Keeping track of thousands of life-saving medical devices and making sure hackers cannot access them used to be an overwhelming task for John Weller, chief information security officer at MetroHealth, which runs 26 medical centers in Michigan.
Weller brought in Israeli-founded startup CyberMDX to protect the devices along with the lives of the patients that depend on them. Founded by former leaders of Israel’s cybersecurity network, CyberMDX protects millions of medical devices around the world. It provides a centralized system that tracks each of the thousands of different devices used in hospitals and clinics, identifying security gaps and helping personnel quickly locate and fix them before attacks occur.
“We didn’t know where we needed to focus before CyberMDX, but now we do,” Weller says. “It’s telling us what our threats are, and what our vulnerabilities are. I always thought of myself as a doctor without a stethoscope or without a thermometer. I didn’t know what the temperature was of the device, and I get that with CyberMDX.”
As the healthcare field becomes more connected to the internet, medical devices and the networks that run them are increasingly vulnerable to cyberattacks and data breaches. Ransomware attacks against healthcare organizations rose by 123% in 2020, costing medical providers $21 billion in downtime and over $2 million in ransom money.
“The pandemic reshaped what is considered critical infrastructure today, and attackers took note,” says Nick Rossmann, global threat intelligence lead for IBM-X-Force. In about a quarter of the healthcare attacks, cyber criminals used ransomware to blackmail care providers into paying to restore access and safeguard their patients and equipment.
“We must protect against these risks,” says Amir Magner, cofounder and president of CyberMDX and former head of the Cyber Division in the Israeli Prime Minister’s Office. “In this field, we are talking not just about protecting data, but also protecting patients’ care and patients’ lives. It’s a very critical mission.”
Hospitals and other healthcare facilities are increasingly struggling to find affordable and user-friendly protection for their data, which comes from thousands of different devices with varying levels of built-in security. The devices are often strung together on networks with multiple users on different shifts with high staff turnover, says Lee Kim, director of privacy and security at the Chicago-based Healthcare Information and Management Systems Society, a nonprofit that addresses tech solutions in the medical field.
“Limitations to solutions are discovered every day,” Kim says. “Patient lives are on the line. The closer the proximity of the patient to the technology and the more life-saving or life-sustaining the technology is for the patient, the higher the stakes.”
Last year, CyberMDX scientists discovered that hackers could infiltrate hospital X-ray, CT, and MRI machines and steal patients’ medical records, which can fetch a high price on the black market. Months earlier, the company found that cyber criminals could access certain anesthesia machines and alter oxygen levels, potentially killing patients during surgery. The company alerted GE Healthcare Systems, the maker of those imaging and anesthesia machines, and helped close the security gaps.
A prime challenge for cybersecurity in the medical sector is the number of IoT devices, or physical objects ranging from tiny sensors to large imaging machines that use the internet to send, receive or process data.
“The average patient bed has 15 IoT devices,” Magner says, including IV infusion pumps and wireless heart monitors. Remote-care devices, such as pacemakers and glucose meters for diabetics, are also increasingly connected to networks. Data collected from or fed to these machines could affect drug dosages and influence doctors’ diagnoses and treatment plans.
“These things must be protected in order for the patients to be protected,” Magner says.
Hospitals also use a lot of older machines. While they may meet medical needs and can be incorporated into modern computer networks, such machines often do not contain the built-in cybersecurity protection needed in today’s online world, Kim explains. CyberMDX platform can locate and protect most of these older devices.
In addition to security, CyberMDX offers hospitals a treasure trove of data that can help run their equipment more efficiently. It does this by bringing together all the data from all the hospitals’ thousands of devices on one screen, including the location of these devices, their serial and model numbers, and any manufacturer recall information or technical problems they are experiencing.
As a result, hospitals do not have to waste time searching in supply closets and wards for available equipment like extra ventilators or nurse-call buttons. They can quickly find any equipment that needs repair or has been recalled by manufacturers for safety reasons. It also helps hospitals make more informed decisions when ordering new or replacement equipment.
“Before CyberMDX I would have to spend days locating a device that had been recalled or had a security vulnerability,” says Tamir Ronen, chief information security officer at Assuta Medical Centers, which has 10 locations in Israel, each with tens of thousands of internet-connected devices. “But the system lets me easily see a dashboard telling me which floor and which room each machine is in, and when it is being used.”
CyberMDX, which has tripled its revenue during the last year, has also integrated its product with global health technology company Royal Philips, Amazon Web Services and Microsoft, all of which collect and analyze the increasing amount of data produced by medical devices.
“The amount of data is causing a revolution in the healthcare industry, which on the one hand leads to better care,” Magner says. “But it also comes with risks, and that’s what we are addressing. We are insuring that hospitals can keep operating safely.”
For more information about CyberMDX, click HERE.