Forgot your password?
typodupeerror
Government Medicine Wireless Networking IT

Hospital Wireless Networks May Be Regulated Medical Devices 185

Posted by Soulskill
from the digital-lifeblood dept.
Lucas123 writes "As hospitals continue to connect patient monitoring equipment, physician PDAs and laptops to wireless networks, and then collapse those data paths onto traditional IT networks, the closer the US Food and Drug Administration comes to regulating them, according to Computerworld. The focus of the FDA's regulation comes in its recently finalized 80001-1 standard that established risk management practices for those networks, the adherence to which may be voluntary, but would determine Medicaid and Medicare reimbursements. 'If you don't comply, then you have two choices. You can have the federal government come in and inspect your hospital, or you can decide not to accept money from Medicare or Medicaid. Voluntary sometimes isn't exactly voluntary,' said Rick Hampton, wireless communications manager for Partners HealthCare System in Boston."
This discussion has been archived. No new comments can be posted.

Hospital Wireless Networks May Be Regulated Medical Devices

Comments Filter:
  • by Kenja (541830) on Monday January 10, 2011 @03:18PM (#34827464)
    Current level of security and quality for medical IT is rather poor.
    • Re:Good? (Score:4, Interesting)

      by Anonymous Coward on Monday January 10, 2011 @03:33PM (#34827698)

      I'd have to concur. I've been in hospitals where the IT staff offered free wireless internet for the waiting areas- and the only open access point was to the "airgapped" network for the financials, etc. I'm sure that Medicare would LOVE to find out about THAT particular HIPAA violation. >:-D

      • Re:Good? (Score:4, Insightful)

        by NevarMore (248971) on Monday January 10, 2011 @03:40PM (#34827800) Homepage Journal

        I I'm sure that Medicare would LOVE to find out about THAT particular HIPAA violation. >:-D

        Then go tell them. If you've physically been in the hospital that could be your data, your loved ones data, or just plain due diligence if you were there for work and not for a medical reason.

    • Re: (Score:2, Informative)

      by Anonymous Coward

      I think the quality of classic IT in a hospital isn't that bad. The status of our Windows network isn't that bad. There are issues, but I don't think we're any worse than any other industry. What is bad is the Biomed side of the house. The medical equipment stores patient data with no authentication or auditing capabilities. The systems that are based on off the shelf hardware and software (e.g. Windows PC hooked up to a medical device) can't be patched because the vendors won't certify the systems with tho

      • by HiThere (15173)

        What's your rate of infections by viruses? If you're running a MSWind network, that might be a fair test. If it's zero, you may be doing pretty well.

        This wouldn't work on a Linux or Unix network, as there basically aren't any viruses to probe the network, but on MSWind they might do a fair job of testing you.

        N.B.: I'm *NOT* a sysadmin, so I may be talking through my hat. But at least it sounds like a fair first test. If viruses are getting through, you KNOW your network is pervious.

        P.S.: Whenever I se

        • by vlm (69642)

          What's your rate of infections by viruses? If you're running a MSWind network, that might be a fair test. If it's zero, you may be doing pretty well.

          This wouldn't work on a Linux or Unix network, as there basically aren't any viruses to probe the network, but on MSWind they might do a fair job of testing you.

          Its just an anecdote, but a casual acquaintance I met at HOPE 2006 in NYC or something, worked at a hospital and their solution to preventing LAN/network based infections was to create the semi-mythical one PC vlan.

          So the linux side spoke dot1q and had a zillion interfaces and spoke smb via samba or whatever the heck the biomed device used. There was also some confusing discussion of mac address filtering, he was guite proud that any ole sysadmin could do iptables at OSI 3 and up, but he was doing all mann

    • by emarkp (67813)

      Sadly, that's not the only part of the equation. Will regulation make it better and/or safer?

      Because in my experience (10+ years of software medical device work) FDA regulation of medical devices has reached a point where the cure is now worse than the disease. Innovation is swamped under paperwork that prevents many solutions from coming out that would make medical devices safer or better, but which would cost too much for a company to implement because of FDA rules.

      Too often, medical device errors (radi

  • Good. (Score:5, Insightful)

    by RightSaidFred99 (874576) on Monday January 10, 2011 @03:18PM (#34827466)

    I'm one of those much hated libertarian leaning people who thinks regulation should only be applied when absolutely needed. In this case, we're talking life and death data and I would expect medical systems to be heavily regulated both for security and availability/reliability.

    So what's the controversy?

    • Re:Good. (Score:5, Funny)

      by Kenja (541830) on Monday January 10, 2011 @03:21PM (#34827510)
      You fool! You're suposed to let the free market decide! If too many people die at hospital A, just go to hospital B!
      • by dkleinsc (563838)

        Yeah, someone needs to send RightSaidFred99 to a Cato Institute reeducation center before he starts thinking that health insurance is a life-and-death kind of thing too and needs to be regulated!

    • Re:Good. (Score:5, Interesting)

      by Talderas (1212466) on Monday January 10, 2011 @03:21PM (#34827518)

      Well. Since you need to comply with FDA regulations or not get your medicare/medicaid funding, it's a pretty big deal.

      The problem exists in the transition. These improvements cost money and there's a good chance that networks in transition wouldn't meet the FDA requirements. That would cause the hospital to loose the medicare/caid funding and consequently have to turn away or eject patients that would be a huge cost to them that would otherwise get treatment.

      Since there's that potential while in transition to a more modern network, hospitals may be quite unwilling to fund the improvements in the first place and preserve their funding.

      • by Kagato (116051)

        Maybe a really small hospital might have issues, but if you're mid or larger and can afford something like Epic MyChart, you can afford a competent network admin.

      • Re:Good. (Score:4, Interesting)

        by Americano (920576) on Monday January 10, 2011 @03:53PM (#34827996)

        Or, as with just about any government regulation, the policy would be enacted and give hospitals X number of months or years to comply with the standards set forth in that policy, or face a loss of Medicare/Medicaid funding.

        Here's what will not happen:
        12:01 a.m., January 1, 2012: Regulation goes into effect.
        12:02 am, January 1, 2012: All non-compliant hospitals cease to receive funding from Medicare and Medicaid, and the feds move in to shut down these illegal dens of medical "care" for their noncompliance.

        They'll probably have several years to bring themselves into compliance, with a requirement that they document their risk mitigation policies until they are compliant, and if at the end of that time they can't show compliance, then they will risk losing their Medic[are|aid] funding.

        • Re: (Score:3, Interesting)

          by eth1 (94901)

          Or, as with just about any government regulation, the policy would be enacted and give hospitals X number of months or years to comply with the standards set forth in that policy, or face a loss of Medicare/Medicaid funding.

          Here's what will not happen:
          12:01 a.m., January 1, 2012: Regulation goes into effect.
          12:02 am, January 1, 2012: All non-compliant hospitals cease to receive funding from Medicare and Medicaid, and the feds move in to shut down these illegal dens of medical "care" for their noncompliance.

          They'll probably have several years to bring themselves into compliance, with a requirement that they document their risk mitigation policies until they are compliant, and if at the end of that time they can't show compliance, then they will risk losing their Medic[are|aid] funding.

          Exactly. What will really happen is this:
          12:01 a.m., January 1, 2012: Regulation goes into effect, with deadline of 2015-01-01.
          2012-01-01, IT: "We need to get started on this"
          2012-01-01, Exec: "We don't have the money yet"
          2013-01-01, IT: "We need to get started on this"
          2013-01-01, Exec: "We don't have the money yet"
          2014-01-01, IT: "We need to get started on this!"
          2014-01-01, Exec: "We don't have the money yet"
          2014-11-01, Exec: "We need this in two months or we're fscked!! We'll need you to work 168 hour wee

          • by fishexe (168879)
            2015-01-01, Exec: "I was put out of business by more onerous regulation. Yet again, government has gotten in the way of your health care. Don't vote for candidates who want to choke business with regulation. They are to blame for everything bad in society."
          • Maybe that's how it works at *your* hospital, but not at *mine* (I work in diagnostic imaging, which is under IT at my hospital). At my hospital we've known this was coming for quite some time and have been working towards it. And the Feds have also known it's been coming and have been working with us. Early adopters get big $$$ to help the process. That amount goes down the closer they come to the due date. They start to get penalized once the due date passes, losing more and more $$$ as time goes on,

      • However, as some others have pointed out, what you are doing and how the new rules are written is very relevant. If you are having equipment monitoring vitals signs sending data over the network that is relevant to the monitoring of the patient, you better be sure that the information is getting where it should be. Likewise, if you are just providing a public WiFi for patients and families so they can check their email while they are at the hospital, then there isn't as pressing a need to make sure the netw
      • by vlm (69642)

        That would cause the hospital to loose the medicare/caid funding and consequently have to turn away or eject patients that would be a huge cost to them that would otherwise get treatment.

        This assumes that medicare/medicaid patients are, and always will be, your most profitable. If your assumption ever turns out to be wrong...

    • Re: (Score:3, Insightful)

      by Korin43 (881732)

      The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare. It's perfectly fine if you have the money for the first option, but not everyone does.

      Not to mention that some people would be willing to take the risk to save money. Everything you do in life has a risk, why regulate just that one? There are many cases where I'd be willing to go to a hospital with a crappy wireless network to save some money. I'd think twice about gettin

      • by blueg3 (192743)

        The problem is that a heavily regulated system like this raises prices

        It also tries to make arguments on blind assertions.

        • by Korin43 (881732)

          The problem is that a heavily regulated system like this raises prices

          It also tries to make arguments on blind assertions.

          So you think things get improved for free then? More rules means more time spent making sure you're following them, and in the case of the healthcare industry, it means paying insane amounts of money for something that's cheap for everyone else (but the cheap version doesn't come with the right certifications).

          • by blueg3 (192743)

            So you think things get improved for free then?

            So, are you trying to argue that since it costs money to improve X, then if Y is an improved version of X, then Y is necessarily more expensive than X?

            • by Korin43 (881732)

              No, I'm saying that if it costs money to improve X, and you require that X be improved, then it will cost money. If Y uses X and isn't a charity, then Y will become more expensive to make up for it.

      • by Maclir (33773)

        The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare.

        Wait a minute - I thought the original article was referring to hospitals in the USA - so then "best healthcare" is not an option.

      • The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare. It's perfectly fine if you have the money for the first option, but not everyone does.

        "...Boo, my social security number, credit card number, and license number were stolen due to a poorly-secured network!" And all because a few doctors couldn't take a small paycut to afford the cost of securing their systems.

        Not to mention that some people would be willing to take the risk to save money. Everything you do in life has a risk, why regulate just that one? There are many cases where I'd be willing to go to a hospital with a crappy wireless network to save some money.

        And why should the contents of my personal health records and financial records be put up for grabs, because you're willing to accept the risk? You act is if it's like the choice to wear or not wear a seatbelt, in which it's your life at stake if your coin comes up tails.

        • Re: (Score:2, Informative)

          by Korin43 (881732)

          The point is that I'm not forcing you to go to my hospital, but with these regulations, you want to force me to go to yours.

    • Re: (Score:2, Insightful)

      I'm one of those hated libertarian people, and you haven't even begun to explain anything libertarian.

      This isn't between life and death, this is just communication between two machines (wireless networking). By confusing the two, you've fallen into the trap of the "do it for the children" crowd.

      In this case we have a government that is withholding payments because they haven't inspected a network. Okay, I'm okay with that, except for one thing, this isn't about privacy or security or anything like that. It

      • Re:Good. (Score:4, Insightful)

        by Peeteriz (821290) on Monday January 10, 2011 @04:54PM (#34828776)

        According to the TFA, this has killed at least 6 people in the last year, so in this case the communication between two machines was 'life and death'. Or wasn't it?

        • by fishexe (168879)

          According to the TFA, this has killed at least 6 people in the last year, so in this case the communication between two machines was 'life and death'. Or wasn't it?

          Bah! Never let the facts get in the way of a good story!

    • by RKThoadan (89437)

      I'm a little less libertarian than you and I see some potential problems. I don't really have many problems with this being regulated, but I'm a bit uncertain that the FDA is the best agency for this. I typically think that regulation is very similar to encryption. Both can make you much safer if done well, but they aren't done well very often (especially regulation) and end up just being a big inconvenience. Unlike many I genuinely believe that regulation can and should be done properly, which means it

    • by _Sharp'r_ (649297)

      So what's the controversy?

      Perhaps you are unaware that it can take several years and millions of dollars to get a new "medical device" through the FDA?

      Perhaps now you can see the possible implications in limiting a hospital's choices of networking devices if the FDA starts to regulate them as medical devices.... not to mention the delays in implementing a new higher bandwidth network when the technology is out there, but no one has put a 10 Gig Ethernet switch through the FDA approval process yet, for examp

  • by ducomputergeek (595742) on Monday January 10, 2011 @03:18PM (#34827468)

    I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..

    I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.

    It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.

    • by Kjella (173770)

      I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements.

      You're not exactly doing consultants a favor by showing that you can't spell HIPAA [wikipedia.org], you know.

  • by Rich0 (548339) on Monday January 10, 2011 @03:26PM (#34827582) Homepage

    I think that this kind of regulation is appropriate - in certain cases. I think you need to do a FEMA (failure mode effects analysis - basically ask what could go wrong?) and then control your network accordingly.

    Modern networking gear is very reliable in terms of transmission accuracy - if you send a packet from A to B and it gets there, it is extremely unlikely that it was modified (unless deliberately). It is not so reliable in terms of guaranteed transmission.

    So, if we're talking about a network being used to display a lab test in a doctor's office, I'd argue that there is a pretty low risk of anything going wrong and strong control over the network should be unnecessary (beyond general good security practices that would apply in any business setting).

    On the other hand, if we're talking about monitoring equipment, I'd say that control of the network is critical, unless there is some kind of backup for communicating alarms. If an alarm in a patient room is likely to be heard and responded to without the aid of the network, then it is probably important but not critical. If a patient alarm could be ignored if not broadcast over a network, then that network needs to be treated as a life-critical piece of equipment. That means that changes are carefully controlled, and the design has to be fit for purpose. Lives are at stake, and if some cheap router hangs up without a backup of some kind, or if a cable is left detached during maintenance and isn't caught by routine procedure, somebody could die.

    The sad thing is that regulations like this are likely to get abused in two different ways (I've seen this happen in other regulated industries):

    1. It will be over-applied in areas that are not really at risk, driving up all kinds of costs that consumers end up paying for, and often delaying the introduction of technology that could actually improve care.

    2. Because of the huge cost associated with knee-jerk reactions and consultants/etc in #1, administrators will try to skirt the regulation as much as possible, which puts patients at risk in situations where the controls really are appropriate.

    In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.

    • by digitig (1056110)

      So, if we're talking about a network being used to display a lab test in a doctor's office, I'd argue that there is a pretty low risk of anything going wrong and strong control over the network should be unnecessary (beyond general good security practices that would apply in any business setting).

      On the other hand, if we're talking about monitoring equipment, I'd say that control of the network is critical, unless there is some kind of backup for communicating alarms.

      The important thing is that somebody has looked at the use and decided that those levels are appropriate. And if it's not documented, it didn't happen.

      It will be over-applied in areas that are not really at risk, driving up all kinds of costs that consumers end up paying for, and often delaying the introduction of technology that could actually improve care.

      2. Because of the huge cost associated with knee-jerk reactions and consultants/etc in #1, administrators will try to skirt the regulation as much as possible, which puts patients at risk in situations where the controls really are appropriate.

      In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.

      Essentially, you need a system that requires somebody to do a HAZOP or functional hazard analysis to see what hazards any new system (or reversion to an old system!) presents. If the hazards are negligible then job done. If they aren't then you do full risk assessment and management, but the extent of that will vary according to the severity of risks. That's

    • In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.

      I work in an ensemble of hospitals for cronical patients, that is barely getting into the information age. My experience is that in these last cases regulation is not harming advance, but just reveals the nasty truth behind "the paper way": inadequate communication (that is supplemented through informal channels), inefficiences, and so on. One of the first fruits of the process of defining our clinical record system is that our directors found out how did really work some of the areas under their "supervisi

  • We can't even patch some of our systems or install an antivirus client on some of our equipment because it is considered a "medical device" and would lose FDA certification.

    One proposed solution is to VLAN these devices so we don't have radiology equipment spreading conficker throughout our network . . .

    • by rdunnell (313839) on Monday January 10, 2011 @03:37PM (#34827754)

      And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.

      • by spamking (967666)
        I don't want our medical devices on our main network.
        • I don't want our medical devices on our main network.

          Too bad. It's going to be increasingly necessary that they are if you want to really utilize electronic records. That doesn't mean that security is impossible but it is going to be a fact of life. Get over it and worry about how to secure the network.

      • by eth1 (94901) on Monday January 10, 2011 @05:10PM (#34828996)

        And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.

        Well, since you ask...

        I manage firewalls for several hospital chains. One of the main reasons that their radiology stuff is connected to their main network is that those images are all stored digitally, and need to be available all over the place (Dr.s' offices, etc., that may or may not be at the physical location of the hospital. Also, most hospitals these days don't have a radiologist sitting around in the ER all night/weekend, any more. They contract with a remote one, so they also have to be able to send those images elsewhere (over a VPN to the imaging service, for example). Often those systems are at least firewalled in a DMZ, but I have yet to see them on a completely separate network (although some clients are making noises in that direction).

      • by Gonoff (88518)

        If the scanners are on the network you can...

        • see it from PC beside scanner
        • see it from consultants office
        • see it from any PC in hospital - if the user has permission
        • on call consultant can VPN in from home to look at it
        • show patient in ward
        • compare it against earlier pictures
        • compare it against reference scans
        • teleconference and discuss it
        • check whether your scanners actually work properly

        Hospitals here have some pretty serious rules & policies on Information Governance. If it is properly looked after, we sho

        • by Lehk228 (705449)
          all of that is fine, send the data to a well secured file server and retrieve data as needed with appropriate permissions, rather than trying to make every node understand security and access policy, each data source just identifies itself to the central server which does know who is authorized to see what and records who did so.
          • by Gonoff (88518)

            That sounds like a description of a secure network. Hopefully, that is what all hospitals do. Sadly, they will not generally be using the most secure operating systems to use it.

      • by dogugotw (635657)

        The ability to share data across the world improves medical care. If a local physician can't quite read a scan, the scan can be shared to instantly which improves the overall care the patient receives. That's why you want this stuff on a network.

        I work in the medical device industry and none of this is all that new. It's clear that the FDA wants companies it regulates to THINK ABOUT RISK and then show that you've mitigated the relevant risks and can prove that's true. It's not rocket science, and doesn

    • While as other people have said, that equipment should not be on the main network, the reason you have this problem is that the person who wrote your validation documentation wrote it wrong. I work in a GxP laboratory environment and the key to this sort of thing is writing the validation correctly so as to allow patching of the systems and updating/changing the antivirus client without requiring a change control. Unfortunately, it has only been in the last 2-4 years that it has become accepted that it is o
    • by digitig (1056110)

      We can't even patch some of our systems or install an antivirus client on some of our equipment because it is considered a "medical device" and would lose FDA certification.

      If it really are safety of life equipment there should be no way for a virus to get in, and that should be documented. If folks are connecting to the net or installing pirated games on safety of life equipment, the problem is not that you can't install an antivirus client. And as for patching the systems, if you can show that the patches are developed to FDA standards, you can patch them. If you can't, you shouldn't even be considering it.

  • If something is not exactly voluntary and yet called voluntary, what is the real word for that? And I don't mean non-voluntary. What is a word for something that is voluntary, but not 100%? I.e. there are consequences if you don't. Because then it isn't "completely" voluntary.

    • by imamac (1083405)
      In military-speak: Voluntold.
    • People are bound to disagree with me, but I'd say "mandatory". It has been mandated that non-compliance has consequences. The word is usually used as a strict synonym for compulsory, but that's overstepping.

      In other words, you're not being compelled to comply, but consequences have been mandated. If you would say that you are being compelled, then you could not say that it is voluntary.

    • by slinches (1540051)

      If something is not exactly voluntary and yet called voluntary, what is the real word for that?

      I believe it's called extortion. At least when anyone besides the federal government does it.

    • by chiguy (522222)

      Coercion - the use of express or implied threats of violence or reprisal (as discharge from employment) or other intimidating behavior that puts a person in immediate fear of the consequences in order to compel that person to act against his or her will

  • Can the FDA regulate wireless networks? Just because the network is in a hospital?

    I don't disagree that they should be as secure as possible due to the sensitive nature of the data.

  • Does not appear to be available without paying for it (in Swiss franks even). If the US government is going to mandate something it could at least have the decency to post a free copy of what it mandates on a .gov web site for all to download.
  • I imagine that FDA medical device directives would have rules for data security and for RF emissions as well. I am a bit more familiar with CE medical device directives, where there are different classes of compliance - a device that filters your blood has stricter rules than an exercise machine - but besides protecting patient data, I assume a computer or network device in a medical environment would have to have have low RF emissions, so that it doesn't interfere with other medical devices. When your mi
  • It might be a good idea not to connect life-support and -monitoring equipment to the Internet? Even an internal network is a poor idea.

    These infrastructures can't handle flawless transmission of the NORMAL data that isn't life-critical, so I sure as hell don't trust it to tell a doctor in any timely or reliable fashion if my heart rate drops or my O2 sats are off so they can come help. Perhaps a separate, dedicated system is in order? You could possibly use most of the same type of infrastructure components

  • make a law forcing the right to install updates / anti virus on 3rd party systems / hardware / pc's hooked up to printers, medical devices and more. Forcing as in they can't void warranty or force you have there own tech to come in to do the windows updates no they must give you the pass words so you can use your own techs to do the work.

Maybe Computer Science should be in the College of Theology. -- R. S. Barton

Working...