ECRI Releases Guidance on Protecting Device Systems Against Ransomware
Ransomware attacks are making headlines with increased frequency. The latest malware to affect medical devices, WannaCry, wreaked havoc on hospitals in the U.K. and hit at least two hospital systems in the United States. As facilities continue to grapple with the reality that the rate of cyberattacks is only going to grow, hospitals’ IT departments are tasked with implementing more protective measures that focus specifically on medical device systems versus general hospital systems.
ECRI recently released a new guidance, “Ransomware Attacks: How to Protect Your Medical Device Systems”, which offers “do’s and don’ts” on how hospitals can identify and protect against ransomware infection. The recommendations are directed at a facility’s medical device security lead and include the following:
- Identify all medical devices, servers and workstations that operate on a Windows operating system (the WannaCry ransomware targeted Windows-based OS)
- Have the connected medical devices and servers received the Microsoft Windows OS MS17-010 security patch?
- Run a vulnerability scan to identify affected medical devices
- Manage third-party vendors that haven’t implemented the security patch
- Disconnect any devices identified or suspected to have a malware infection, and if unencrypted patient data is involved, risk management should handle the hospital’s response to the data breach (per HIPAA)
- Address most life-critical devices first, followed by therapeutics products, patient monitoring devices, alarm notification systems and diagnostic imaging systems
Read the “don’ts” in the guidance.
Related Articles
-
The guidance is intended to clarify the FDA’s approach for referencing the terms “device” and “counterfeit device” in FDA documents, as well as how the agency intends to interpret existing references to section 201(h) of the FD&C Act in guidance,…
-
On the journey to full-scale production for medical devices incorporating optics, a series of steps early in the process can make all the difference for successfully launching new products and introducing next-generation upgrades. This article discusses four considerations for a…
-
This year, the healthcare industry will step up its fight against cyberattacks because the costs and risks to patient care are becoming too great.
-
The UK MHRA has published “Software and Artificial Intelligence as a Medical Device.” The guidance document assembles previous guidances and regulatory requirements for SaMD and AIaMD devices seeking commercialization in the UK market.
