The inaugural session was addressed by Dr. V K Singh, Managing Director, InnovatioCuris Pvt. Ltd., who set the tone for the conference by raising the genuine questions as how one can create healthcare delivery at optimum costs. He emphasized on working with grassroot innovators. In his speech, he also warned the young innovators to trust the technology only up to a limit.

Our guest of honor, Lt General (Dr.) Rajesh Pant, National Cyber Security Coordinator,Prime Minister’s Office, Government of India, in his special address quoted Mark Twain’s quote, “Gutenberg’s invention created heaven, and along with it a new hell”. He related this saying by how it applies equally to technology. As the technology has given us new horizons and ways to live, it has alongside created problems too.

Dr. Yasmin Ali Haque, UNICEF India Representative in her introductory address, gave a brief overview on the how unmet needs, especially in health sector become the mother of innovations and how technology can be a solution to address those innovations. She insisted on the use of scalable technology as to how it can be made accessible to millions of people. Referring to this, she talked about the 2030 agenda for sustainable development. The world has resolved to leave no one behind in fighting extreme poverty and preventable child deaths.

Mr. Karnal Singh, Ex-Enforcement Director, India raised during his speech Narayana Murthy’s concern that there have been no recent innovations from India. “Are we so bad?” He said we would have to think differently for finding solutions. The education which we receive in our country is more competitive than collaborative.There are many unmet needs in health sector, for example, for majority of injections, cold chain is not maintained. It’s been a long time that we could have insulin tablets rather having the existing insulin injections. India, prominently being an agricultural land faces a major unmet need of water requirement, which is only 50% against the 80% requirement. He acknowledged that 2010-2020 has been the decade of innovations for India. To everybody’s pride, the ranking of India in the global innovation index has improved by five places to 52nd in 2019 from 57th position last year.

Sachin Gaur, Director Operations, InnovatioCuris, took the opportunity to drive everybody’s attention towards the trust deficit which persists in medical community and equity of stakeholders. He insisted on developing a common language within the medical fraternity to which Artificial Intelligence (AI) can be a probable answer.

The forum manifested remarkable heterogeneity with its speakers from various realms across the globe. The second session on “Innovations for hospitals and insurance companies” was very interestingly structured as a free-style discussion.

Mr. Mohan Krishnan introduced the discussion with a brief presentation on the global trends in healthcare and their affordability. He particularly emphasized on access to healthcare resources and quantity shortage in India. He highlighted how lifestyle associated diseases have taken over the communicable diseases. He discussed the key trends in supply dynamics, their relationship to healthcare sector, and the challenges and opportunities for their future implementation. The functional and central aspect of this session was majorly about healthcare which is accessible and affordable to the masses. Other key points that emerged during the session are outlined as:

• switching of communicable to non-communicable lifestyle associated diseases
• lack of medical care in rural areas
• Ayushman Bharat Yojana or Pradhan Mantri Jan Arogya Yojana or National Health Protection Scheme: one of the largest and promising healthcare initiatives which aims to address healthcare holistically
• patient feedback must be a pre-requisite while thinking of the innovations which can fulfill the unmet needs
• biggest challenge in healthcare is information symmetry
• one of the most remarkable point that came up was that the healthcare provider should be “paid to prevent”, and not paid to cure
• 5 P’s should be prioritized: People, Plant (equipment in hospitals), Processes, Premises, Patient care

This enlightening session focused on four most important factors, viz., better health outcome, better patient experience, better staff experience and better costs.

The tone of the next session on “Innovations in medical devices and diagnostics” was set by majority of doctors. The diagnostics could be done by the help of paramedics or people other than doctors and then they could be replaced by automated systems or AI. There are schemes such as Ayushman Bharat, which give accessibility to each one. The innovations could be patient centric, healthcare centric or in terms of sustainability. The focus was on trends impacting medical devices and diagnostics, for example, lab-on-chip, wearable health monitoring devices, AI, 3D printing, etc.

The tone of the next session on “Innovations in medical devices and diagnostics” was set by the majority of doctors. The diagnostics could be done by the help of paramedics or people other than doctors and then they could be replaced by automated systems or AI. There are schemes such as Ayushman Bharat, which give accessibility to each one. The innovations could be patient-centric, healthcare centric or in terms of sustainability. The focus was on trends impacting medical devices and diagnostics, for example.

The brainstorming session provided meaningful insights into the remedies which innovations can bring to the unmet needs in healthcare. Prime Minister’s health and wellness program were much talked about. Challenges in the not-much-explored area of management of blood banks were discussed. The lack of a centralized system of blood banking is a major concern.

The role of medical robotics, which is a type of disruptive technology, is very fascinating. The thought of switching from open surgery to key-hole-surgery to no-hole surgery is in fact very intruding. Another major concern across the globe is diabetes and how the diabetologists across the nation are ignorant in not examining the feet of their diabetic patients as 30% of the diabetics suffer from severe foot diseases. There are ample cases of diabetic amputation, which must raise an alarm within the diabetologists.e lab-on-chip, wearable health monitoring devices, AI, 3D printing, etc.

The fourth session was a very inspirational one wherein the dais had seven women innovators, each one unique in their own fields. As Prime Minister Modi once said, “The progress of humanity is incomplete without the empowerment of women.
”InnovateHER gave a common platform to few wonderful women where they shared their stories of inspiration, falls, and experience. This session was indeed a beautiful stretch of one hour where these women from varied backgrounds and aspirations showcased their expertise and their words gave hope, path and motivation to everybody present in the auditorium. They were an epitome of women empowerment and proved it greatly “Komal Hai Kamzor Nahi Tu, Shakti Ka Naam Hi Naari Hai, Jag Ko Jeevan Dene Wali, Maut Bhi Tujhse Haari Hai”.

Ms. Shriya Sethi, presented detailed statistical data on women entrepreneurs, about emerging trends in healthcare innovations, the existing lacunae and the current scenario of general well-being of people.

Ms. Priya Prakash, Founder & CEO, HealthSetGo, was one of the youngest innovators, who herself realized at a very tender age, the importance of good health. This drove her to initiate her existing foundation, which focuses on the wellness of children. “If the kids are healthy in the first place, the coming young generation would be disease-free”, was her take on the evolution of her organization.

Another eminent panelist Ms. Preeti Rao, Founder & CEO, Weljii, inspired everybody around to focus on being healthy. Instead of talking about the illness, she emphasized more on how people must take care of their wellness which includes both physical and mental health.

Ms. Veena Sehgal, a pharmacist and entrepreneur mentioned the gap in the availability of medicines which the doctor prescribes. They are most of the times available on area-specific basis which makes it difficult and time consuming for the patients. There should be an emphasis on generic medicines, rather than brands.

Amidst such tech gathering which had brought together so many thought leaders and experts alike; we had between us few young innovators. These innovators with their priceless ideas and vision delivered their pitches to make their candidature remarkable in its unique way.

The candidates included Priya Prakash (HealthSetGo), Yogesh M (Hybrid effluent water system technology), Saiprasad Poyarekar (spray-on skin tissue), Ashish Sharma (Drip monitoring system) and Vijay Kumar Kumawat (Microporous implants). With their unique set of products/services, the candidates made it difficult for the jury to decide on the winners. Saiprasad with his technological advancement of spray-on skin tissues to get rid of minor-to-severe burns grabbed him the award for best innovator pitch. He was followed by Vijay Kumar, as 1st runner-up and Priya Prakash as 2nd runner-up.

The next session was a special one dedicated to diabetes, one of the most worrisome chronic diseases across the globe. The speakers talked about how to monitor, control and manage the disease.

Dr. Arjun Dang, CEO, Dr. Dangs Lab, who was chairing the session referred India as the “diabetic capital of the world”, referring to the alarming scenario of the affected Indians wherein around 16 million Indians are affected with Type 2 diabetes, and this number is expected to rise to more than 100 million in the next ten years. He also insisted not to commoditize healthcare, rather consider it as a service which requires a lot of compassion and empathy.

One very relevant question that came up was that “Why Indians are most prone to diabetes?”. Probably it is because of the harmful oils and highly processed foods available in the Indian markets. Stress is a huge component in diabetes management. Exercise and breath-management (pranayama, etc.) have a major impact on diabetes management. One of the major contributors of diabetes is non-nutritional food. Sleep which is often understated has a direct impact on blood sugar level which increases due to lack of proper sleep. Diabetic patients can improve only to fall back again into the same pit and destroy their health, hence it is of utmost importance to rescue them.

Among the highlights of the next session, “India Global Collaboration in Health Sector: Start-up Opportunities and Challenges” were the long-term Australia-India collaboration goals in the field of Science and Technology. To seek the answer to the question, “What can India offer to countries in the panel and what do the countries have to offer for India?”, let’s read next.

Dr. Jukka Holappa, Commercial Counselor, Country Manager India at Business Finland, shared the current status of healthcare in Finland. He spoke about the excellent condition of R&D in Finland, among which ten large companies are Indian.

Dr. Shiban Ganju, shared that he has come to India because India is “where all the action is happening right now”. He talked about traditional medicines in India, differential pricing of products across various countries. The innovators must focus on “frugal innovation”, for providing the best of healthcare.

Ms. Sharda Balaji, a lawyer by profession highlighted the importance of mobile penetration which is the largest in the world in India. There have been tectonic shifts happening in technology. She discussed how India is all about affordability and value consciousness. The concept of “jugaad” or making things doable work well in India. This is where a lawyer is needed to license the product(s). The major challenge she mentioned in India is lack of connectivity with deep science and research across geographical locations within the country due to its enormous size.

Much was talked on the existence and emergence of the digital health in the intriguing session on “Digital Health: Giving Birth to New Delivery Models through Mobile, IoT, Blockchain and Artificial Intelligence”.

Mr. Jacky Ovadia, General Manager, IDEA (International Innovation & Business Development expert), Israel shared with the audience his viewpoint on advancement in telemedicine. There must be portable medicine devices which can effectively check pulse and nerves very easily. He mentioned about remote monitoring for ultrasound, pregnancy, pulse checking, and clinically approved digital urinalysis. He said that a concept which uses GPS to monitor patients’ activities and habits can have varied impact on people’s lives.

Way forward

With such inspirational, informative and interactive sessions, the two-day conference came to an end, raising too many new questions and challenges that may impact healthcare, especially in India. It also gave answers to many existing issues through the numerous innovations that were presented. The generic thought which probably each one had was on the affordability and accessibility of good healthcare. If the innovations are not scalable, easily accessible and cost-effective to the masses, they cannot persist for long.

Of utmost importance were the views on how AI can save lives, and the importance of end-to-end affordable healthcare. IoT can connect to anyone, anytime, anywhere in rural and urban areas where reach is low, and how AI helps in diagnosis and innovation. Early intervention can resolve health problems and there is a huge scope in the use of the apps which can enable timely and real time intervention. With highly potential schemes like Ayushman Bharat, we can create value chain in affordable and accessible healthcare for everyone.

The healthcare sector sees immense opportunities with the innovations happening across the globe. Innovation pitches from global and Indian companies that were conducted wherein organizations from various sectors came forward to present their portfolio of services and products.

Innovators and researchers are working on various aspects wherein they can target various chronic as well as lifestyle associated diseases. For example, the Nano 4 TB kit helps detect TB easily. There are various state-of-art laboratories across the nation which are deployed and use high-end technology, for example next generation sequencing is used to perform operations to detect aneuploidy or any kind of anomaly which is responsible for spontaneous miscarriages and mental retardation in live born babies. In the light of technology, innovation and healthcare, we must look at technology with a business view; how technologies work in society, sustainability of the model with traditional delivery, and about new models in healthcare.

Read past InnoHEALTH conference press release:
InnoHEALTH 2017
InnoHEALTH 2018
Also Read: Press Release: The International Medical Travel Show Dubai 2020

About the author

Dr. Jasmeet Chhabra is a Doctorate in Immunology and whenever she gets free time from the full-time job she loves to read and write about imperative issues in healthcare.

The meeting witnessed some very eminent and influential speakers from around the healthcare sector. The former Enforcement Director (ED) Karnal Singh who has investigated many high- profile cases graced the meeting as the Chief Guest.

Innovation is exciting and there are more innovations happening in the private sector, and with increasing technology come increased risks. With the rapidly growing technology, ranging from wireless devices such as mobile phones, tablets, and laptops to smart refrigerators, cars, and even medical devices like pacemakers, etc., it seems that the growing connections around us are difficult to detect. Therefore, the risk that comes together in operating within this brave, new and a connected world is high.

Shri Karnal Singh shared his expert viewpoint on the impact and importance of artificial intelligence, connected healthcare and need for cybersecurity in healthcare. How the digitization of healthcare is important and the rural and urban divide of same. He also insisted on the improvement of infrastructure and facilities available in the rural healthcare industry. In addition, he discussed the gap between the medical industry and government institutions where the research is needed and that we adopt mostly from our partnering and supporting foreign countries and how a change in mindset and adoption of new and improved technology can enhance the Indian healthcare. The future of healthcare is on the Internet and the Internet is vulnerable. Technology is the solution and it will come whether we want it or not. Therefore, the need of the hour is OUR PREPAREDNESS. We should welcome and be prepared for the connected network of healthcare.

An interesting session on the basic concepts of AI was the icing on the cake. It acquainted the participants with AI emphasizing on the fact that one should not get bogged down by the technology. Instead, one should focus on the use cases of it and there lies the innovation.

Often, the terms “digital health” evoke images of smartwatches or apps that can process the health data and can give a readout of parameters like heart rate, blood pressure, etc. That is a part of digital health, to be sure, but today we also focus on a newer aspect called “Precision Health” and the session “Prerequisite and journey of India to offer (precision) healthcare to all: Powered by Digital, Genetics, and AI” offered a far more expansive vision for digital health technologies, genetics and AI.

Precision medicine is an emerging approach of medicine which focuses on the cause of an illness, and not addressing the symptoms alone. Precision medicine may not be very well- known as Personalized Medicine. But they are the same. It takes into consideration individual variability in genes, environment, and lifestyle for each person.

Precision healthcare improves efficiency and accuracy to healthcare treatments. With precision healthcare, doctors can potentially develop targeted and precise treatment and therapies for masses as well as for an individual. This can improve patient treatment to large populations in countries like ours.

It’s based on evidence and data which comes from a series of medical tests on a patient. Thus, the data is its most important aspect. Very soon, along with genome sequencing and health sensors data coupled with the growing amount of Big Data, patient data will create large data sets of valuable information which can be used for more tailored treatments. But as an individual, a physician is not equipped to manually analyze these newly available data sets, which is where the advanced technologies such as AI come into picture.

The challenge that the clinicians see in the adoption of AI is the gap between the technical person and a clinician in regard to understanding the implementation of “normal reference values”. For example: If the normal value of hemoglobin for a person staying at planes (say Delhi NCR) is 13.5, the value 17.5 is perfectly normal at Ladakh. Is that incorporated in the AI system? Something that works in the USA might not work in India. The doctor or a clinician will have a great role to play in case of developing the AI as he/she can only give the correct inputs for the training sets.

With the new wave of digitization, medical records have seen a paradigm shift in the healthcare industry. As a result, the healthcare industry is witnessing an increase in the absolute volume of data in terms of complexity, diversity, and timeliness. Since the healthcare experts look for every possible way to lower the costs while improving the care process, delivery and management, and so is the aim of InnovatioCuris (IC), big data emerges as a persuasive solution with a promise to transform the healthcare industry. This paradigm shift from reactive to proactive healthcare may result in an overall reduction in healthcare costs and gradually may lead to economic growth. The above-stated and many more discussion points were there that became the part of the very interactive and interesting second session on “Mitigating data security and privacy challenges for digital healthcare in India”.

Data transmission is also an important aspect of implementing technology and safeguarding it. The Digital Information Security in Healthcare Act (DISHA) is one such step taken by the Indian Government in the long journey to securing the healthcare data of patients in India.

One of the biggest challenges is the lack of availability of data in a democratic manner and it’s all in silos in short data interoperability is a huge challenge. The major concerns that the clinicians have at the moment regarding the implementation of DISHA act are that it says that no court shall entertain any complaint unless made by the Central Government or central data authority, state data authority or the person affected and there would be times when PIL (public interest litigation) is there on the data security as well. The challenges will always pertain but what we need to do is to have trust in the law and protection by it. Major challenges regarding data security or cybersecurity, in hospitals or the clinical establishments, is that we do not have implemented laws that may protect our data. With the hope that they are definitely going to come, we can only stay prepared with our changed mindsets.

Ransomware epidemic is spreading in healthcare like wildfire due to its increasing digitalization which is and will attract more attention of hackers.

The healthcare industry has been a victim of various cyber attacks in the last few years. According to recent studies, healthcare has outnumbered financial services and become the most cyber attacked industry. The latest in cyber-attack is ransomware wherein the hacker encrypts the data and threatens to publish it until the ransom is paid in form of bitcoins. In US alone, healthcare industry was the victim of 88 per cent of all ransomware attacks across industries last year.

The recent case of WannaCry ransomware crippled the IT systems of NHS, UK. And after hitting NHS, it spread globally targeting more than 99 nations. The hackers demanded payment of £300 – £600 to unlock systems and have earned about £55,000 in ransom.

Ransomware has indeed become a lucrative revenue source for hackers due to which the number of attacks is predicted to quadruple by 2020. Medical records have 10-20 times more value than the credit card data in the internet black market. Ransomware epidemic is spreading in healthcare like wildfire due to its increasing digitalization which is and will attract more attention of hackers. Also, the vulnerability of the health data tends the organizations to pay the ransom to get the data back to maintain privacy and confidentiality of patient data.

Even after so many cases of cyber attacks compromising millions of electronic health records each year, the healthcare industry is inadequately prepared to prevent and resolve these attacks. Whether it is India or US, cyber security is always discussed in forums and budget is allocated for the same but is not put to proper use. Cyber attacks happen due to outdated security infrastructure or employee negligence.

Hospitals and insurance companies have been the main targets of hackers. But, a new vulnerability is catching everyone’s attention i.e. medical devices. The next nightmare in ransomware attacks could be hacking of medical devices such as insulin pumps, pacemakers, defibrillators, implants etc.

Disfunctioning of medical devices can be catastrophic. Just imagine, hackers take control of one’s pacemaker and ask for ransom or else they would manipulate the device which could be fatal. This kind of attack has been showcased in the very famous TV show Homeland wherein the Vice President dies due to hackers remotely disable his pacemaker.

Just like the serial, the former US Vice President Dick Cheney’s doctors disabled his pacemaker’s wireless functionality due to fear of possible assassination attempts as revealed by him during an interview in 2013. This clearly showcases that medical devices can be the next target for hackers.

Regulators such as FDA are increasingly getting concerned about medical device security and have issued warning. In 2015, for the first time FDA issued safety notice to hospitals which strongly discouraged hospitals to use an infusion pump which was found to be vulnerable to cyber attacks. But it has been observed that FDA did not force the company to fix the devices being used in the hospitals and didn’t investigate other insulin pump models. This shows that FDA needs to be more stringent towards medical device security. The vulnerability of infusion pump was pointed out by a white hat hacker Billy Rios during his hospital stay.

Few of the medical device companies/providers have been proactive in strengthening their device security such as Johnson & Johnson in Oct 2016 warned 114,000 diabetic patients about a security lax that a hacker could exploit in one of its insulin pumps (J&J Animas OneTouch Ping). The hackers can disable or alter the dosage which could be fatal. J&J suggested ways to the patients for mitigating risk.

There have been no documented cases of medical device hacking till date but demonstrations have been conducted in research environment. One such example is of Barnaby Jack who succeeded in hacking an insulin pump and demonstrated giving off lethal dose of insulin without the pump alerting the user. Another example is that of St Jude Medical’s implantable devices such as pacemakers, defibrillators, and resynchronization devices. The radio frequency (RF) enabled St. Jude medical implantable cardiac device and corresponding Merlin@home Transmitter enables transmitting and receiving patient data stored on the device to the physician to monitor his health. But FDA reviewed the device and confirmed about cybersecurity vulnerabilities, if exploited, could be fatal.

Also, researchers at TrapX Security analysed three hospitals for medical device hacking. The deception technology was installed which utilized emulated medical devices in the hospitals. These emulated devices attract and trap hackers so that TrapX could trace the hackers activity. These fake medical devices such as Radiation Oncology system, LINAC , Fluoroscopy, PACS and Xray system appeared real to the hackers and TrapX could monitor hacker’s activity.

According to TrapX, these hospitals utilized older version of Windows that made it vulnerable and most medical devices did not have additional endpoint security software which made the attack undetectable. It was also noticed that the main goal of hackers was to steal medical records not to manipulate the device.

Another research at University of South Alabama showcased how they hacked pacemaker and killed a medical simulator called iStan. The $100,000 medical dummy comes equipped with robotics that mimic the human cardiovascular, respiratory, and neurological systems. The researchers could speed the heart rate up or could slow it down. Not only pacemaker, researchers could manipulate an insulin pump or a number of things that would cause life-threatening injuries or death. This clearly illustrates why medical device security is important.

With the advent of IoT, where devices are connected via internet should focus on cyber security. Industrial experts are realizing that cyber security is prime priority for all the devices connected to the internet.

Devices such as wearables, smart bed, smart emergency system, etc. are all lagging behind in cyber security. Apart from medical devices, surgical robots are not being scrutinized for cyber security. Just imagine, surgical robots been hacked which could lead to life threatening situation of the patient. One such demonstration has been showcased by researchers at University of Washington in 2015. They hacked a tele-operated surgical robot, Raven II. The experiment demonstrated three types of attacks that made telesurgery vulnerable with this robot. The researchers demonstrated how they took complete control over the robot and disrupted the operation.

All of this sounds scary but it can be prevented if we are well prepared. It is important to understand that not only regulators like FDA need not address the challenge of cyber security but also the medical device vendors and providers should take shared responsibility. It has been observed that providers point the device manufacturers to be accountable for cyber security for responding to vulnerabilities and providing fixes for the same.

On the other hand, the device vendors hold providers responsible for their negligence and having outdated network  protection. To be safe from such attacks, organisations should review their cyber defence strategies and budget. Also, employee training and awareness needs to be tackled to avoid falling for opening phishing mails and change passwords regularly.

It has also been observed that providers such as middle scale hospitals, clinics or laboratories have often overlooked cyber security as priority as they believe not much data is present with them and only the big organisations are in trouble. Which is not true, as hackers are aware of the precious financial and patient data these clinics hold and are aiming at clinics or small hospitals also to get the data. So, they should also focus on medical device security.

The next big thing in helping fight against cybersecurity is artificial intelligence (AI). According to some analysts, the advantage of using AI is it can help predict cyber attack before it happens with the use of behaviour analysis. It alerts security team on any behaviour deviation or authentication failures while accessing records. AI not only helps in detecting threats quickly but it is also cost efficient compared to the money paid by companies in ransom. It does not replace security tools but acts as an additional layer of security. AI can also help in analysing employee behaviour for avoiding any internal security breach. AI can help in bridging the shortage of skilled cyber security professionals also. According to Centre for Cyber Safety and Education, there is a shortfall of 1.8 million cyber security professionals by 2022 worldwide. Companies such as IBM are already investing in AI system Watson for cyber security.

Also start-ups such as Cognetyx are providing cognitive cyber surveillance solution to healthcare organizations. Use of AI for cyber security in other areas has been showcased, for example, the Las Vegas city officials and UK government to monitor their Public Services Network and protect their records from security threats. Whereas, the successful implementation of AI in healthcare cyber security is yet to happen.

The next wave of medical device cyber attacks can be prevented by collaborative approach and commitment from all the stakeholders. Not only the healthcare organizations should make sure their security practices and strategies are updated but the government should also help in skill development of cyber security professionals and encourage more research on medical device security by providing medical device at low cost. Since medical devices are expensive and require license, it makes it difficult for researchers to explore this area. At the end, we should not forget that we have to stay a step ahead of hackers to be a hard target for them.

Want to write for InnoHEALTH? send us your article at  magazine@innovatiocuris.com

Read all the issues of InnoHEALTH magazine:
InnoHEALTH Volume 1 Issue 1 (July to September 2016) – https://goo.gl/iWAwN2 
InnoHEALTH Volume 1 Issue 2 (October to December 2016) – https://goo.gl/4GGMJz 
InnoHEALTH Volume 2 Issue 1 (January to March 2017) – https://goo.gl/DEyKnw 
InnoHEALTH Volume 2 Issue 2 (April to June 2017) – https://goo.gl/Nv3eev
InnoHEALTH Volume 2 Issue 3 (July to September 2017) – https://goo.gl/MCVjd6

Connect with InnovatioCuris on:
Facebook: https://www.facebook.com/innovatiocuris
Twitter: https://twitter.com/innovatiocuris
Linkedin: https://www.linkedin.com/groups/7043791
Stay update about IC by visiting: www.innovatiocuris.com

Introduction

The famous Silicon Valley investor Marc Andreessen says, “software is eating the world”. By, which he means that increasingly we are bringing software into systems to increase efficiency, lower down the cost or time involved in the process. Interestingly, humans also do software writing and humans are prone to make mistakes. It is estimated by various experts that 1000 lines of code (KLoC) has approximately 15-50 bugs present. Bugs here mean mistakes made by the software programmer while writing the software code. Bugs often result in some kind of malfunction or wrong output. Some of these bugs can lead to exploit by a third party making the larger system vulnerable or as we call hackable. As long as humans will write software, bugs will be there.

In a typical software company as bugs are discovered, new code is written to fix these bugs. The new code might further result into new bugs hence the cycle continues. At the consumer end, we keep receiving software updates over the air, as we use our phone / laptops or other devices, which are many times an attempt of the software company to overcome the past mistakes.

A lone computer hacker or an organized crime group looks at these software updates (sometimes called patches) very curiously as for them this could be a chance of hitting the jackpot! They reverse engineer it and try to understand the bug, that the patch is trying to cover. Very often systems are not updated with latest updates. Leading to most system having a known vulnerability, which the hacker can take advantage after understanding it well. Hackers further can create a simple script (programming code snippet) to some sophisticated software, which can then take advantage of the vulnerable system. We often call such a program as malware, as it is built with bad intention.

Today, as we talk it has become from a hobby crime to organized crime! Software companies regularly receive communication from bounty hunters about exposing their critical software bugs and in exchange not to do so, hackers want to charge them bounty money. Some software companies have gone further and engaged these bounty hunters to reduce security risks in their software.

In some cases the hacker is not interested in the bounty money (hence they do not inform the software maker) but rather interested in exploiting the bug. Sometimes, the bug is not known to the software maker or anyone else in the world and can be converted into a lethal attack. Such attacks are known as a zero day attack! As prior knowledge of such a vulnerability does not exist. Hence, most software security solutions, like anti virus software do not work on them. Further selling the knowledge of exploit as lethal software is now called as a cyber weapon. Nation states are now engaged in buying or building such software to infect systems of enemy states. Hence, we have come very far in the business of software bugs, where the enemy could be a lone developer, an organized crime group or a Nation state.

How is software eating the health sector and the threats linked to it?

In the above section we discussed in general, how the exploitation of software is increasingly becoming a serious business. While, we have seen many examples in last 30 years from a hobby software programmer to Nation states taking advantage of the software driven vulnerabilities. We would like to share some examples closer to the health sector.

1. Malware affecting data systems

Hospital information systems and similar information systems as part of the healthcare delivery have become very commonplace and one of the core component of the system. As pointed out in the introductory section, organized crime groups are now looking to exploit software bugs for commercial purposes. One of the ingenious way that they have developed is a malware known as ransomware . Ransomware is a malicious computer program which when executed on a system encrypts the data with very strong encryption making it unusable for hospitals or any other care provider to access patient records or other vital information. It then demands a ransom inform of bitcoins (a crypto currency) in order for the victim to have the key to decrypt the vital information. In recent incidents of ransomware infection, some hospitals in USA have even demanded millions of dollars as ransom and some have even paid.

The mitigation strategy for countering ransomware for any organization would be a strong backup of data. Also, creating awareness among the employees on sources of malware and reducing the chances of accidental infection of the workplace systems.

The long-term solution of tackling such organized crime is a better international legal framework, which allows international prosecution and cooperation among law enforcement agencies.

2. Denial of service attacks on ehealth services

In 2007 there was a distributed denial of service attack that took place in Estonia. A statue of the Russian soldier was removed from the Tallinn Square, capital of the country. Which sparked a response from sympathizers from Russia and it brought down the Estonian economy for three days. Estonia being one of the most advance countries when it comes to take up of e governance services, ehealth being one of them. The entire attack costed less than 50,000 US dollars. That was the first Denial of service attack the world saw at the level of a nation state.

The basic premise behind such an attack is that you have a service (e-service) to be provided to citizens over Internet like their own health records for example. The provider would have some finite amount of bandwidth and computing power at the backend of the service correlating to the average load on the service. In a distributed denial of service attack, the attacker uses compromised computing devices (commonly known as a bot) to access the Internet service. The botnet, which is a collection of such bots could be having thousands or millions of such devices that simultaneously access the service. The service provider is not able to distinguish the normal traffic from the bot traffic and often the server crashes under the heavy load. For a normal user trying to access the service, the service is unavailable because of the finite resources of the server being exhausted by the bot traffic. Hence, it is called a denial of service attack.

Hence, when a city, state or a nation is considering providing an eservice to citizens it could witness such attacks. One strategy to mitigate such attacks is to have tracking of the server traffic for any anomalies and having redundancy available in the system. This is achieved many times by putting the service on a cloud, which can tolerate such traffic fluctuations.

3. Data leak and breaches

Many health systems or systems require some kind of authentication mechanism to log in to the system in order to access the service. Many a times these are text password based systems behind which, important patient profile or health records information is stored. The largest of the companies like that of Google, Microsoft etc have seen attacks where the attacker is able to leak the passwords of millions of their customers. Such scenarios result in massive breach of data privacy and compromise for customers.

Good security practices, proper encryption of data and regular updates of the system are some of the key considerations for avoiding such instances. Nowadays, two-factor authentication has become a standard practice for making the authentication systems more robust. However, still some user awareness is needed to opt for better security practices whenever possible.

4. Hacking medical devices and health system

If we look at the building blocks of the health systems, where information technology is deeply integrated. We have already covered the health information systems, eservices and patient interface of authentication into the services. However, increasingly we hear about Internet of Things (IoT) devices in the health sector domain. Which means the integration of Internet services into traditional medical devices or new age devices, which have also connectivity. For example, a thermometer which can send the temperature data to your phone or a stethoscope which can record the patient breathing sound and upload in a server for finding patterns of lung diseases. These are powerful use cases and provide great opportunity to clinicians and care providers, where they have greater computation power available to them and they are able to do more with less. However, these IoT devices are prone to the same kind of attacks as any other communication device or a software program. They can be compromised to show wrong values and totally messing up the diagnosis. There are already such instances. One such instance not related to health sector but important is of the Stuxnet. Stuxnet was designed for the SCADA systems of Iranian nuclear program by USA and Israel in order to delay their nuclear program.

5. Stealing identity information

As mentioned in the point 3, about data leaks and breaches at the system level. One problem, which can arise from such an attack, is a further more damaging attack that is stealing of identity information. In India, mobile phones to receive an sms message containing one time password is increasingly becoming a standard practise because of being cost effective, simple and secure. Any such application, which you may install on your phone, can also get access to the sms and other features of your phone. Meaning the incoming sms or calls can also be stolen by this application to complete the transaction on your behalf. As increasingly we have to prove ourselves using biometrics or passwords to online systems. It is possible for the attackers to steal these credentials and access our records without our knowledge. Hence, any third party applications that we install on our devices (especially phone) , we need to be very careful about the type of access control they have on our devices.

6. Implantable medical devices with communication interfaces:

In 2007, the former US Vice President, Dick Cheney’s implanted pacemaker’s wireless communication was disabled fearing a terrorist attack. This sounds like science fiction to many but incident has already happened ten years back! Many of the medical devices are built with a communication interface and it is quite normal for a typical pacemaker or other such devices to have a Bluetooth or a similar communication technology based interface for remote diagnosis and other purposes. While, the communication ability of such a device was planned for looking at the state of the pacemaker it was not designed with keeping security in mind. Hence, it is possible that someone can connect to a critical device like pacemaker and shuts it down remotely.

One more reason that such exploits are possible increasingly as computing is becoming cheaper. What seems strong security today might not be strong tomorrow. However, an implantable device might stay in the patient’s body for tens of years. Hence, we need to have a long-term view on the communication interfaces and their capabilities on such devices. We need to make considerations on control and information capabilities of these interfaces. Misuse of control capabilities can lead to even death and misuse of information capabilities can lead to breach of patient privacy.

Way forward: why Internet is the new breeding ground for crime?

The law of the land governs the Internet in every country and hence the legal regime globally is very fragmented. However, a user of Internet does not see any borders or walls and so is the criminal. They build their criminal businesses where they do not fear strict government action and often for paltry sums the user or the national law enforcement agencies do not pursue the criminal cases cross border.

On top of it newer crypto currencies like Bitcoins, makes it easy to make such transaction in an anonymous manner. Dark net marketplaces provide a breeding ground for criminals to conduct illegal transactions of billions of dollars without getting caught. So, the three important components, weak legal enforcement, anonymous currency and secret marketplaces are enabling the cyber crime to flourish. If we want to slow it down, we will need greater international collaboration among lawmakers and user awareness at all levels.

Reference:
(i) https://www.wsj.com/articles/SB10001424053111903480904576512250915629460
(ii) http://labs.sogeti.com/how-many-defects-are-too-many/
(iii) https://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net/transcript?language=en
(iv) https://hackerone.com
(v) https://en.wikipedia.org/wiki/Zero-day_(computing)
(vi) https://en.wikipedia.org/wiki/Cyberweapon
(vii) https://en.wikipedia.org/wiki/Ransomware
(viii) https://en.wikipedia.org/wiki/Bitcoin
(ix) http://www.csoonline.com/article/3033160/security/ransomware-takes-hollywood-hospital-offline-36m-demanded-by-attackers.html
(x) https://www.theguardian.com/technology/2016/feb/17/los-angeles-hospital-hacked-ransom-bitcoin-hollywood-presbyterian-medical-center
(xi) http://innovatiocuris.com/looming-danger-of-ransomware/
(xii) http://www.bbc.com/news/technology-24608435

Want to write for InnoHEALTH? send us your article at  magazine@innovatiocuris.com