Cyber Defense eMagazine December Edition for 2021

And it’s only getting worse. If you’re wondering how big this problem really is, it’s enormous when you
consider there are approximately 15 million medical devices in U.S. hospitals today with billions of IoMT
devices, experts believe, on the way. There’s no easy fix because highly detailed device information is
extremely difficult to come by.
Data silos and disconnects
Traditional computerized maintenance management systems (CMMS), which help HDOs track and
manage their inventory, aren’t actually connected to the devices they manage and don’t have access to
live traffic, so they don’t consistently know location, utilization, or other vital device details. IT asset
management (ITAM) and configuration management databases (CMDB), which organizations use to
track and manage their IT assets, don’t offer much relief. While they can dynamically capture information
on the networked assets in the environment, they lack visibility and understanding of medical devices.
That is, they can tell you the IP address of a device, what ports it’s connecting to, and maybe even what
type of device it is (e.g., an IV pump or an MRI machine); however, the classifications are often incorrect.
They can’t tell you what modules are attached to a device (e.g., syringe module on an IV pump). They
can’t tell you anything about serially attached medical devices that don’t have an Ethernet connection.
They can’t tell you what proprietary protocols are being used, what embedded software is on the device,
how often that device is used, where it’s located, or any anomalies in the network traffic.
As a result, BioMed, clinical engineering, and maintenance teams need to spend a lot of time trying to fill
in their inventory gaps. Unfortunately, this usually means HTMs are stuck wandering their halls to collect
needed information. It also means a lot of the data is outdated almost as soon as it’s captured because
most devices rarely remain in one place. This creates huge blind spots that can lead to costly and
dangerous operational omissions.
What are the risks to healthcare organizations?
It may seem overblown to say that these informational holes pose a danger to a health system’s
operations, but they do. Silos can lead to inefficient workflows, gaps in operational oversight, and other
organizational risks. At best, if left unaddressed, these disconnects add costs and delays to the business
that can make it challenging to offer connected care; at worst, they can generate failures or disruptions
in care which affect a health system’s integrity, reputation, and long-term economic viability.
Cyber Defense eMagazine – December 2021 Edition 101
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.