In the age of internet-connected devices, electronic medical products that are created without adequate levels of security may actually end up doing more harm than good.
It’s more than just a company’s reputation at stake if and when those vulnerabilities are discovered by malicious hackers. Patients could lose their lives.
The engineers at DornerWorks have helped companies build dozens of medical devices with innovative technology, including connected prosthetics, MRI machines, and patient positioning systems for hospital beds. Security is a major concern when developing medical devices like these, software security in particular.
“You need to ensure that the software the device is running is valid software for that device. and was produced by someone who is authorized to give you software for that device,” says DornerWorks engineer Dan Rittersdorf. “We do that by signing the software with a cryptographic signature.”
Communication at the edge of the device can also invite risk. Software developers must consider what their device needs to communicate with, and ensure that communication is secure and authorized.
“It brings a lot of urgency to the classic security properties of confidentiality, integrity, and availability,” says engineer Kevin Kredit.
Kredit considers availability to be “a traditionally underrated security feature,” and an essential consideration in medical electronics.
One of the most prolific medical device failures occurred when vulnerabilities within St. Jude Pacemakers allowed malicious hackers to access a device. Once in, an intruder could deplete the device’s battery or change the rate of the shocks it produced.
St. Jude eventually released a software patch that solved the problem, but it couldn’t do as much to save the company’s reputation as a medical device manufacturer. This and other medical device companies must be increasingly vigilant in an effort to prevent such hacks from reoccurring, especially now that the types of threats have expanded to entire healthcare systems.
Incidents of hospital ransomware, in which healthcare operations are brought down by malicious hackers in hopes of extorting the victims, can have devastating effects. The intruders can deactivate hospital systems and prevent doctors and nurses from doing their work.
With any electronic medical device, data leaks are also security concerns. Along with potentially changing the information doctors rely on to make medical decisions, exposure of patient data can run afoul of HIPAA regulations. Especially now that there are so many ways electronic products can be accessed, whether it be via Wi-Fi, Bluetooth, or otherwise, security is all the more critical in medical devices.
Medical devices that can put lives at risk if they stop working must be designed with security checks that prevent any interruption of use from tasking place. Of course, some medical devices are less critical, and require less rigorous safety checks in the design.
The three classes of medical device software are:
Medical device development and eventual FDA approval can be a complex process, and rightfully so. The same products capable of saving lives and relieving pain also run the risk of causing injury and death when they fail.
The FDA’s “Content of Premarket Submissions for Management of Cybersecurity in Medical Devices” provides recommendations on cybersecurity measures that can help ensure medical device functionality and safety.
DornerWorks has guided a number of companies through development aligned to FDA standards, leaving them better positioned to obtain FDA approval and reach a successful launch.
The Espire Elbow was a unique challenge for College Park and helped the company make a big impact in the prosthetics industry. Being the first myoelectric device for the company’s development team, they called on DornerWorks to engineer the full product ecosystem.
DornerWorks worked with College Park and navigated the product development toward a mobile application for tablet usage that ensures the safety of patient data through Over-the-Air (OTA) updates. The Espire Elbow allows the patient ease of movement and practitioners a greater and immediate understanding of their patient’s issues, without worry of compromising their safety or disrupting use. Hardware engineers designed the main control and signal processing boards used in the device, each featuring a Microchip SAM E70 ARM microcontroller, while a Bluetooth module provides connectivity. The Microchip devices used for myo-control signal processing can compute complex math functions and perform real-time signal analysis simultaneously, while meeting the elbow’s stringent power budget requirements and making the most of its battery.
A medical product manufacturer developing a convenient new solution to administering anesthetic wanted to make sure the patient’s dosage data would be safe from tampering. DornerWorks guided the company to a hardware accelerated solution that improved accuracy and lowered size, weight, power and cost (SWAP-C).
When another medical device company was looking for a way to improve the capabilities of their bone healing stimulator device, DornerWorks engineers integrated a full-color LCD display with graphical user interface, encrypted USB communications, and a rechargeable battery, adding ease of use and portability to the device’s main features as well as improving performance.
With guidance from engineers who have been through the process before, you can be sure that your development is on track to change lives for the better, too. Contact us today and schedule a meeting with our team. We’ll help you map out a plan to turn your ideas into reality.
