NIST Releases Draft Paper on Telehealth and Remote Monitoring Device Cybersecurity
The National Institute of Standards and Technology’s National Cybersecurity Center of Excellence (NCCoE) has released a draft paper covering the privacy and security risks of telehealth and remote monitoring devices along with best practices for securing the telehealth and remote monitoring ecosystem.
Patient monitoring systems have traditionally been deployed within healthcare facilities; however, there has been an increase in the use of remote patient monitoring systems in patients’ homes in recent years. While these systems are straightforward to secure in a controlled environment such as a hospital, the use of these systems in patients’ homes introduces new risks.
Managing the risks and ensuring that remote monitoring systems and devices have an equivalent level of security as in-house systems can be a major challenge.
The purpose of the paper is to create a reference architecture that addresses the security and privacy risks and provides practical steps that can be taken to improve the overall security of the remote patient monitoring environment.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The paper addresses cybersecurity concerns related to the use of the devices in patients’ homes, the use of home networks, and patient-owned devices and identifies cybersecurity measures that can be implemented by healthcare organizations with RPM and video telehealth capabilities.
“The project team will perform a risk assessment on a representative RPM ecosystem in the laboratory environment, apply the NIST Cybersecurity Framework and guidance based on medical device standards, and collaborate with industry and public partners,” explained NCCoE.
NCCoE has evaluated the following functions of the devices:
- Connectivity of devices and applications deployed on patient-owned devices such as smartphones, tablets, laptops, and desktop computers
- How applications transmit monitoring data to healthcare providers
- The ability for patients to interact with their point of contact to initiate care
- The ability for data to be analyzed by healthcare providers to identify trends and issue alerts to clinicians about issues with patients
- The ability for data to be shared with electronic medical record systems
- The ability for patients to initiate videoconference sessions through telehealth applications
- The ability for application patches and updates to be installed
- How a healthcare provider can establish a connection with a remote monitoring device to obtain patient telemetry data
- How a healthcare provider can connect to a remote monitoring device to update the device configuration
The paper does not cover risks specific to third-party telehealth platform providers nor does it evaluate device vulnerabilities and defects.
Stakeholders have been invited to comment on the draft paper. Comments will be accepted until December.
The guidance document can be downloaded on this link.
Image Source: J. Stoughton/NIST
