Medical IT Networks Research Articles

Healthcare Providers’ Readiness to Address Medical Device Cybersecurity within the Irish Healthcare System

Medical devices that can diagnose and treat critically ill patients have become sophisticated and complex. Device manufacturers have been developing these systems to meet market requirements as technology evolves. Combining medical devices and ICT into a distributed medical device IT system can be a solution to incorporating continuous monitoring from the patient bedside to interoperability with a clinical information system. These technology innovations aim to manage patient data and configure medical devices into networked systems that can provide functionality and safety. The implementation of a medical device network solution allows a healthcare provider to take advantage of managing the flow of information to improve clinical work practices and implement a system that can be interoperable with other clinical information systems. International Electrotechnical Commission (IEC) 80001-1 was developed to assist healthcare providers in identifying and managing the risks associated with medical devices sharing the same IT network with other systems and software. This standard defines roles, responsibilities, and activities in relation to the management of risk with medical devices on an IT network. This study aims to determine if the standard International Electrotechnical Commission (IEC) 80001-1 is being implemented and determine familiarity with regulations and appropriate standards and guidance for an effective medical device security risk-management program with Irish healthcare providers. A literature review highlighted the restrictions healthcare providers face in adopting and implementing IEC 80001-1 and the security threats and risks present when integrating medical devices and IT networks. The study research was conducted with clinical engineering members of the Biomedical and Clinical Engineering Association of Ireland (BEAI). This survey targeted BEAI members due to their wealth of experience, knowledge, and skill level in supporting complex medical device systems. An online anonymous survey was created to determine knowledge, awareness, and familiarity with IEC 80001-1 and other medical device security risk-management guidelines. The study research results revealed low knowledge, awareness, and familiarity among research participants with IEC 80001-1 and guidelines on medical device security risk management. These results were consistent with the literature review that a key to the success of standard adoption is collaboration between stakeholders and a multidisciplinary approach to compliance.

Revising IEC 80001-1: Risk management of health information technology systems

IEC 80001-1 was published in 2010 and is now undergoing revision. Feedback gathered on the adoption of the standard has revealed a number of barriers that have impacted its adoption. The standard provides requirements related to the roles, responsibilities and activities that need to be performed for the risk management of medical IT networks. One reported barrier is a lack of drivers to motivate Top Management to implement the standard. In addition, there is a lack of alignment between IT and biomedical engineering departments within hospitals. Finally, the IEC 80001-1 standard was considered to be too complicated and complex to implement. This paper presents the barriers identified in the feedback and presents an approach to the revision of the standard as a process based standard following the structure outlined in ISO/IEC Directives Annex SL and aligned risk management standards as a means to overcome these barriers.

Improving ICU risk management and patient safety

PurposeThe purpose of this paper is to describe a study which aimed to develop and validate an assessment method for the International Electrotechnical Commission (IEC) 80001-1 (IEC, 2010) standard (the Standard); raise awareness; improve medical IT-network project risk management processes; and improve intensive care unit patient safety.Design/methodology/approachAn assessment method was developed and piloted. A healthcare IT-network project assessment was undertaken using a semi-structured group interview with risk management stakeholders. Participants provided feedback via a questionnaire. Descriptive statistics and thematic analysis was undertaken.FindingsThe assessment method was validated as fit for purpose. Participants agreed (63 per cent, n=7) that assessment questions were clear and easy to understand, and participants agreed (82 per cent, n=9) that the assessment method was appropriate. Participant’s knowledge of the Standard increased and non-compliance was identified. Medical IT-network project strengths, weaknesses, opportunities and threats in the risk management processes were identified.Practical implicationsThe study raised awareness of the Standard and enhanced risk management processes that led to improved patient safety. Study participants confirmed they would use the assessment method in future projects.Originality/valueFindings add to knowledge relating to IEC 80001-1 implementation.

The MedITNet assessment framework: development and validation of a framework for improving risk management of medical IT networks

AbstractThe use of networked medical devices can provide a number of benefits such as improved patient safety, a reduction in adverse events and reduced costs of care. Today, medical devices are increasingly designed for incorporation into a hospital's general IT network, which allows devices to exchange critical information. However, connecting devices in this way can introduce risks potentially negating the benefits to patients. While the IEC 80001‐1 standard has been developed to aid Healthcare Delivery Organisations (HDOs) in addressing these risks, HDOs often struggle to understand and implement the requirements. The MedITNet framework has been developed to allow HDOs to assess the capability of their risk management processes against the requirements of IEC 80001‐1. MedITNet provides a flexible assessment framework enabling HDOs to gain a greater understanding of the requirements of the standard and to improve risk management processes by determining their current state and highlighting areas for improvement. This paper examines the challenges faced by HDOs in the risk management of medical IT networks and briefly explains the components of the MedITNet framework and how the framework addresses these challenges. The use of Action Design Research (ADR) in the development and validation of MedITNet is also discussed focusing on a pilot implementation of the assessment method and expert review of the overall framework. The changes to the framework and its components as a result of the validation process are also discussed. Copyright © 2016 John Wiley & Sons, Ltd.

Letters to the Editor

Regarding the research paper “Assessing a Hospital's Medical IT Network Risk Management Practice with 80001-1” (January/February 2014 BI&T): The thing that amazes me is that most people I talk with claim that only big institutions like Partners and Kaiser can implement 80001, that there is no way a small hospital can do it. It takes a 40-bed hospital in Ireland to show it's going to work exactly opposite to this.I spent a few hours at the HIMSS conference in February, getting my ears bent by IS security types and a couple of CIOs. I'm beginning to think that only small hospitals can implement 80001. The larger institutions are either too arrogant to feel they need it (they already know everything) or too bureaucratic to pull it off—or possibly, both.I did talk with a couple of CIOs who “got” it. But, they confessed, only after their network had been badly compromised.Rick HamptonWireless Communications Manager, Partners HealthCare, Boston“How to become a High-Performing HTM Department” (November/December 2013 BI&T) is the best and most useful article written so far about the changing role of healthcare technology management (HTM) professionals and HTM overall. The article was packed with plenty of advice and proposals for action, but it also managed to offer a big picture on the changes we're seeing. Congratulations to the author on a great job!I am an imaging specialist at University of Chicago Medicine. I don't have a management role in the Radiology Engineering Department, but I have been looking for ways to improve department efficiency—introducing metrics, changing the culture, elevating our visibility, and doing many of the other good things mentioned in the article. The advice about “not butting heads” with IT was especially wise.I will read the article again and try to extract points of improvement and implement them in my environment. I believe in the saying, “You don't need a title to be a leader.”Aleksandar Popivoda, CRESRadiology Engineer, University of Chicago Medicine

Risk Management of Medical Devices in the Healthcare IT Network

Medical devices become increasingly part of the network, a variety of network reliability, safety and management issues are continuing to emerge in medical healthcare. The networked healthcare environment risk management standard IEC 80001 addresses the current task. Both the definition of roles and responsibilities and procedures of medical IT-network risk management of IEC 80001 are furthered analyzed.

Risk Management of Medical Devices in the Healthcare IT Network

Medical devices become increasingly part of the network, a variety of network reliability, safety and management issues are continuing to emerge in medical healthcare. The networked healthcare environment risk management standard IEC 80001 addresses the current task. Both the definition of roles and responsibilities and procedures of medical IT-network risk management of IEC 80001 are furthered analyzed.

Human Factors and IT Medical Device Standards at AAMI

Human Factors and IT Medical Device Standards at AAMI

Responsibility Agreements Ensure Accountability Under 80001

Mike Papa, BS, CBET is the supervisor of biomedical engineering at St. Luke’s Health Network in Bethlehem, PA. E-mail: papam@slhn.org As traditionally isolated medical device networks migrate in design and functionality onto more converged enterprise IT networks, hospital-based clinical engineers and IT personnel are faced with managing an increase in associated risks. The newly approved voluntary standard IEC 80001-1: Application of risk management for IT-networks incorporating medical devices, addresses what healthcare delivery organizations (HDOs, or hospitals) can do to manage such risks. 80001 provides a structure for HDOs to manage the risk of converged network(s). A key part of this structure calls for the HDO to establish and manage the roles and responsibilities among all stakeholders that take part in the formation of the medical IT network. Stakeholders include the HDOs, the medical device manufacturers (MDMs), and the IT manufacturers. Within 80001, roles and responsibilities are established and managed in the form of a contractual agreement called a “responsibility agreement.” This article takes a closer look at the establishment of responsibility agreements and their importance to implementing 80001.

Managing Security Risks With 80001

Healthcare delivery organizations (HDOs, or hospitals) will soon begin to use IEC 800011:2010 to assist them in managing risks associated with medical IT networks—IT networks in their facilities that incorporate medical devices. Recent attention has been given to the dangers of and poor outcomes occasionally experienced when in-hospital interconnection of medical devices is performed without due care. Cooper and Eagles related how the new standard will help to provide safer, more effective, and more secure operation of a medical IT network. Of course, the problems of incorporating a medical device onto an IT network are not confined to hospitals. With the global movement toward electronic medical records, it is likely that soon even the single practitioner may have a fairly sophisticated network as an integral part of the practice’s infrastructure. It will be unlikely that the smaller practices will have the resources to maintain an aggressive cybervigilance stance and might be grateful for much of the complexity associated with the incorporation of medical devices into their infrastructure to be managed by a transparent, open process. One of the first challenges in managing risk is assembling information essential to the initial assessment of risk. For medical devices, this effort involves obtaining documentation and understanding of the device’s intended use, instructions for use, security disclosures, and any other safety or effectiveness disclosures that might be possible. Similar documents must be obtained or created for the target IT network where the information sources may be internal or from both internal service providers and from IT vendors. This paper discusses the nature and use of security risk disclosures under IEC 80001-1 with an emphasis on the use of common terminology to group together and discuss the security capabilities and/or requirements for medical devices that are risk managed during the entire life cycle of connection to the medical IT network. It does not assume nor promote any particular security controls framework for the HDO or medical device manufacturer (MDM). Instead, it simply outlines a grouping of security capabilities of the medical device that are relevant to securing the IT network connected device throughout its life cycle. The article is an overview of an upcoming Technical Report from the IEC (publication likely in late 2011) and provides some information that may change before the release of the final report. However, we hope it provides an overview for HDOs, both big and small, to start to think about organizing their IT network risk management activities to include security Managing Security Risks With 80001

Step-by-Step Risk Management for Medical IT Networks

Step-by-Step Risk Management for Medical IT Networks