The Healthcare Supply Chain Association on April 17 outlined numerous cybersecurity measures healthcare providers, devicemakers and service providers should consider implementing to protect patients' health, safety and privacy.
HSCA organized its cybersecurity considerations into four main categories, which are summarized below.
1. Cybersecurity training and software. HSCA encourages organizations to designate an organization security officer, maintain updated anti-virus software, and implement cyber training and assessments for appropriate stakeholders.
2. Equipment acquisition standards and risk coverage. Organizations should make sure they follow regulatory standards for purchasing medical devices and updating legacy devices, provide insurance policies to cover cybersecurity risks, and validate devices by testing manufacturer claims.
3. Data encryption.HSCA recommends organizations encrypt personal authentication data, along with any other confidential or sensitive information.
4. Information sharing and standards organizations.Organizations should also participate in Information Sharing and Analysis Organizations, certify that suppliers of network-accessible medical devices, software and services are compliant with current FDA regulations, and ensure manufacturers provide a Manufacturer Disclosure Statement for Medical Device Security.
"Advances in information technology and medical devices, and increasing interoperability of information systems, devices and services are improving patient care," said HSCA President and CEO Todd Ebert, RPh. "However, medical devices and services are vulnerable to cybersecurity threats that could jeopardize patient health, safety and privacy. … HSCA member [group purchasing organizations] bring a unique line of sight over the entire healthcare supply chain that allows them to bring innovative products and services to patients, while simultaneously helping providers confront 21st century cyber threats."