Telehealth is redefining the interaction between healthcare providers and their patients. No longer restricted to in-person visitations, any individual with an internet connection can receive medical guidance. While these services were limited due to legislative obstacles in the past, COVID-19 has created a new paradigm that has made telehealth solutions a vital care delivery mechanism for patients of all types.
As promising as telehealth is, however, the same internet connectivity that fosters universal care delivery also creates susceptibility to cyber-attacks. It only takes one IoT device breach, account hack or man-in-the-middle attack to massively endanger patient and healthcare provider data.
The rush to cybersecurity must therefore be as rapid as the rush to telehealth. Device and app manufacturers must commit to true and holistic security that starts in app development and continues throughout all stages of patient interaction and care.
The specific vulnerabilities of telehealth care delivery
Most telehealth security concerns revolve around the principle of protecting patient personally identifiable information (PII).
Telehealth services need to be built on principles of data integrity and confidentiality. Both data at rest and in-transit must only be seen by authorized individuals. However, this is easier said than done.
Rapid adoption along with a shift to new communication and care delivery channels that do not have embedded security create significant vulnerabilities. In addition, while hospitals have made great strides to strengthen their own networks, patient home networks and internet connections are often replete with security risks.
Alongside this, individual devices meant for facilitating the telehealth process, including at-home patient monitors and other remote-care products likewise, often have no built-in security tools.
Cybercriminals will leverage even the smallest security flaws to achieve their goals and relying on unsecure network channels magnifies threats to patient PII. Any connected medical devices can be susceptible, including pacemakers, glucose monitors, implanted defibrillators, and many others.
There are a multitude of attacks cybercriminals may initiate. Similar to how they’ve used ransomware to shut hospitals out of key systems, they can also execute control over remote care devices and demand a ransom to resume normal operation. While doing so, they can steal patient PII or interrupt device functionality further intensifying the damage they can do.
For example, with SweynTooth, fraudsters can immediately block an IoT (in this case medical) device from working through exploiting Bluetooth security flaws in third-party code. This is only one of countless examples of what can go wrong when telehealth isn’t safely delivered which is why providers must incorporate security from the development stage onward.
Cybersecurity built-in into all stages of telehealth delivery
The health sector has long been vulnerable to cybercriminals. 2019 saw a 350% increase in ransomware attacks along with hundreds of data breaches that impacted tens of millions of patients. 2020 is no exception to this.
Telehealth services require security solutions that protect patient devices and data regardless of network connection or other external security factors throughout all stages of interaction and care.
Just as healthcare providers focus on data security within their offices, so must they incorporate it into telehealth platform development. In this PDF, we review the top six cybersecurity essentials that should be integrated into all telehealth platforms to ensure the safety and continued success of this increasingly vital healthcare delivery model.
