speed grinder with a 1/2 inch bit to create inoculation holes.  Here's a video from Leo illustrating the technique

He also recommended that we create mist irrigation to keep the logs moist during the summer months.

The kindness of strangers is always an inspiration to me.    Leo and his wife Marie generously provided me with all the advice I need to begin mushroom cultivation with our poplars.

I look forward to a bounty of oyster mushrooms from the forests of Unity Farm when they first fruit next Spring.

"Social Documentation" for Healthcare

Every day CIOs are inundated with buzzword-compliant products - BYOD, Cloud, Instant Messaging,  Software as a Service, and Social Networking.

In yesterday's blog post, I suggested that we are about to enter the "post EHR" era in which the management of data gathered via EHRs will become more important than the clinical-facing functions within EHRs.

Today, I'll add that we do need to a better job gathering data inside EHRs while at the same time reducing the burden on individual clinicians.

I suggest that BYOD, Cloud, Instant Messaging, Software as a Service and Social Networking can be combined to create "Social Documentation" for Healthcare.

In previous blogs, I've developed the core concepts of improving the structured and unstructured documentation we create in ambulatory and inpatient environments

I define "social documentation" as team authored care plans, annotated event descriptions (ranging from acknowledging a test result to writing about the patient's treatment progress), and process documentation (orders, alerts/reminders) sufficient to support care coordination, compliance/regulatory requirements, and billing.

Here are a few core principles I'd like to see as the foundation of "social documentation" products:

*Incorporates data input from multiple team members, reducing the documentation burden for each participant
*Eliminates redundant entry of the same information by different caregivers (nurse, pcp, specialist, resident, social worker)
*Supports Wikipedia like summaries (jointly authored statement of history, plans, and decision making)
*Supports Facebook/Twitter like updates i.e. "Patient developed a fever, ordered workup, will start antibiotics"
*Incorporates data already present in the EHR such as orders and results without having to re-describe them in narrative form

Accomplishing this is likely to require a modular architecture with some services offered in the cloud, some on mobile devices, and some via new enterprise software that improves upon insecure consumer offerings (such as institution hosted HIPAA-compliant instant messaging).

I recognize that implementing "social documentation" at a time when we're implementing ICD-10, Meaningful Use Stage 2, new security imperatives, accountable care organization tools to support care management, and healthcare information exchange may seem overly burdensome.

However, Yogi Berra said "If you don't know where you are going, you might wind up someplace else."

I believe that our strategy for ICD-10, Meaningful Use Stage 2, new security imperatives,  ACOs, and HIEs can incorporate the modules that will be foundational for "social documentation" in healthcare.

If 5 years from now, Beth Israel Deaconess is known as the birthplace for the "post EHR" care management medical record and "social documentation", I'll have stories to tell my grandchildren about.