IoT in healthcare at serious cyber attack risk

New Delhi,: While the healthcare industry is rapidly adopting new-age technologies such as the Internet of Things (IoT) and Artificial Intelligence (AI) to improve access and outcomes especially in the rural areas, companies must ensure that the technology acts with responsibility and transparency, say experts.

In recent years, India has seen IoT adoption in education, governance and financial services. The technology has also enabled doctors see and interact with patients in remote telemedicine centres - with the case history and medical data automatically transmitted to the doctor for analysis.

"India has an acute shortage of doctors which impacts both the quality and reach of healthcare services in rural and urban centres," John Samuel, Managing Director (health and public service) at Accenture, told IANS.

"A digital platform powered by advanced digital technologies can enable continuous remote patient monitoring and reporting, allowing hospitals to extend care to more people, and reduce the burden on healthcare infrastructure," Samuel added.

According to the "IoT India Congress 2018", the Indian IoT market is expected to grow from $1.3 billion in 2016 to $9 billion by 2020 across sectors such as telecom, health, vehicles and homes, among others.

It is emerging as the next big thing to become a $300 billion global industry by 2020 and India is all set to capture at least 20 per cent market share in the next five years, says a Nasscom report.

However, lack of basic security awareness among staff as well as state-of-the-art cybersecurity solutions has made the healthcare industry a favourite target for hackers.

A 2016 report from cybersecurity firm SecurityScorecard found that healthcare is the fifth highest in ransomware counts among all industries, and more than 77 per cent of the entire healthcare industry has been infected with malware since August 2015.

Among them was the notorious WannaCry ransomware attack in 2016 which affected over 300,000 machines across 150,000 countries, including the UK's National Health Service (NHS).

"Despite suffering from ransomware attacks, organisations remain unprepared for the next round of large-scale attacks," Yariv Fishman, Head of Product Management (Cloud Security and IoT) at Check Point Software Technologies, told IANS in an email interaction.

Fishman pointed out that it is not mandatory for medical device manufacturers to include cybersecurity capabilities as part of their offerings.

Once integrated into a hospital, medical devices are fully utilised to meet patient care requirements.

As a result, even if a software patch that may prevent a potential cyber-attack is available, it usually takes lot of time for implementation.

Other reasons include old or unpatched operating systems and flat networks in which, guests, patients, doctors and connected medical devices, all share the same network.

To ensure security, medical device designers (particularly those with IoT components) should have a 360 degree view of the various parts of the network, said Fishman.

"They also need to segment parts of the network in order to contain malware attacks and mitigate the potential risk of one part of the network attacking other parts and integrate threat prevention solutions," he noted.