UL LLC, of Northbrook, Ill., has concluded a two-year cooperative research and development agreement (CRADA) with the U.S. Department of Veterans Affairs (VA), a program that verified that the UL 2900 standard provides a more seamless cybersecurity blanket for connected medical devices. UL said this marks is an important step toward the development of cybersecurity tools that ensure that devices can be used without undue risk to patients.
The CRADA was detailed in a paper by UL. Of note, the VA serves roughly 9 million veterans who received care from 172 VA medical centers and more than 1,200 community-based outpatient clinics. Many of these veterans interact at least occasionally with health care professionals via telehealth, but the VA Health IT infrastructure is massive, encompassing more than 340,000 desktop and laptop computers.
These computers make use of more than 90 various applications, including 56 health provider applications, making VA Health a ripe target for cyber attacks. Another 55,000 or so medical devices are connected to the VA Health network, including 11,000-plus pacemakers and implantable defibrillators, the net effect of which was to prod a closer look into the VA's cybersecurity protocols.
Infusion pump used as test case
To assess readiness against cyber threats,NULL, the team simulated a hacking at a Veterans Health Administration site in Tampa, Fla., using ICU Medical's Plum 360 infusion pump, a UL 2900 certified medical device. A number of scenarios were deployed to determine whether compliance with the UL standard would suffice to fend off cyberattacks on the pump. These included man-in-the-middle (MITM) attacks and connection to a wireless network to which a hostile laptop computer also had access.
The test run demonstrated that the infusion pump was blocked from connecting to an unsecured network without interfering with routine functions, such as an exchange of data with a dummy drug library. The pumps were able to fend off MITM attacks without having to rely on access point security measures, while transmission of encrypted data likewise continued uninterrupted despite the test cyberattacks.
Anura Fernando, chief innovation architect for medical systems at UL, told BioWorld MedTech that the organization had begun engaging with several federal government agencies in 2014 and 2015. This included the General Services Administration, which found itself needing to handle a breach of personnel files at the Office of Personnel Management in 2015. Fernando said the FDA and the National Institute of Standards and Technology were also in on the discussion.
"They wanted to understand why those kinds of breaches were still happening" even with a significant number of standards for cybersecurity, Fernando said. UL's discussions with the federal agencies made clear that there is a need for more cybersecurity standards, including those for repeatable, reproducible testing. The private sector weighed in, too, with an interest in supply chain assurance. Stakeholders decided that a CRADA would be a good way to explore the possibility of more robust standards than were available at the time.
Fernando said UL's approach was to develop a scope that covers a number of different technologies that are used in both home and clinical settings. VA Health has moved more aggressively to utilize telehealth over the past few years, so the UL standard had to tackle a diversity of product types and uses cases, both in facilities and at home. The infusion pump is fairly representative of the types of devices for which a use case might have been invoked, and the research going into these pumps had to evaluate how they are linked to a hospital's IT network, as well as the types of controls that were available for end users in nonclinical environments.
Health Canada, TGA on board
The UL-2900 family of standards is still relatively new, although the FDA formally recognized it in September 2017. Fernando said 2900-1 is the base standard, while 2900-2-1 is specific to the med-tech industry. He said that in addition to the FDA, Health Canada and Australia's Therapeutic Goods Administration have recognized 2900-2-1, while the regulatory authorities in South Korea and mainland China are considering recognition. Additional 2900-2-x standards will be developed for other industries, although the core principles will be obvious through each iteration, Fernando said.
Fernando added that the consistency of the core principles is critical because not everything that shows up in a hospital or other clinical setting is directly regulated by the FDA. Electronic health records are still the province of the Office of the National Coordinator for Health Information Technology, while industrial control systems for non-health care uses in hospitals, such as HVAC systems, are an entirely different matter in regulatory terms. Still, these systems all need protection from cyber-assaults, and thus a standard template for the related cybersecurity programs will prove invaluable in the years ahead.
The question of risk management is addressed in 2900-2-1, and the general themes are the same as those seen in ISO 14971. Fernando said 14971 is largely reflected in the technical information report (TIR) 57 from the Association for the Advancement of Medical Instrumentation (AAMI). The TIR has not yet been directly referenced in the UL standard; however, Fernando said 2900-2-1 will cite both the AAMI publication and ISO standards upon the next iteration.
While the CRADA is now completed, UL's relationship with VA Health continues, Fernando said. UL and VA Health are looking at what other cybersecurity standards might be needed, and he said 2900 standards will have to be updated fairly frequently, particularly with advances in artificial intelligence (AI) and machine learning (ML). AI and ML will prove exceptionally difficult to incorporate into an all-inclusive set of requirements, but Fernando said it can be done. "To some extent, the standards are extensible that way," he said, adding that while 2900-2-1 may need modification, the fundamental question of keeping the standards relevant would require constant vigilance in any event.
"The main concern from a security viewpoint . . . is that these devices use data that's acquired in the field to alter the existing algorithm," Fernando said of AI and ML, so lack of awareness of the provenance of the data suggests they could be manipulated to skew how the algorithm behaves. There are a number of entities looking into this question, including AAMI and the Medical Imaging & Technology Alliance, although the FDA's ongoing efforts to craft a regulatory framework for AI and ML – not to mention the ongoing effort to develop a final regulatory framework for software as a medical device under the pre-cert paradigm – suggest that the related adaptations to 2900-2-1 won't be ready in the near term.
Industry is becoming more savvy about cybersecurity, Fernando said, but not everyone is on board, a situation that calls for additional effort on the part of all stakeholders. "I think the issue with device makers right now is there are some who are very mature and understand the risk, and some who are just starting to become aware," he said.