Cybersecurity Archives - InnoHEALTH magazine

Report on First Certificate Course in Cyber Security in Healthcare (CCCH)

InnoHEALTH Magazine — Thu, 27 Aug 2020 07:45:55 +0000

A Joint initiative by Public Heath Foundation of India and InnovatioCuris with support of Lions Club of India through Lions Coordination Committee of India Association (LCCIA)

Summary

The healthcare industry is frequently struggling with data breaches and other cybersecurity incidents. That’s likely because cybercriminals know the value of medical data. The new wave of digitizing medical records has seen a paradigm shift in the healthcare industry. With increasing digitization in the healthcare industry, we have become more vulnerable to data and identity thefts. In these difficult times, attacks from malicious actors may even rise, which means healthcare cybersecurity must remain a priority in 2020.

Cognizant of the importance of cyber security in healthcare sector, Public health foundation of India (PHFI) collaborated with InnovatioCuris (IC) developed a Certificate Course in Cybersecurity in healthcare (CCCH) with an objective to provide understanding of healthcare with cyber security aspects and to help participants start security initiatives in their healthcare facility.

A total of forty-two participants from all across the country underwent the training from 04th -07th July 2020. For this training, twenty-three participants from six state governments, two PSUs, three government bodies and one private diabetes association received nomination from Lions Club of India through Lions Coordination Committee of India Association (LCCIA) and nineteen participants were enrolled through self-nomination.

Feedback and evaluation are an integrated quality assurance tool to assess the impact and effectiveness of course. A concurrent session feedback and evaluation was done on all 4 days. The questionnaire was administered at the end of each module on all the 4 days along with end session quiz and an exit exam of 40 marks with objective questions was conducted after the last session. The exit exam result had an average of 79% which is well above the passing score (50% of total); indicating a 100% pass percentage.

Feedback study shows that 97% of participants were satisfied with the course content and provided a speaker rating of 8 on a 10-point scale. We received overwhelming testimonials from participants wherein they mentioned that they would recommend the course to their organizations.

There is always a scope for improvement and learning. The three areas we plan to work upon on the basis of feedback received is by adding more Indian case studies and emphasising more on digital health / telemedicine topic, increasing the speaker pool and addition of relevant government guidelines.

To increase the scalability and to maximize the benefits of training we would reach out to various state governments for nominations and dedicated batches. To improve the sustainability and impact of the course, endorsement from the relevant government agencies linked with cyber security is indispensable.

Introduction

Public Health Foundation of India (PHFI)

PHFI, a public private initiative was launched by the 14th Hon’ble Prime Minister of India on March 28th 2006 at New Delhi, India. Evolved through consultations of multiple constituencies, Indian as well as International academia, state and central governments etc., PHFI is a response to redress the limited institutional capacity in India for strengthening training, research and policy development in the area of Public Health. Structured as an independent foundation, PHFI has adopted a broad integrative approach to public health, following up with the training of numerous Healthcare Professionals under various capacity building initiatives in Chronic conditions since 2010.

For more information visit: www.phfi.org

InnovatioCuris (IC)

InnovatioCuris which is commonly known as IC is a unique organization, which brings deep healthcare expertise, a scientific rigour on applying global innovation models & management processes by leveraging IT to deliver healthcare at an optimum cost. In IC we have partnered with world class academic institutes, government bodies, NGOs and healthcare organisations to create a collaborative ecosystem for piloting new interventions (systems and processes) to improve healthcare delivery.

For more information visit: www.innovatiocuris.com

Lion’s Club International (India)
Lions are a global service network of volunteers that make a difference in their local communities. Lions Clubs is the world’s largest service club organization with more than 1.35 million members across 46,000 clubs in 209 countries. Lions Clubs was established in India, in Bombay, in February 1956. Lions Clubs in India are the second largest group of volunteers in the world after USA, with 6,335 Clubs and 2,35,000 members. Lions Club of India through Lions Coordination Committee of India Association (LCCIA) also joined hands with us towards providing full fee sponsorship to 23 participants.

For more information visit: www.lionsclubs.org.in

Curtain Raiser: Thought leaders’ conversation on Promoting Cyber Security in Health care

Public Health Foundation of India and InnovatioCuris organised an online event: Thought Leaders conversation on promoting security in health care on 10th June from 4pm to 5pm. We had the proud privilege of having Lt. Gen. (Dr.) Rajesh Pant (National Cyber security coordinator, Government of India), Hony. Brig Dr. Arvind Lal (Chairman and Managing Director of Dr. Lal Path Labs) and Dr. Harish Pillai, Group CEO, Aster DM healthcare, as the event panelists. Apart from the eminent panelists, we were fortunate to have thought leaders and dignitaries from NHSRC, NABH, State governments, PSU’s, corporate hospitals and various top academic institutes.

Dr Arvind Lal, MD, Lal Path Labs said, “we live in an Interconnected age. He mentioned three important points, the threat of ransomware is experienced regularly by the health sector. Second point was about patient data. How that the data is being traded in the black market. With Digital India enabling healthcare at last mile the threat to patient data is more real. The third issue is the connected healthcare, in terms of the medical devices and the healthcare would remain as the prime target for hackers. Ultimately it comes down to people and processes to keep this patient data absolutely secure. A comprehensive security awareness program can help healthcare facilities combat many of the security concerns discussed today. With the right resources and support from leadership security awareness training can teach the facility staff how to identify, how to avoid and how to report the hacking attack takes place.

Dr Harish Pillai, Group CEO, Aster DM Healthcare, shared his viewpoints, an extract of that is as follows: “Covid has led to healthcare providers jump to the bandwagon of telehealth without due diligence or due process in selection of the vendor, hardware and other components. But it is a change whose time has come. He seconded the view point of Dr Arvind Lal on patient data protection. Dr Pillai foresees that a lawsuit on breach of data privacy might open eyes of people in future, if the topic is not taken seriously. He highlighted cyber security issues arising in telemedicine, medical devices, home care and in general with the adoption of digital health. He suggested having mission mode task force to take up the issues of cyber security is need of the hour. The training program on cyber security as per him will go long way in safeguarding the health sector.”

Lt. Gen. (Dr.) Rajesh Pant, National Cyber Security Coordinator, India, responded to both the panelists by saying that data security topic is very important and the pending bill of Personal Data Protection Act in the parliament is going to be a big step in this direction providing a regulatory framework for improved security of citizen’s data. Also, the mission task force headed by him has produced the national cyber strategy this year. Health sector has been neglected as per him in past but COVID-19 has shown us how every component of economy is dependent on health sector. COVID-19 has also created an atmosphere of fear and uncertainty which is breeding ground for cybercrime.

He shared specific advice to healthcare providers which is as follows:

To have a dedicated Chief Information Security Officer, with two separate cells for IT and other on cyber security. So, that implementation and testing is not done by the same people
Allocate budget for cyber security, which is 10% of the IT budget

He concluded with three hard facts:

Vulnerabilities will continue to exist
Cyber-attacks will continue to happen
Attribution of these attacks will be difficult

Hence, similar to physical hygiene for COVID-19, cyber hygiene also gets utmost importance for the health sector! Cyber hygiene as per him covers a variety of measures like stronger passwords to a good cyber security policy in an organization.

Training model

In the age where cyber-attacks on digital infrastructures have become a daily affair, no country including India is resistant to such a global phenomenon. Disasters and pandemics pose unique challenges to providing health care.

Once the PDP and DISHA comes into effect, the healthcare organizations will need to comply with it at the earliest. Organizations in healthcare will have to conduct regular trainings for their personnel so that they can maintain compliance with the security protocols mentioned in India’s data protection law.

The course curriculum for the program developed by InnovatioCuris and PHFI comprises of four modules. The entire course curriculum contains pre-course reading material, power point presentations, case studies, assignments and group activities.

Course Objectives

Primary Objective

To provide understanding of healthcare with cyber security aspects and to help participants start security initiatives in their healthcare facility

Secondary Objectives

To provide basic knowledge of internet and cybersecurity
To establish understanding on cybercrimes in health sector
To help create cyber security policy for healthcare facility
To help the participant reduce errors and make healthcare facilities more secure

Salient Features

Course Pedagogy

The first batch of this 4 modular training was planned from 04th to 07th July 2020 with one session each day on zoom platform from 3.30 – 05:00 pm India Standard Time.

Criteria of Certification

The criteria for successful completion of the program is as follows:

Participation in all sessions of webinar series of 90 minutes
Appearance in end session quiz post completion of session
Appearance and clearance of final examination in the form of MCQ’s for 20 minutes, after Module 4 (Minimum 50% marks to be obtained in exit exam to be eligible for the certificate)
Submitting a brief self-assessment survey report (maximum 1-2 pages), within 08 days of course completion i.e. by 15th July (For LCI nominated participants)
Course Curriculum

Course curriculum

Session calendar

Course Design

Inaugural of the course on 4th July 2020

During the Inaugural ceremony of the course, Dr. Anuradha Aggarwal Monga welcomed all the delegates and participants and gave an overview of the Certificate course in Cyber Security in Healthcare (CCCH) followed by welcome address by Surgeon R. Admiral Dr. V.K Singh (Retd.), inaugural remarks by Lt. Gen (Dr.) Rajesh Pant, special remarks by Mr. Naresh Aggarwal and Prof. K. Srinath Reddy and ceremony was concluded by Vote of Thanks by Dr. Sandeep Bhalla.

Surgeon R. Admiral Dr. V.K Singh (Retd.), (Managing Director, InnovatioCuris), in his welcome address expressed his gratitude towards Lt. Gen. Rajesh Pant stating that he desired for cyber security initiatives in health sector and PHFI and IC provided impetus for this course. He welcomed all the dignitaries and highlighted the importance of cyber security in current times.

Lt. Gen Rajesh Pant (National Cyber Security Coordinator, Government of India) in his inaugural remarks complemented IC and PHFI on launch of the course and showed his gratitude on behalf of Govt. towards lions’ club for supporting this cyber security training by nominating participants from state governments, PSUs and other government bodies. He emphasized on the fact that Healthcare and research institutions are most targeted in cyber-crime and recommended that all hospitals should have Chief information security officer (CISO)and cyber security cell to prevent cyber-attacks. He propagated that sectoral cyber security training is a need of the hour as every sector needs different proficiency. He concluded by extending his full support for this training and stated that along with physical hygiene, cyber hygiene should also be practised.

Mr. Naresh Aggarwal [(Past International President LCI (2017-18), Immediate Past LCIF Chairman (2018-19), Board Appointee LCI (2019-20)] in his special remarks emphasized on the fact that Cyber Security is not just about protecting data; it is fundamental for maintaining the safety, privacy, and trust of patients. With increasing digitization in the healthcare industry, it has become prone to Cyber threats. So, training of healthcare workers on cyber security is of utmost importance and concluded by providing his appreciation to this initiative.

Prof. K Srinath Reddy (President, Public Health Foundation of India) in his special remarks stressed on the fact that cyber security has become inseparable from health security. He recognised the role of cyber space as important platform in delivering health services but at the same time cautioned that this valuable tool can be breached with data thefts and thus required to be protected so that health can be promoted in all directions. He emphasized that Cyber space offers plenty of opportunities to improve efficiency and outreach in health services, therefore we need cyber security as an important tool so that all efforts for health systems are adequately protected and promoted.

Dr. Sandeep Bhalla (Director- Training, Public Health Foundation of India) in his Vote of Thanks stated that health is the biggest investment in these trying times and expressed gratitude towards all the delegates for extending their support in this initiative.

(Anticlockwise) Mr. Naresh Aggarwal, Past International President LCI (2017-18), Immediate Past LCIF Chairman (2018-19), Board Appointee LCI (2019-20),) Prof. K Srinath Reddy, President, PHFI, Dr. Sandeep Bhalla, Director- Training, PHFI, Lt. Gen (Dr.) Rajesh Pant (National Cyber Security Coordinator, Government of India), Surgeon R. Admiral Dr. V.K Singh (Retd.), Managing Director, InnovatioCuris, Dr. Anuradha Aggarwal Monga, Program Manager, PHFI

Technical Sessions from 4th -7th July 2020

Each technical session was moderated by Dr. Anuradha Aggarwal Monga, Program Manager PHFI. At the beginning of each session, the moderator introduced the speaker and the topic of the day. This was followed by the one-hour session by the faculty using slides. During the session participants were free to type their questions in the chat box. Most of the questions were answered during the session only on the chat box. At the end of the session, the speaker summarized the key points and opened the floor for Q&A.

Post technical session participants attempted end session quiz through Microsoft forms link provided to them in chat box and on dedicated course whats app group. Speaker gave assignment pertaining to each module which was to be submitted by the participant next day by 10 am and analysis of quiz and assignment was summarized by the faculty in preceding session for invoking discussion and learning.

Closing Ceremony on 7th July 2020

On the last day of the training, Mr. J. P. Singh, International Director, LCI (2018-21), Chairperson, LCCIA (2019-20) was the guest of honour.

In his address, he saluted all the health workers for their tremendous job during this pandemic. He stressed that IT has become an integral part of every field, especially in healthcare. Mr. Singh appreciated the efforts of faculty in educating doctors in this field. He also appreciated that PHFI took care of this subject and came up with this initiative and was happy to be a part of this initiative.

During closing ceremony 04 participants gave their feedback for the course and shared their view about cyber security and its importance in these times.

Speakers

Mr. Sachin Gaur

He is a researcher cum entrepreneur in the space of mobile and Internet solutions. He was in the top 10 innovators in India under India Innovates Growth Programme 2013 by FICCI. He has a double M.Sc.(tech) in Mobile Security and Cryptography from Aalto University, Finland and University of Tartu, Estonia. He has worked in the past with organizations like Adobe, C.E.R.N. and in research at the Aalto University in security related topics.

Also, he has a dozen patents issued/pending in USPTO apart from contributing book chapters in two books on topics of Innovation and Healthcare.

Lt. Col. Satyendra Verma (Retd.)

An Army veteran who prides himself as a problem solver. He has a passion for technology which was amplified through extensive exposure to communication and Information Security during 23 years of service with Indian Army. Post retirement he has led important initiatives in Mobile and App technologies with startups as well as with a leading Industry body. Since 2017, he has focused on Indian Healthcare sector and through extensive interaction, gained unique insights on the state of Healthcare Data Security & Privacy in India. In 2018, he co-founded XScale Innovation, as a vehicle for his many innovative solutions, one of them being to help and support Information security in Indian healthcare sector. He is a Data Privacy expert and Certified Lead Auditor for Information Systems Security.

At 51, he is also an active sportsperson representing India as Captain of Indian Wingsuit team.

Participants

A total of 42 participants from all across the country underwent the training in this batch.

For this training, 23 participants from state governments, PSUs and other government bodies received nomination from Lions Club of India through Lions Coordination Committee of India Association (LCCIA) and 19 participants were enrolled on course fee through self-nomination.

Detailed participant list is given as annexure 2.

Outreach of Participants

Participant Profile

Gender Ratio :33% females and 67% males
Average experience of 14 years.
15 from the private sector, 22 from government, 1 from NGO and 4 are from PSU’s
Categories of Participants:
- Health Officials (Central, state, Public sector, Programs, etc
- Top Management (Owners, CIO /CISO)
- Practising/Resident Doctors (Private/Govt.)
- Managers (Quality, IT)
- Consultants (Private/Govt.)
- Professors & Students

Participant Survey, Feedback and Evaluation

A pre-course survey was done before the training initiation.

Out of 42 participants 38 answered the pre -course survey

Feedback Analysis

A concurrent session feedback and evaluation was done on all 4 days which intended to summate the feedback, satisfaction and experiences faced by the participants during the course. The feedback obtained will further enable to suitably modify the course curriculum content and delivery of future cycles of this course thereby strengthening the quality, going forward. The questionnaire was administered at the end of each module on all the 4 days along with end session quiz.

Exit Exam

The exit exam constituted 20 questions each carrying 2 mark, to be completed in 20 minutes. The result had an average of 79% which is well above the passing score (50% of total); indicating a 100% pass percentage.

In form of Multiple-Choice Questions
20 minutes ;20 MCQs
Minimum 50% marks required, i.e. 20
No negative marking

Participant Testimonials

Dr. Anagha S, Resident Surgeon, Karnataka

It was an eye opener for me, as I have just started my career in health care, I have many more years to go. I have learnt how important it is to practice cyber hygiene both on my personal gadgets and also on hospital systems. It is definitely going to help me in my future to safeguard my patient’s data and help the hospital I’m working in, to make it more cyber secure

Saravanan Sankaran, CIO, Aravind Hospital, Chennai

CCCH conducted by PHFI was a unique opportunity to understand the evolving demand on Cybersecurity in Health Care. The course content was certainly beneficial and was focused on the appropriate topics for Health care Professionals. My objective was met to understand the upcoming demand on Data Security and Protection in health care from the PDPA bill. My sincere appreciation to all the PHFI facilitators and to the instructors who kept the 4-day sessions very interactive and covering the concepts without technical jargons. I believe this course can be conducted for my organization staff.

Dr. Binit Shekhar, Senior deputy chief medical officer, NHPC

Course was very well designed, perceiving the cyber threat, which is looming large over the ever-increasing use of internet in healthcare services. It’s important to all the stakeholders of healthcare sector and encompasses all the people & processes. The content of the program provided a fair amount of information about the risks we are going to face in our day to day operations. The flow of the program alongside the end session quiz kept all the participants engaged and focused towards the objectives of the program. Certainly, every organization should have such useful and well conducted programs, with such knowledgeable and intelligent faculties, who made such technical subject so non-technical and easy to understand.

Dr. Jiffin T Thilakan, Malankara hospital, Kunnamkulam, Thrissur

As there is a new approach for medical consultation, its better late than never to know about the cyber hazards which will be faced by us. This course took me way beyond my expectation levels. The course material was simple and so digestible in a way that a common person could understand about it. If I get a stage to present this course in my hospital I will definitely give them a thumbs up.

Dr. Mandeep Sarma Basistha, Medical and Health Officer, Assam

We got a basic idea about cybersecurity in healthcare. Course is It’s beneficial and I am more enlightened. My objectives were fulfilled. I like the participatory approach. I would like to conduct the same course in my organization.

Dr Priti Elhence, Professor, Sanjay Gandhi Postgraduate Institute of Medical Sciences, Lucknow

It was a wonderful introduction to a relevant subject. Has made me understand the terminology / language of cyber science and provided a framework to understand the systems. The course was very well taught by learned speakers n well conducted by the moderators. As a novice student need more time to absorb the subject. Would also like the course to cover safe cyber practices for an individual. Would surely like to have this course conducted for my Institute. Thanks a lot!!

Annexures

1. Agenda of the inaugural ceremony and course

DAY 1- 4th July 2020
Inaugural of the course and conduction of Module 1
Time	Topic	Speaker
03:30- 04:00 pm	Inaugural ceremony of course
	Welcome address	Surgeon R Admiral Singh, VSM (Retd.) Dr. V.K Singh Managing Director InnovatioCuris
	Inaugural remarks	Lt. Gen (Dr.) Rajesh Pant National Cyber Security Coordinator, Government of India
	Special remarks	Mr. Naresh Aggarwal Past International President LCI (2017-18), Immediate Past LCIF Chairman (2018-19), Board Appointee LCI (2019-20)
	Special remarks	Prof. K. Srinath Reddy President, Public Health Foundation of India
	Vote of thanks	Dr. Sandeep Bhalla Director- Training Public Health Foundation of India
04:00 pm to 04:10 pm	Round of Introduction of participants
04:10 pm to 05:10 pm	Module 1: Basics of Internet and Cyber Security	Mr. Sachin Gaur Director Operations, InnovatioCuris
05:10 pm -05:30 pm	End session quiz followed by Q&A

DAY 2- 5th July 2020
Module 2
Time	Topic	Speaker
03:30 – 04:30 pm	Cyber Crime in Health Sector	Col. Satyendra Verma
04:30 pm – 05:00 pm	End session quiz followed by Q&A

DAY 3 – 6th July 2020
Module 3
Time	Topic	Speaker
03:30 – 04:30 pm	Cyber security: Policy, Process and People Part 1	Col. Satyendra Verma
04:30 pm – 05:00pm	End session quiz followed by Q&A

DAY 4 – 7th July 2020
Module 4
Time	Topic	Speaker
03:30 – 04:30 pm	Cyber security: Policy, Process and People Part 2	Mr. Sachin Gaur
04:30 pm – 05:00 pm	End session quiz followed by Q&A
05:00 – 05:10 pm	Closing Remarks	Mr. J.P Singh (International Director 2018-21, LCI) Chairperson – LCCIA (2019-20)
05:10 pm -05:30 pm	Exit exam

2. List of Participants

S. No.	Participant Name	Designation	Sponsoring State/Organisation
1	Dr Amjith E Kutty	State Quality Assurance Officer	NHM, Kerala
2	Dr Anagha S	Resident Surgeon	Karnataka
3	Dr B K Behera	Senior Specialist,Medicine	NTPC
4	Dr Bhavneesh Saman	Chief Medical Officer	NTPC
5	Dr Divya.V.S	State Nodal Officer – Training	NHM, Kerala
6	Dr Indumathi B	Resident Surgeon	Karnataka
7	Dr L Tilakeswari Devi	State Nodal officer Palliative, NHM & In Charge State Covid training, Lamphelpat	Manipur
8	Dr Rashmi N	Resident Cardiologist	Karnataka
9	Dr Y Premchandra Singh	SNO NCD. Medical Directorate. Lamphelpat	Manipur
10	Dr. Banamber Sahoo	Library & Information Officer	ICMR
11	Dr. Binit Shekhar	Senior deputy chief medical officer	NHPC
12	Dr. Daljit Singh Sethi	President, Meghalaya Diabetes Association	Meghalaya
13	Dr. Karamvir	Deputy Chief Medical Officer	NHPC
14	Dr. Kartik Shah	State Quality Assurance Medical Officer	Gujarat
15	Dr. Manas Som	Supdtt. CMS	Kolkata Municipal Corporation
16	Dr. Mandeep Sarma Basistha	Medical and Health Officer	Assam
17	Dr. Nabarun Majumdar	MO (P.M.U.)	Kolkata Municipal Corporation
18	Dr. Pallabi Barman	Medical Officer (Dental)	Assam
19	Dr. Priyanka Verma	MPH Student	ICMR
20	Dr. Rashmi Wadhwa	Consultant QI	NHSRC
21	Dr. Vaishali Sodagar	State Consultant-WASH in Health	Gujarat
22	Shri. Satyajeet Patil	State Data manager	Goa
23	Smt. Sneha Naik	State Data manager	Goa
24	Dr Beena KV	Additional Medical Superintendent	Self-Nominated
25	Dr Debadyuti Sahu	Post-MD PhD Scholar	Self-Nominated
26	Dr Duraimurugan Mariappan	Medical Consultant	Self-Nominated
27	Dr Hemant Phatale	Endocrinologist	Self-Nominated
28	Dr Jaffarullah Abdulla	Sr. CONSULTANT	Self-Nominated
29	Dr Jaigish Vyas	Medical officer class-2 (M.B.B.S., B.L.S.)	Self-Nominated
30	Dr Jiffin T Thilakan	Doctor	Self-Nominated
31	Dr Priti Elhence	Professor	Self-Nominated
32	Dr Priti Phatale	M.B.B.S.DCH	Self-Nominated
33	Dr Rajesh Pai	Medical Superintendent	Self-Nominated
34	Dr Ravi Chavan	Cardiologist	Self-Nominated
35	Dr Shimpa Sharma	Pro-Vice-Chancellor, Professor	Self-Nominated
36	Dr Shirish Ratnaparkhi	MBBS, DTCD	Self-Nominated
37	Dr Suvrat Gupta	Senior Resident	Self-Nominated
38	Dr Venkataramana Reddy	General Manager (Operations & Marketing)	Self-Nominated
39	Mr Dinesh TP	Assistant agricultural officer	Self-Nominated
40	Mr Savaranan Sankaran	CIO	Self-Nominated
41	Mr Yuvraj Baskaran	Software Support Executive	Self-Nominated
42	Venu Samudrala	Senior Legal Counsel	Self-Nominated

The post Report on First Certificate Course in Cyber Security in Healthcare (CCCH) appeared first on InnoHEALTH magazine.

Effectiveness of Cyber laws in India

InnoHEALTH magazine digital team — Wed, 08 Jul 2020 09:57:22 +0000

Effectiveness of cyber laws in India

In this era, we talk about privacy and its concern on a daily basis. Cybercrime refers to the crime in which a computer or network systems are the object of a crime or used as a tool for committing an offence. Cyber-criminals may use any means to gain access to personal information, trade secrets or for any other malicious purposes.

The basic educative question is what one should do when there is a cyberattack, this could include financial fraud, cyber bullying or any other cyber-crime. Fuelled by internet and mobile penetration, we have seen rapid growth of cyber-crime in India, giving rise to many unsolved cases. In India, Community Emergency Response Team (CERT) is the agency which takes care of collection, analyses information on cyber-attacks, forecasts and alerts for cyber incidents. One could report the incident on their website.

“Aurora Generator Test”, an experimental cyber-attack conducted in 2007, during which the researchers found that by altering the software of a power generator remotely, they could cause the turbines to set fire and thus eventually cause serious damage to the generator. These types of examples are a relevant threat from cyber terrorists on the Industrial Control Systems (ICS) and Building Control Systems (BCS). The question arises what type of forensics could be done and how can these cyber-attacks be prevented from happening again in the future?

Fastest growing threat is cyber terrorism, not only to individuals or organizations, but to nations as a whole, we must ensure that the correct methods of prevention are being taken into considerations. As there are no easy answers to this, and depending on the severity of the cyber-attack, it could take weeks and even months to determine the answers to these two questions.

This is due to the lack of resources or lack of motivation on an individual or organizational level. The answers could be found via the means of conducting various, in depth penetration testing exercises. This involves both getting into recon on potential threats and managing current threats accordingly.

An effective way to address these risks is to create a culture of security. Security culture refers to the set of values in terms of cyber security, shared by everyone in an organization. This determines how one is expected to think about it. Building security culture right will develop a security conscious workforce, and promote the desired security behaviours one wants from staff.

A simple checklist which could have dos and don’ts which could help the organization build a security culture. As said culture eats strategy for breakfast, once implemented to the core, 80-90% of the attacks could be prevented.

It is a tenacious effort of government and lawmakers to ensure that technology grows in a healthy manner and is used for legal and ethical business growth and not for committing crimes. Easier said than done, it takes a lot of effort to change the behaviour of human beings.

To start with the government and industry leaders should come into collaborations and start developing recognition and they should conduct events like Capture The Flag (CTF) activities and they should have problem statements on hackathon on cyber security.

Composed by Dhruv Singh, cybersecurity expert

Dhruv Singh is a self-professed ‘massive geek’ and renowned cyber security expert. Energetic, passionate, and charmingly nerd, has trained various institutions and defense organizations with a mission to empower them with cyber security. His passion to make cyber security accessible and interesting has led to develop a course on cyber security named Cyber4Hospital, available on Udemy with a vision to bring cyber index to India.

The post Effectiveness of
Cyber laws in India appeared first on InnoHEALTH magazine.

Thought leaders’ conversation on Cyber Security for Healthcare

InnoHEALTH Magazine — Tue, 16 Jun 2020 10:51:21 +0000

Thought leaders conversation on
PROMOTING CYBER SECURITY IN HEALTHCARE

Twenty-seven healthcare leaders joined the conversation on cyber security issues in the health sector. The program was opened by Dr V K Singh, MD InnovatioCuris with three eminent panelists, Dr Arvind Lal, Dr Harish Pillai and Lt Gen Dr. Rajesh Pant. Dr Sandeep Bhalla, Director (Training) PHFI and Mr Sachin Gaur, Director, InnovatioCuris presented the course curriculum and invited feedback and inputs from the experts on the initiative. Below is a short summary of the expert opinion on the topic.

Dr Arvind Lal, MD, Lal Path Labs said, “We live in an Interconnected age. He mentioned three important points, the threat of ransomware is experienced regularly by the health sector. Second point was about patient data. How that the data is being traded in the black market. With Digital India enabling healthcare at last mile the threat to patient data is more real. The third issue is the connected healthcare, in terms of the medical devices and the healthcare would remain as the prime target for hackers. Ultimately it comes down to people and processes to keep this patient data absolutely secure. A comprehensive security awareness program can help healthcare facilities combat many of the security concerns discussed today. With the right resources and support from leadership security awareness training can teach the facility staff how to identify, how to avoid and how to report the hacking attack takes place.“

Dr Harish Pillai, Group CEO, Aster DM Healthcare, shared his viewpoints, an extract of that is as follows: “COVID has led to healthcare providers jump to the bandwagon of telehealth without due diligence or due process in selection of the vendor, hardware and other components. But it is a change whose time has come. He seconded the view point of Dr Arvind Lal on patient data protection. Dr Pillai foresees that a lawsuit on breach of data privacy might open eyes of people in future, if the topic is not taken seriously. He highlighted cyber security issues arising in telemedicine, medical devices, home care and in general with the adoption of digital health. He suggested having mission mode task force to take up the issues of cyber security is need of the hour. The training program on cyber security as per him will go long way in safeguarding the health sector.”

Lt Gen Rajesh Pant, National Cyber Security Coordinator, India, responded to both the panelists by saying that data security topic is very important and the pending bill of Personal Data Protection Act in the parliament is going to be a big step in this direction providing a regulatory framework for improved security of citizen’s data. Also, the mission task force headed by him has produced the national cyber strategy this year. Health sector has been neglected as per him in past but COVID-19 has shown us how every component of economy is dependent on health sector. COVID-19 has also created an atmosphere of fear and the uncertainty which is breeding ground for cyber crime.

He shared specific advice to healthcare providers which is as follows:

To have a dedicated Chief Information Security Officer, with two separate cells for IT and other on cyber security. So, that implementation and testing is not done by the same people.
Allocate budget for cyber security, which is 10% of the IT budget

He concluded with three hard facts:

Vulnerabilities will continue to exist
Cyber-attacks will continue to happen
Attribution of these attacks will be difficult

Hence, similar to physical hygiene for COVID-19, cyber hygiene also gets utmost importance for the health sector! Cyber hygiene as per him covers a variety of measures like stronger passwords to a good cyber security policy in an organisation.

Apart from the panelists, valuable inputs were added by thoughtleaders and dignitaries from NHSRC, NABH, IIM, State governments, PSU’s, corporate hospitals.

Guest list

S.no	Name	Designation and Organisation
1	Hony Brig Dr. Arvind Lal	Chairman and Managing Director of Dr. Lal Path Labs
2	Lt. Gen. (Dr.) Rajesh Pant	National Cyber security coordinator, Government of India
3	Dr. Harsh Pillai	Group CEO, Aster DM healthcare
4	Mr. Munender Soperna	CIO, Dr. Lal Path Labs
5	Ms. Rashmi Pimple	Director, Life sciences, Research & Innovation Circle Hydrabad (RICH)
6	Col. Satyendra Verma	Director, Xscale
7	Dr. Partha Dey	Independent Consultant
8	Dr. J.N. Srivastava	Advisor, Quality improvement, NHSRC
9	Dr. Sangeeta Sharma	Professor & Head of Neuropsychopharmacology, IHBAS
10	Mr. Satish Kumar Kapoor	Chief Quality officer, Indraprastha Apollo hospitals
11	Dr. Sanjeev Kumar Singh	CMS, Amrita Institute of Medical Sciences Kochi
12	Dr. Suneela garg	Director Professor HAG, Ex Head (CM) Sub Dean, MAMC& Head Community Medicine, FMS
13	Dr. B.K Behera	Senior Specialist, Medicine, Corporate Medical Cell ,NTPC Ltd
14	Dr. Rajesh Chandwani	Faculty, Human Resource Management Area Chairperson, Centre for Management of Health Services (CMHS) Indian Institute of Management Ahmedabad
15	Dr. Atul Mohan Kochhar	CEO, National Accreditation Board for Hospitals & Healthcare Providers (NABH)
16	Dr. Kamla Fartyal	General Manager(Medical Services), NHPC
17	Dr. Kartik Shah	State Quality assurance officer, Government of Gujarat
18	Dr. Sandeep Bhalla	Director (Training), Training division, PHFI
19	Dr. Anuradha Aggarwal Monga	Program manager, Training division, PHFI
20	Dr. Vasudha Kalra Sharma	Program Coordinator, Training division, PHFI
21	Surgeon R Admiral Dr. V K Singh	MD, InnovatioCuris
22	Mr. Sachin Gaur	Director, InnovatioCuris
23	Dr. Pushkar Kumar	Senior Public Health Specialist, Training division, PHFI
24	Mr. Prashant Singh	Director, Coordination and Strategy Development, PHFI
25	Mr. Clarion	InnovatioCuris
27	Mr. Dhruv Singh	InnovatioCuris

Report by Sachin Gaur, InnovatioCuris

The post Thought leaders’ conversation on Cyber Security for Healthcare appeared first on InnoHEALTH magazine.

Webinar: Cyber and Data Security for Healthcare Establishments

InnoHEALTH Magazine — Tue, 10 Dec 2019 08:25:58 +0000

Title: Cyber and Data Security for healthcare establishments
Date: December 21, 2019
Time: 4 pm to 5 pm
Speakers: Satyendra Verma, Sachin Gaur
Organizers: CAHO and ICFHE
Register now
Introduction:

Healthcare is a vulnerable target for cybercrime because of two simple reasons; Firstly, it is a rich source of valuable data and Secondly, defenses are virtually absent in most healthcare establishments around the world and the case is no different in India.

The decision makers in the ecosystem are aware that Databreaches and attacks on medical devices can have severe consequences but unlike other sectors, the slow pedalling in this direction has little to do with lack of security budget or availability of methods to secure them but has more to do with the Gap in understanding among them.
This Webinar aims to help to demystify this topic with minimum technical jargon and demonstrate how no amount of technology or solutions can help unless they are preceded by clear Decisions & Directions from the Top Management. We will also share an innovative cybersecurity toolkit which can be used to do a quick in-house assessment of the Information Security Statues at your Healthcare establishments and how simple steps can resolve 80% of the Information/Cyber/Data Security issues.
Who will Benefit ? / Target Audience:

Top management
Decision makers
Owners

What it IS?

Attempt to Demystify the Subject for Top management.
Guided Quick Self Assessment of your Cybersecurity Status
Educate about forthcoming Indan Regulations related to Data Security
Explanation on which 20% of efforts can solve 80% of the problems.

What it is NOT?

Technical Details of Cyber Attacks.
Explanation of a particular solution.
Aimed at IT Managers

Speaker Bio:
Satyendra Verma
An Army vetran has an extensive exposure to Information System Security in his 23 years of service with Indian Army. After retirement, he has done extensive research to gain knowledge about the cyber issues pertaining to Healthcare and Education sector. He has conducted extensive training and workshops in Information Security in both the fields. He is ISO 27001, Certified Lead Auditor for Information Systems Security. He is also an active sportsman and the Indian Team Captain for Wingsuit Flying.
Sachin Gaur:
He has a double M.Sc.(tech) in Mobile Security and Cryptography from Aalto University, Finland and University of Tartu, Estonia. He has worked in the past with organizations like Adobe, C.E.R.N. and in research at the Aalto University in security related topics.
Register now for free

Also Read:
Exclusive Interview with India’s National Cybersecurity Coordinator
Don’t ignore the cyber threats in hospital. Enroll for the Cyber4Healthcare course on Udemy

The post Webinar: Cyber and Data Security for Healthcare Establishments appeared first on InnoHEALTH magazine.

Exclusive Interview with India's National Cybersecurity Coordinator

InnoHEALTH Magazine — Mon, 14 Oct 2019 05:23:08 +0000

Vision for cybersecurity: An exclusive interview with India’s National Cybersecurity Coordinator at Prime Minister’s Office

-Interviewed by Sachin Gaur, executive editor, InnoHEALTH Magazine

Lt General (Dr.) Rajesh Pant is an internationally recognized Cyber Security expert, presently tenanting the prestigious appointment of National Cyber Security Coordinator at the Prime Minister’s Office, India. General Pant brings to the table an interesting mix of military operations, academic excellence, corporate governance, and cybersecurity wisdom. Prior to this, he was the Head of the Army’s Cyber Training establishment for three years. He served in the Army Signals Corps for 41 years wherein he was awarded three times by the President of India for distinguished service of the highest order. He also served as the Chairman of Precision Electronics Ltd as a Governing Council Member of IETE (India). Sachin Gaur interviewed him on his viewpoint on India’s vision for cybersecurity.

Q. On behalf of InnoHEALTH Magazine, we congratulate you on your new assignment. For our readers, we would like you to share your short-term and long-term vision for Cybersecurity from national security perspective.
Short-term vision is to issue National Cyber Security Strategy 2020-25 early next year. Task force is working overtime on this by consulting all stakeholders. Long-term vision is to create an all-encompassing cyber vertical at the national level, to handle incident response, cybercrimes, legal issues and capacity building.

Q. We know that there are some fundamental technological shifts waiting to happen like 5G, and along-with it massive (Internet of Things) IoT deployments and especially use cases of connected healthcare. Can you share your views on the cybersecurity implications of the connected devices?
IoT security is a priority topic world over and this is because the limited security capabilities of these devices are also an afterthought. We need to work on a framework, to bring baselinesecurity through the manufacturers and developers of these devices. These devices are omnipresent in our lives, we find them in our home environment to industrial environments including hospitals. We have seen attacks in the past, where such devices are compromised to launch massive denial of service attacks to manipulate the workings of critical infrastructure.
Also, the issue of IoT security is multidimensional, from data security, privacy to device security. As we discuss this, there are multiple acts and bills pending in the Parliament on these topics. While the bills and acts will provide a framework, we need to also create awareness on both sides, supplier and consumer on the possible risks and mitigation strategies.

Q. What steps can be taken to improve the security in such connected devices?
When I say baseline security framework, it can be achieved in multiple ways.
As of today, most devices that we use including mobile phones, do not have a security testing certification. So, we can agree with the industry and look at important test cases and if they can do self-certification on such test cases.
For example: the device should not have weak default login credentials, it is sending data to a remote server and can be operated remotely. So, we can come up like a 5-star rating framework like that of the energy consumption but for the security of IoT devices basis what kind of tests they clear.
Industry bodies can agree on various levels of security and what it takes to achieve that level. Such a framework, when implemented, can provide confidence to consumers and users on the kind of device they are using vis-a-visthe use case they have at hand. So, they might use a higher security rating device in a use case where the stakes are high.
The other approach is to get the security testing done with notified agencies. Department of Telecom for example has announced mandatory security testing of network elements for telecom given telecom is a part of the critical infrastructure and security issuescannot be taken lightly.
Also, some of the emerging concepts in connected devices are missing in the various governing acts of the industrial connected devices. So, we also need to update our legal frameworks to cover software-based tempering of such devices and make the manufacturers and service providers accountable and proactive towards the security of the systems they provide.

Q. What are the threats that you foresee for the health sector?
There are three areas we see where health sector can be impacted:
First is the data breaches and ransomware attacks on healthcare data. As we know, among all the data, healthcare is the most sensitive and sought after by malicious actors. Outside of India, we have seen umpteen cases where ransomware has crippled the health system and it is only after paying the ransom the hospitals can start operation again. Timely backups and encryption of healthcare data during storage is a preventive measure that clinical establishments can take to mitigate the breach and ransomware attacks.
Second is the manipulation of connected devices. The topic of IoT and connected devices security, as discussed in the above sections, directly apply to the medical devices. Healthcare is a domain where attacks on such devices can be life threatening, especially when there are implantable devices. As we have the new Medical Device Regulation Act in India since 2018, we should also consider cyber security aspect in the devices which have a communication interface. For example, a pacemaker which has a communication interface can be manipulated remotely and the patient’s life is at risk.
Third is the manipulation of health system including the building management. We are probably not very far from the days when sophisticated attacks, as we see in the movies, on high security establishments by manipulating the building controls. The building management systems are very weak when it comes to security. Every hospital is a building and imagine what a false fire alarm would mean to patients in Intensive Care Unit. Or even loss of air conditioning or sudden spikes in electrical power.
There is a proposed act DISHA, Digital Information Security Healthcare Act, which might address some of the legal aspects of security in the healthcare setting. A lot needs to be done in this area, and we are on our way.

Q. Our readership consists of health experts all over the world. Any message for them?
We are at the cusp of a new age where we look to take advantage of Artificial Intelligence to Internet of Things. For such a knowledge economy to take off, health sector is at the center of it and health experts need to pay attention on what they are buying and how such systems are managed and operated. Through intervention of Ministry of Health & Family Welfare and responsible bodies such as National Accreditation Board of Hospitals & Healthcare Providers (NABH) of Quality Council of India, we plan to recommend a cyber audit and increased awareness of information security.
We would not want our hospitals and clinical establishments to be a prey for malicious actors. Rather we would want our experts to leverage technology to take the country to the next level in providing care to a wider population at a lower cost and of the highest quality.

The post Exclusive Interview with India's National Cybersecurity Coordinator appeared first on InnoHEALTH magazine.

The Vulnerability of Medical Institutions to Cyber Attacks

InnoHEALTH Magazine — Mon, 24 Jun 2019 10:39:58 +0000

McAfee’s researchers were able to modify the vital sign data in real-time providing false information to medical personnel by switching the heartbeat records from 80 beats a second to zero within five seconds. You would have woken up to news that Medstar patient records’ database was subject to ransom ware cyber attack and was asked to pay bitcoins. Unfortunately, the hospital did not have backup of medical records and in some cases, they had to turn away the patients. These incidents, unfortunately, are not stray incidents.

There are various technologies converging and a rapid increase in machine-to-machine communications. It is predicted that by 2025, most hospitals will have the ability to network connect more than 90% of their devices. However, many hospitals are yet to make their data security systems extremely robust. Data privacy and data security are the two important pillars that need urgent consideration. Just as financial data is loved by the cyber criminals, so is health data becoming a gold-mine with the cyber offenders. Specially so when the hospitals are run on legacy systems and there is no dedicated framework or surveillance on their own data.

Personally, identifiable data is an indicator of an individual, such as name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.Several cyberattacks on medical institutions are initiated to extract the electronic health records (EHRs) of patients. These EHRs may contain their personal health information, medical history, diagnosis codes, billing information, etc., which can be exploited by the cyber offenders in various manners, for instance to get ransom from the medical institutions or to create fake IDs to buy medical equipment(s) or medication which can be resold or exclusively sold on prescription.

Take this example. On 12 May 2017, a global ransomware attack, known as WannaCry affected more than 200,000 computers in at least 100 countries. The ransomware attack also affected 80 out of 236 trusts (medical institutions under NHS) and further 603 primary care and other National Health Service (“NHS”) organisations were infected with the ransomware virus including 595 general practitioners. The trusts which were affected with WannaCry ransomware faced issues like patient appointments being cancelled, computers being locked out, diversion of patients from accidents and emergency departments, etc.

As reported in the investigation report on the WannaCry ransomware attack on NHS, published by the National Audit Office (“NAO”, an independent parliamentary body in the United Kingdom), all NHS organisations infected with the WannaCry virus had unpatched or unsupported Windows operating systems. NHS Digital (a national provider of information, data and IT systems for commissioners, analysts and clinicians in health and social care in England) informed the NAO that the ransomware spread via the internet, including through the N3 network (the broadband network connecting all NHS sites in England), though there were no instances of the ransomware spreading via NHSmail (the NHS email system).

In India, as reported by multiple news agencies, last year in the month of June, the Mahatma Gandhi Memorial (a trust-run hospital) hospital, Mumbai (MGM Hospital) was affected by a similar cyber-attack where the hospital administrators found their systems locked and noticed an encrypted message by the attackers demanding ransom in Bitcoins to unlock it. It was reported that the MGM Hospital had lost 15 days’ data related to billing and patients’ history, though the hospital didn’t face any financial loss.

Once these cyber offenders have access to the EHRs, they hold the systems of the medical institutions hostage for ransom, by encrypting all the systems completely inaccessible and unusable for the victimised medical institutions. The vulnerability to such cyberattacks may account to various reasons, such as outdated digital infrastructure, medical personnel unaware or untrained about cyberattacks. Cyber offenders may gain access to medical institutions’ systems through various ways and sometimes as simple as (a) using a USB drive; (b) exploiting vulnerable or expired software, (c) stealing medical personnel’s mobile devices, (d) hacking email or (e) phishing, etc. It is time that our healthcare providers upgrade their technologies, networks, and understanding on this subject.

Regulatory bodies across the world have suggested / adopted guidelines and cybersecurity processes and controls which help the medical institutions to mitigate cyber risks and vulnerabilities. In this article, we will be primarily focusing on various safeguards and standards put in place by the European Union and India to deal with such cyberattacks.

SCENARIO IN EUROPE

As a part of the EU cybersecurity strategy, the European Commission standards to ensure necessary adopted the EU Network and Information Security Directive (“NIS Directive”) on 6 July 2016 and it came into force in August 2016. As the NIS Directive is an EU directive, every member state had to adopt a national legislation which would transpose the NIS Directive by 9 May 2018 and identify operators of essential services under the transposed law by 9 November 2018.

The NIS Directive has three major parts to it (a) national capabilities, (b) crossborder collaborations and (c) national supervision of the critical sectors including health.

(a) National Capabilities: The NIS Directive mandates every member state of the EU to have certain cybersecurity capabilities, e.g., it is a mandate for every member state to have a national Computer Security Incident Response Team (“CSIRT”).

(b) Cross Border Collaborations: The NIS Directive encourages collaborations between EU member states like the EU CSIRT network, the NIS cooperation group, ENISA etc.

(c) National Supervision of Critical Sectors: As per the NIS Directive, every member state shall supervise the cybersecurity of critical market sectors in their respective country including health sector.

Further, as a part of the NIS Directive the NIS cooperation group through ENISA has developed guidelines regarding (a) identification criteria of cyberattacks, (b) incident notification, (c) security requirements for Digital Signal Processors (DSPs), (d) mapping of operators of essential services (OES) security requirements for specific sectors including health and (e) audit and self-assessment frameworks for OESs and DSPs.

With a view to prescribe certain standards of safety and quality, three recognised EU standards organisations namely (a) the European Committee for Standardisation (CEN), (b) the European Committee for Electro-technical Standardization (CENELEC) and, (c) the European Telecommunications Standards Institute (ETSI) were set up. By setting common standards across EU, CEN, ETSI and CENELEC ensure protection of consumers, facilitate cross-border trade, ensure interoperability of goods/ products, encourage innovation and technological development, and include environmental protection and enable businesses to grow.

The General Data Protection Regulations (“GDPR”) specifically define ‘data concerning health’, ‘genetic data’ and ‘biometric data’ and regards them as ‘special category of data’. This means that parties who are processing special category of data shall comply with additional higher safeguards and process it legitimately. Recital 53 of the GDPR states that special categories of personal data which merit higher protection should be processed for health-related purposes only.

THE INDIAN SCENARIO

Personal medical/health information in India is regarded as sensitive personal information as per the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal data or Information) Rules, 2011 (“Rules”).

The Indian legislature took an important step for addressing issues relating to cybersecurity when it amended the Information Technology Act, 2000 in 2008, through which they established an Indian Computer Emergency Response Team (CERT), a national agency for incident response. CERT is primarily responsible for handling cybersecurity incidents occurring in India and analysing information related to cybercrimes, but among other things CERT is also indulged in issuing guidelines, advisories, vulnerability notes and white papers relating to information security practices, procedures, prevention, response and reporting of cyber incident.

CERT-India has been entrusted with performing the following main functions (a) collecting, analysing and disseminating of information on cyber incidents, (b) forecasting and giving alerts on cybersecurity incidents, (c) laying down emergency measures for handling cyber security incidents, (d) coordinating cyber incident response activities, (e) issuing guidelines, advisories, vulnerability notes and white papers relating to information security practices, procedures, prevention, response and reporting of cyber incidents, and (f) performing any other functions relating to cybersecurity as may be prescribed.

CERT-India in the last five years or so has focused on making various institutions who are highly dependent on cyber/digital networks, i.e. are ‘cyber resilient’. Being cyber resilient allows these institutions to effectively anticipate the various threats and figure out the mechanisms of dealing with the cyberattacks. Anticipate, withstand, contain and recover are the 4 main contours of being cyber resilient.

Anticipate: Maintain a state of informed preparedness to forestall compromises of mission/ business functions from adversary attacks
Withstand: Continue essential mission/business functions despite successful execution of an attack by an adversary
Contain: Localize containment of crisis and isolate trusted systems from untrusted systems to continue essential business operations in the event of cyberattacks
Recover: Restore mission/business functions to the maximum extent possible subsequent to successful execution of an attack by an adversary
Evolve: To change missions/business functions and/or the supporting cyber capabilities, to minimize adverse impacts from actual or predicted adversary attacks

To strengthen the framework and ensure that reasonable security practices and procedures are followed, the Department of Information Technology introduced certain rules. The rules require each and every corporate body including medical institutions who collect sensitive personal information to have security measures as documented in their security policy/programme which is considered to be a reasonable security practice, keeping in mind the nature of their business and considering the fact that they are collecting sensitive personal information. One such international standard as recommended under the Rules is the IS/ISO/IEC 27001.

Taking a step further, the Ministry of Health and Welfare has introduced a draft bill for Digital Information Security in Healthcare Act (“DISHA”). One of the key purposes of DISHA is to ensure reliability, data privacy, confidentiality and security of digital health data. DISHA prescribes that the storage of digital health data so collected would be held in trust for the owner and the holder of such data would be considered as the custodian of data, thereby making such holder responsible to protect privacy, confidentiality and security of data.

To bring it all together:

Majority of the cyberattacks reported worldwide are caused due to reasons which sometimes are trivial and perhaps ignored more often, such as outdated Windows operating system patch, lack of proper antivirus or reasons such as phishing, lack of awareness among the people about cybersecurity, etc.

The EU, through GDPR has made data security an integral part of law and India is taking strong steps to set up a robust data protection and data security law. Various regulations, programmes, codes, standards, etc., discussed in this article are some key indicate steps that can be implemented.

Law is just one part to solve the issue. The real question is who is responsible for safety of our personal data, commercial data, data assets, etc.? We secure our houses with a lock, burglar alarms, video cams because the house owner wants to protect it. Similarly, individuals, organizations, healthcare personnel, hospitals and other institutions who collect health data for multiple reasons should be aware of various cyber-threats and must take steps to safeguard their networks and systems from such threats.

About the author:

Sharda Balaji is the founding partner of NovoJuris Legal, and along with being a qualified lawyer is also a company secretary and has been at the core of evolution of technology and IT laws in India.

Manas Ingle is a legal associate at NovoJuris Legal and works as a technology lawyer, where he deals with various legal projects relating

The post The Vulnerability of Medical Institutions to Cyber Attacks appeared first on InnoHEALTH magazine.

Is “Smart” Technology a Saviour of Healthcare?

InnoHEALTH Magazine — Tue, 28 May 2019 09:18:22 +0000

The healthcare industry is continuously sprouting with the exponential evolution of technology such as artificial intelligence (AI), virtual reality (VR), and robotics, etc. These new areas of smart technology are expected to pose unswerving influence on the healthcare industry during the next couple of years.

Smart Health Technology is equipped to automatically obtain, store and compute health information from technically advanced sensors and offer personalized advice or automated actions from the collected data. This technology can interact and engage with data via Virtual or Augmented Reality to provide even more real-time experience for both, physicians and patients.

With the dissatisfaction among junior doctors reaching unprecedented levels (a staggering 80% feel excessively stressed) and the number of doctors progressing to specialty training dwindling to its lowest rate in the history of the National Health Service (NHS); these changes have never been more needed. In the event of NHS staff struggling to cope up with the growing demand for patient care, owing to the UK’s rising aging population, technology is seen as an enabler which will further propel healthcare professionals to work smarter, and not harder.

There are numerous opportunities for healthcare stakeholders/ manufacturers to innovate Smart Health Technology solutions, which are expected to streamline the precise medical care approach, e.g., telemedicine. However, there are also certain restraints in the regular healthcare system pertaining to infrastructure and adequate competencies to integrate Smart Health Technologies. Moreover, manufacturers and service providers need to ensure data security and adhere to global standards. Few of the latest applications of Smart Health Technology are Smart Apps, Smart Pills, Smart Syringes, Intelligent Fabrics, and Smart Wearable Devices.

Also Read:
AI and Cybersecurity in Digital Healthcare
World’s First AI powered Ayurveda Protocol

Smart Apps

The global smartphone users’ count is expected to surpass 2.5 billion by 2019. This exponential base of users is expected to influence the fate of health and fitness apps, which have already increased by more than 30% since 2016 (as on current date). It is estimated that almost 75% of current active mobile users run their health and fitness apps at least twice a week. With increased awareness among the mass population, people are leveraging technology to take better control of their health conditions such as asthma, infertility, obesity, and diabetes, etc. Moreover, the plethora of user data churned out from these apps are helping the market researchers access unparalleled volume of data for further in-depth and precise insights.

Smart Pills

The smart pill technology includes a wireless capsule, a receiver, and the software, which investigates and categorizes the gathered information from the patient who consumes the pill. It is an emerging technology, which is witnessing an upsurge in demand and is expected to show significant potential in the diagnostics domain in the future. The technology is used to detect gastrointestinal (GI) conditions and offers the physicians with information relating to several parameters such as pH, temperature and GI tract pressure.

For instance, the first digital pill -Abilify MyCite (approved in November 2017 by the US Food and Drug Administration) is used to track patients’ medication data. This is a venture between Tokyo-based Otsuka and California-based Proteus Digital Health (digital medicine service provider). The other key players operating in the smart pill technologies market include Novartis AG, Given Imaging Ltd., Philips Healthcare, Smartpill Inc., Olympus Medical Technology, Medtronic, Pentax Medical Co., Siemens Healthineers, Stryker Corp., GE Healthcare, and Boston Scientific Corp.

Smart Wearables

Smart wearable medical devices are small electronic products (consisting of sensors) which have computational competence. These devices are entrenched into items, which are attached to different body parts of the user. They can resemble watches, eyeglasses, clothing, contact lenses, shoes, or even jewelry.

Few of the latest smart health monitoring wearables in the global market include:

Apple Watch Series 4 (healthcare app)
Pebble Health (health monitoring app)
Zephyr BioPatch (wireless monitoring device)
Muse headband (brain-sensing monitoring headband)
AliveCor Heart Monitor (smartphone-based ECG device)
Garmin Forerunner 935 (GPS-enabled heart rate monitoring device)

Precisely, the Apple Watch Series 4 is embedded with an ability to automatically inform hospital service providers if a user becomes immobile for a stipulated period of time. This device assists people to become healthier, simultaneously storing real-time data which can be analyzed by healthcare professionals via remote patient monitoring, ensuring more precise and perceptive data for better healthcare practices. Moreover, AI can continuously monitor healthcare data and transfer the same to hospitals when necessary.

Conclusion

Upcoming healthcare technologies such as Smart Healthcare and AI are gradually renovating healthcare practices and are set to experience further innovations in the recent future. A significant number of healthcare experts are unquestionably banking on smart healthcare as a growing number of patients are keen to use these technologies and apps to improve their lifestyles. However, it is impossible to contemplate every research aspect of smart healthcare, considering its broad facets. Hence, as a result of the emergence of Smart Technology, healthcare stakeholders now should focus on imperative subjects such as security and privacy, ethics, training, biomarkers, genetics and personalized medicines, robotic-enhanced environments, human-computer interaction, and so on. The future is endless and exponential!

About the author

Victor Mukherjee is currently working as an Assistant Manager – Healthcare Practice, Infoholic Research

The post Is “Smart” Technology a Saviour of Healthcare? appeared first on InnoHEALTH magazine.

Cybersecurity Trends, Challenges, and Threats in Healthcare

InnoHEALTH Magazine — Tue, 28 May 2019 06:57:20 +0000

Likewise, the global trends, the growth of the Internet in India is incredibly fast-paced, with an estimated addition of 10 million active users each month. Along with the increase in the number of users, the adoption rate of going digital by various stakeholders in our society is also growing exponentially. Unfortunately, this also increases our vulnerability to potential hacks or security breaches that come from individual hackers to organized groups to even attacks from nation states. Cybersecurity, thus, entails protection of our cyberspace, and all the critical infrastructures like banking and finance, defense, healthcare, manufacturing, nuclear reactors, and commercial facilities from being the target to any sort of attack, damage, misuse or act of espionage.

The healthcare industry is particularly vulnerable to cyber threats not least because of the minimal amount of investment they put in cybersecurity measures. Hospitals, insurance companies, pharmacies, developers/ owners of healthcare websites, manufacturers of medical devices, or handsets, or third-party vendors to which sensitive patient data gets shared; all represent a leaky pipeline through which hackers can enter a system and cause extensive damage. The types of attacks can include access to patient’s medical history, prescriptions, financial and personal details or using the Internet of Medical Things to disrupt implanted medical devices or devices like drug infusion pumps. Healthy cybersecurity practices have, therefore, never been more important than today when a ransomware attack like WannaCry has the potential to literally shut down a country’s (UK) National Health Service.

Where India stands today?

According to the International Telecommunication Union (ITU), a UN telecommunications agency, India ranked 23rd amongst 165 nations on the Global Cybersecurity Index (GCI) in 2017. GCI ranks nations for their commitment towards cybersecurity using various measures – legal, technical, organizational, capacity building, and cooperation. With the rapid rise in cyber threats, India’s growing investment in protecting its data is absolutely a positive development. Nevertheless, a quick look at the current status on cybersecurity and data protection laws in India highlights the gap we must fill in as we move towards complete digitizing of various infrastructures in the 21st century.

For instance, it was last in 2000 when the legal provisions related to cybersecurity were formulated in the Information Technology Act (ITA) when the nature of threats revolved only around viral or malware attacks. The ITA was later amended in 2008 and now deals with cyber crimes such as hacking, tampering, data or identity theft, cheating, phishing, etc. Sections 43 and 63–74 provide provisions for civil and criminal prosecution in case of different cyber offenses. The ITA requires entities holding private data of users to maintain specified security standards and provides provisions to users for airing grievances in case of the data breach.

India established its first cybersecurity policy – the National Cyber Security Policy (NCSP), in 2013, after much mayhem caused by Edward Snowden’s allegations of NSA snooping on India. The policy designated CERT-In (Indian Computer Emergency Response Team), a national nodal agency to respond to and analyze incidents of cybersecurity breaches. CERT-In provides alerts of cybersecurity incidents, conducts emergency measures for handling such incidents, coordinates necessary response activities and issues guidelines, etc., regarding cybersecurity measures. In the case of a data breach, an organization holding confidential user data must report to CERT-In promptly.

Also Read:
Cyber4Healthcare: An Issue of Today & Tomorrow
DISHA – Need of the hour

Healthcare specific provisions

While the above-mentioned regulations provide a general legal cybersecurity framework for all the organizations, no separate provisions are in place viz a viz the healthcare sector. India decided to fill in this gap last year when the Ministry of Health and Family Affair, the Government of India proposed the Digital Information Security in Healthcare Act (DISHA) and placed it in public domain on 21 March 2018 for comments by various stakeholders. DISHA aims to ensure reliability, data privacy, confidentiality, and security of digital health data. The act, applicable to entire India except for Jammu and Kashmir, establishes eHealth Authorities and Health Information Exchanges at the state and national levels while also outlining the guidelines on standardizing/ regulating the processes related to the collection, storing, transmission and use of digital health data (DHD) in India.

Accordingly, DHD means any electronic record of health-related information

concerning the physical or mental health of a person
on any health service provided to an individual
on a donation of any body part of any bodily substance
derived from testing or examination of a body part or bodily substance
collected during providing health services
relating to details of the clinical establishment accessed by a person

DISHA also specifies the rights of the owner of digital health data, outlines the purposes for which DHD can be collected and explicitly mentions all clinical establishments holding DHD to be duty-bound in maintaining privacy and confidentiality of the patient’s data. Importantly, DISHA touches upon what constitutes a breach of digital health data, compensation in the event of one happening and what punishments an individual or a company might face if convicted of a cybercrime.

Marching ahead

The breach of data far more often in the healthcare sector compared to other sectors highlights the value of information stored in digital health records. It is, therefore, important that cybersecurity takes precedence for all the healthcare providers. Proactive measures include identifying likely targets, securing and updating systems in a timely manner, constant monitoring for malware or security breaches and reinforcing good user behavior among the employees. Similarly, the response to data breach incidents needs to be swift to minimize the extent of damage when a cybercrime occurs. Like the adage, ‘prevention is better than cure’, the healthcare providers also have a necessary task ahead of themselves to up their security measures in accordance with the current legal framework, before a patient’s data or the trust gets compromised.

About the author

Dr. Urvashi (Raheja) Bhattacharyya is a Senior Research Analyst at StudyMode. She indulges in machine-learning methods during office hours and enjoys writing about healthcare and education in her free time.

The post Cybersecurity Trends, Challenges, and Threats in Healthcare appeared first on InnoHEALTH magazine.

AI and Cybersecurity in Digital Healthcare

InnoHEALTH Magazine — Wed, 24 Apr 2019 09:07:46 +0000

All day all round we keep hearing the buzzwords such as Artificial Intelligence (AI), Machine Learning (ML), deep learning cybersecurity, etc. But do we really know what these are? Should we really be bothered and aware of how these can change the healthcare industry? To answer and brainstorm on such questions, the InnovatioCuris team gathered on a beautiful Saturday morning on 6 April 2019 in one of India & premier institutions in Hospital and Health Management, Indian Institute of Health Management Research (IIHMR), Delhi.

The meeting witnessed some very eminent and influential speakers from around the healthcare sector. The former Enforcement Director (ED) Karnal Singh who has investigated many high- profile cases graced the meeting as the Chief Guest.

Innovation is exciting and there are more innovations happening in the private sector, and with increasing technology come increased risks. With the rapidly growing technology, ranging from wireless devices such as mobile phones, tablets, and laptops to smart refrigerators, cars, and even medical devices like pacemakers, etc., it seems that the growing connections around us are difficult to detect. Therefore, the risk that comes together in operating within this brave, new and a connected world is high.

Shri Karnal Singh shared his expert viewpoint on the impact and importance of artificial intelligence, connected healthcare and need for cybersecurity in healthcare. How the digitization of healthcare is important and the rural and urban divide of same. He also insisted on the improvement of infrastructure and facilities available in the rural healthcare industry. In addition, he discussed the gap between the medical industry and government institutions where the research is needed and that we adopt mostly from our partnering and supporting foreign countries and how a change in mindset and adoption of new and improved technology can enhance the Indian healthcare. The future of healthcare is on the Internet and the Internet is vulnerable. Technology is the solution and it will come whether we want it or not. Therefore, the need of the hour is OUR PREPAREDNESS. We should welcome and be prepared for the connected network of healthcare.

An interesting session on the basic concepts of AI was the icing on the cake. It acquainted the participants with AI emphasizing on the fact that one should not get bogged down by the technology. Instead, one should focus on the use cases of it and there lies the innovation.

Often, the terms “digital health” evoke images of smartwatches or apps that can process the health data and can give a readout of parameters like heart rate, blood pressure, etc. That is a part of digital health, to be sure, but today we also focus on a newer aspect called “Precision Health” and the session “Prerequisite and journey of India to offer (precision) healthcare to all: Powered by Digital, Genetics, and AI” offered a far more expansive vision for digital health technologies, genetics and AI.

Precision medicine is an emerging approach of medicine which focuses on the cause of an illness, and not addressing the symptoms alone. Precision medicine may not be very well- known as Personalized Medicine. But they are the same. It takes into consideration individual variability in genes, environment, and lifestyle for each person.

Precision healthcare improves efficiency and accuracy to healthcare treatments. With precision healthcare, doctors can potentially develop targeted and precise treatment and therapies for masses as well as for an individual. This can improve patient treatment to large populations in countries like ours.

It’s based on evidence and data which comes from a series of medical tests on a patient. Thus, the data is its most important aspect. Very soon, along with genome sequencing and health sensors data coupled with the growing amount of Big Data, patient data will create large data sets of valuable information which can be used for more tailored treatments. But as an individual, a physician is not equipped to manually analyze these newly available data sets, which is where the advanced technologies such as AI come into picture.

The challenge that the clinicians see in the adoption of AI is the gap between the technical person and a clinician in regard to understanding the implementation of “normal reference values”. For example: If the normal value of hemoglobin for a person staying at planes (say Delhi NCR) is 13.5, the value 17.5 is perfectly normal at Ladakh. Is that incorporated in the AI system? Something that works in the USA might not work in India. The doctor or a clinician will have a great role to play in case of developing the AI as he/she can only give the correct inputs for the training sets.

With the new wave of digitization, medical records have seen a paradigm shift in the healthcare industry. As a result, the healthcare industry is witnessing an increase in the absolute volume of data in terms of complexity, diversity, and timeliness. Since the healthcare experts look for every possible way to lower the costs while improving the care process, delivery and management, and so is the aim of InnovatioCuris (IC), big data emerges as a persuasive solution with a promise to transform the healthcare industry. This paradigm shift from reactive to proactive healthcare may result in an overall reduction in healthcare costs and gradually may lead to economic growth. The above-stated and many more discussion points were there that became the part of the very interactive and interesting second session on “Mitigating data security and privacy challenges for digital healthcare in India”.

Data transmission is also an important aspect of implementing technology and safeguarding it. The Digital Information Security in Healthcare Act (DISHA) is one such step taken by the Indian Government in the long journey to securing the healthcare data of patients in India.

One of the biggest challenges is the lack of availability of data in a democratic manner and it’s all in silos in short data interoperability is a huge challenge. The major concerns that the clinicians have at the moment regarding the implementation of DISHA act are that it says that no court shall entertain any complaint unless made by the Central Government or central data authority, state data authority or the person affected and there would be times when PIL (public interest litigation) is there on the data security as well. The challenges will always pertain but what we need to do is to have trust in the law and protection by it. Major challenges regarding data security or cybersecurity, in hospitals or the clinical establishments, is that we do not have implemented laws that may protect our data. With the hope that they are definitely going to come, we can only stay prepared with our changed mindsets.

The post AI and Cybersecurity in Digital Healthcare appeared first on InnoHEALTH magazine.

Cybersecurity Bootcamp for Hospitals

InnoHEALTH Magazine — Wed, 17 Oct 2018 06:33:55 +0000

Cybersecurity is becoming a part and parcel of our daily life. The theft of private, financial, or other sensitive data and cyber attacks that damage computer systems are capable of causing lasting harm to anyone engaged in personal or commercial capacity. Cyber security in the healthcare industry has the biggest share of the pie. They are struggling to keep themselves secure.

Considering this issue Consortium of Accredited Healthcare Organization (CAHO) and InnovatioCuris (IC) jointly organized Cybersecurity Bootcamp Training for Hospitals’ at M.S. Ramaiah Advanced Learning Centre in Bengaluru, India on 30th September, 2018. Personnels from eighteen hospitals from various parts of the country attended the bootcamp. Personnel included CXOs, hospitals administrators, IT staff and a few doctors.

Also Read: Ransomware Epidemic – Who is next?

What hospitals learned?
To enhance cybersecurity capabilities at hospitals, attendees learned

Cyber threats landscape for hospitals: Dysfunctioning of medical devices can be catastrophic. Imagine, hackers take control of one’s pacemaker and ask for ransom or else they would manipulate the device which could be fatal. This kind of attack has been showcased in the very famous TV show Homeland wherein the Vice President dies due to hackers remotely disabled his pacemaker.

Cyber vulnerabilities and their protection: Many healthcare enterprises have the legacy or antiquated devices that are running outdated software or operating systems. This is the easiest path for attackers lie in the integrated building management, physical security and clinical devices. Healthcare networks are often designed to minimize cost and maximize efficiency, creating flat networks that are easy targets for attackers. Everything else takes a back seat, often including cybersecurity. Healthcare organizations are hyper-focused on their primary mission – saving lives and helping patients – and cybersecurity risks aren’t on the forefront of their minds. Many healthcare enterprises leverage external third-party vendors to manage and run their systems, which can introduce a significant amount of risk.

Ransomware: Ransomware epidemic is spreading in healthcare like wildfire due to its increasing digitalization which is and will attract more attention of hackers. The healthcare industry has been a victim of various cyber attacks in the last few years. According to recent studies, healthcare has outnumbered financial services and become the most cyber attacked industry. The latest in cyber-attack is ransomware wherein the hacker encrypts the data and threatens to publish it until the ransom is paid in form of bitcoins. In US alone, healthcare industry was the victim of 88 percent of all ransomware attacks across industries last year.

Medical devices security framework: The five star medical devices cybersecurity framework: Safety by design, third-party collaboration, evidence capture, security updates and segmentation & isolation.

Healthcare compliances: Healthcare compliance requires healthcare organizations and providers to develop effective processes, policies, and procedures to define appropriate conduct, train the organization’s staff, and then monitor the adherence to the processes, policies, and procedures.

To learn about the problems of the attendees and hospitals, a group task was conducted. This helped us know better our participants and provide viable and tangible solutions. Discussions were made about the immediate threat they have, how they cater them and what more steps can be taken to serve their needs in a better manner.

‘In the world of cybersecurity, the last thing you want is to have a target painted on you.’ – Tim Cook

For more information reach out to us at info@innovatiocuris.com

The post Cybersecurity Bootcamp for Hospitals appeared first on InnoHEALTH magazine.

Cybersecurity Archives - InnoHEALTH magazine

Report on First Certificate Course in Cyber Security in Healthcare (CCCH)

Summary

Introduction

Curtain Raiser: Thought leaders’ conversation on Promoting Cyber Security in Health care

Training model

Course Objectives

Salient Features

Course Pedagogy

Criteria of Certification

Course curriculum

Session calendar

Course Design

Inaugural of the course on 4th July 2020

Technical Sessions from 4th -7th July 2020

Closing Ceremony on 7th July 2020

Speakers

Participants

Outreach of Participants

Participant Profile

Participant Survey, Feedback and Evaluation

Feedback Analysis

Participant Testimonials

Dr. Anagha S, Resident Surgeon, Karnataka

Saravanan Sankaran, CIO, Aravind Hospital, Chennai

Dr. Binit Shekhar, Senior deputy chief medical officer, NHPC

Dr. Jiffin T Thilakan, Malankara hospital, Kunnamkulam, Thrissur

Dr. Mandeep Sarma Basistha, Medical and Health Officer, Assam

Dr Priti Elhence, Professor, Sanjay Gandhi Postgraduate Institute of Medical Sciences, Lucknow

Annexures

1. Agenda of the inaugural ceremony and course

2. List of Participants

Effectiveness of Cyber laws in India

Effectiveness of cyber laws in India

Thought leaders’ conversation on Cyber Security for Healthcare

Thought leaders conversation on PROMOTING CYBER SECURITY IN HEALTHCARE

Guest list

Webinar: Cyber and Data Security for Healthcare Establishments

Exclusive Interview with India's National Cybersecurity Coordinator

Vision for cybersecurity: An exclusive interview with India’s National Cybersecurity Coordinator at Prime Minister’s Office

The Vulnerability of Medical Institutions to Cyber Attacks

About the author:

Is “Smart” Technology a Saviour of Healthcare?

About the author

Cybersecurity Trends, Challenges, and Threats in Healthcare

About the author

AI and Cybersecurity in Digital Healthcare

Cybersecurity Bootcamp for Hospitals

Thought leaders conversation on
PROMOTING CYBER SECURITY IN HEALTHCARE