08 Apr Henry Ford Health makes bold IT restructuring to secure IoT and medical devices
Security chief Meredith Phillips says the health system reorganized internally to more effectively manage and secure 60,000 medical and Internet of Things devices, and to strongly position itself to handle evolving threats, such as ransomware.
Henry Ford Health System is taking far-reaching steps to block insidious cybersecurity threats against Internet of Things technologies and medical devices.
IoT and medical devices – well known to be soft spots in terms of privacy and security – are particularly tricky because most manufacturers have not yet incorporated robust security features into them.
“Organizations must examine if they have their clinical engineering department positioned correctly,” said chief information privacy and security officer Meredith Phillips. “Do they fit this department with IT or with facilities? We are at the beginning of that journey at Henry Ford. We have taken steps others are just considering.”
The big step started a year and a half ago when Henry Ford realigned internally to move the clinical engineering department – people and all the devices – out of operations and facilities and into the IT shop.
Every medical device has an IT component, and at Henry Ford Health approximately 80 percent of these devices handle or store some kind of health data. Henry Ford Health includes five hospitals, one of the nation’s largest physician group practices, a retail division, a 690,000-member health plan – and some 60,000 medical and IoT devices roaming around those.
“So we are ensuring medical devices are running across the most secure connection, are updated with patch management, and are part of our IT scope,” Phillips explained. “Prior to the move it was hit or miss. But we have taken this important step. Others are still thinking it through, and it admittedly can be daunting.”
In addition to moving its clinical engineering department under IT, Henry Ford Health System has been having in-depth discussions with the manufacturers of those 60,000 medical devices.