Over the last decade, we have seen an increasing heath care demands and pressure on hospital beds, culminating in a move towards mobile health and utilisation of telemedicine that has also been gathering pace.
The Wannacry viral attack was a wake-up call to the risks inherent within the UK IT system, should malware or ransomware infect the system. The shutdown led to the loss of OPD sessions and the closure of hospitals, as well as GP surgeries for a number of days, culminating in delays as well as a potential risk to patient health, beyond the economic impact of lost clinical time.
The issue of using more remote monitoring for the patient care within the community could culminate in increasing openings by which malware could be inoculated back into what was felt to be secure IT infrastructure
Our participation in this EU-funded project, HEIR, was to explore how the NHS system and cybersecurity issues could be tested.
Problem and Objective
Increasing use of devices has taken place to help manage the patient within the community (Telemedicine) and within hospital settings. However, rumours abound in regards to how secure are such devices, and how much of a risk they really pose for healthcare, given the increasing reliance of healthcare on electronic records ( EPR) and infrastructure for viewing notes, as well as ordering and recording test results ( e.g. Cerner).
Devices are also in increasing use for monitoring (e.g. heart rate monitors, BP monitors, and pulse oximetry) and the safe delivery of patient care (e.g. ventilators, pacemakers) and patient diagnostics (e.g. ultrasound, CT and MRI scanning etc.)
Not knowing how safe such systems are to cyberattacks, and how they interact with the current IT structure is an issue if we are to be able to mitigate against a future Wannacry attack that can compromise patient care again.
The Croydon Use Case:
Croydon University Hospital is a medium to large-sized NHS Trust located in Croydon, a borough to the south of London. The Trust covers both acute and community services for a population of almost 380,000 citizens.
The R&D department has worked on telehealth projects in the past and the Trust has a system of virtual wards in place, to help manage patients in the community using telemedicine.
The HEIR project aims to demonstrate benchmarking of the current IT infrastructure ( local and global RAMA score) as well as demonstrate utilisation of machine learning for monitoring a medical device, in this case, the chosen example is a team 3 device, used within the labour ward settings, for monitoring the health of the mother and baby during labour. The idea is that the machine learning would pick up abnormal behaviour in the device, indicative of a compromised device, thus enabling system isolation and if needed shut down, to ensure the security of the system as a whole from a potential cyber-attack.
Graphical user interface
In this pilot site, the HEIR platform would be installed into a mock hospital IT system, incorporating the team 3 device and associated database within its own secure server. This then allows the local IT service teams to be able to view the graphical user interface, to see the effects of changing IT infrastructure, such as computers with outdated software, on the local and global RAMA scores, as validation of how secure the IT system is compared to its peers, allowing a degree of benchmarking and data gathering within the Observatory that is linked to the HEIR platform.
Machine learning
In our concept, the mind of a hacker would be to infect or compromise the system – just stopping a medical device from working would generate alarms, and in the common clinical settings, lead to the defunct machine being removed and a new one installed. This nullifies the effects for cyber attackers. However, if the hacker is able to compromise the output of the device, such that it goes unnoticed by the clinical team, then it is potentially possible that more damage is done and also packets of infected material are passed onward into the Trust’s IT structure. Therefore, the concept under test is whether we can utilise machine learning to detect aberrant device behaviour early
For this, anonymised labour ward team 3 data was obtained after securing Information Governance permission, for use within this project. This data, plus synthetically generated data, was then used to train the modelling needed to highlight aberrant signals, thus ensuring full GDP compliance.
A second session of more data was tested before the machine-learning tool can be installed.
The final analysis would be the accuracy of the tools to detect various aberrant signals and differentiate from normal team 3 output data in normal performance.
During this phase, the signals would be all artificially generated so that the performance of the tool could be evaluated fully.
The system thus compromises the host server, hosting the HEIR components, including the machine learning, team 3 server, team 3 device, computers, and laptops.
Conclusion:
Increasing use of IT infrastructures to help patient management has led to a level of risk not initially considered given the degree of increased cyber activity to be malignant. The drive to have more community care, and use telemedicine to help support citizens within the community has opened a door via which cyber-attacks can be harnessed to further compromise the safe care of patients.
The HEIR project enables us to explore methods that can help mitigate some of these potential healthcare risks, be it attacks on IT infrastructure or on medical devices themselves.