The need to change the way of delivering care/service should be our priority. A paradigm shift in the way of offering services through connected health services and emphasizing that privacy and security concerns are of utmost importance when it comes to connected health. Responsibility and accountability after acquiring data are very important. The question is how to analyze the data and get actionable insight. Analytics and IoT should be considered together for actionable insight. The challenge of interoperability has turned up with an increase in the number of devices being used.

Trends and Opportunities of Medical IoT

IoT or Internet of Things is not new, but it has been gaining traction at a very high pace. Since the inception of the word IoT, there has been an ongoing conversation about how it might change healthcare, improve patient safety, affordability and accessibility for patients.

Healthcare in India has a huge potential in terms of IoMT or medical IoT solutions. There will always be challenges and opportunities in this sector. Connected health is contributing towards the growth in space of IoT, but is lagging behind many other connected sectors.

One of the key challenges in developing the algorithm for medical devices such as CT scans and X-rays. Application of artificial intelligence and machine learning in healthcare should be cautiously done because in case of a CT scan if we miss a module it has life risk and hence should be used carefully and should be a well-validated clinical algorithm.

Since the infant mortality rate in India is twice the rest of the world, and that is certainly alarming as the bottom of the pyramid is affected; there is a company which focuses on the mortality rate of low weight birth babies. They have come up with developing a bracelet which diagnoses hypothermia in low birth weight babies. This was a very simple and innovative device, but then they analyzed the intermissions they can work on and came up with baby cradle. The main challenges to develop and design such a product is to cope with the cost factor and the startups definitely need funds to develop such a technology.

The goal of connected health is not just early identification of health issues, but also effective patient care and safety. Today IoT platforms support integration of medical devices and wearables. The need for security is as important as when it comes to IoT and accessing healthcare data and strengthening advocacy for connected health.

Things change very rapidly and in very small time, and IoT is taking shape with it. But who will fund the cost of development/ Can government help the industry in making such policies?

Business Models of Successful IOMT in India and Challenges

The IoT healthcare business strategy is not yet robust because it involves a set of elements with new requirements such as new operational processes and policies, new infrastructure systems, distributed target customers and transformed organizational structures. Therefore, there is a need for a new business model. The IoT technology opens a new dimension of business opportunities for healthcare companies and the IoT platform becomes a key artifact in this transformation. Early movers who are taking a proactive approach to establishing their IoT healthcare ecosystem will tap into new business models. In this part of the business model, the panel discussed the basis of pricing and the way of charging for a product or service. Besides this, the panel also discussed the ways of revenue generation.

While there are many benefits of the Internet of things in healthcare, it isn’t without its challenges. As with any new technology in healthcare, hospital and IT executives are concerned about data security and IoT device management. What are the potential barriers to IoT adoption and how healthcare IT can overcome those obstacles?

AI and IoT change the way healthcare is delivered and we obviously are on the cusp of a revolution. This definitely poses a fair amount of concerns but also huge possibilities. The panel also discussed how Medicare is 100th the cost per person when compared to Obama care. So clearly, there must be more innovations coming from IoT and AI; they are going to help us reduce the cost.

In the past, how people tried to use the data for the benefit of both patients and providers, starting from the patient side faced huge failures, as nobody was willing to pay. And that’s where the thinking came from that; how do we really make this work? How do we really turn this data into a business model? And that’s where they pivoted the model, working with providers and using their data sets. But then the question comes up, “Why the providers would share their data?”. Thus, the first pitching that started was to use the provider’s data for their patient care. And it didn’t work well. The whole narrative was, “What’s in it for providers?”.Therefore, the business model turned out to be, as we kept on talking to people, we realized that the data is going to be useful for provider’s revenue success, and then the same datasets will help the patients. A solution that they projected is to help retain the provider with patients’ data, grow their revenues and help in patient care.

The MedTech certainly seems more complex. Where they are trying to come out with a dermatology solution and oral health solution for serious diseases where a cell phone image taken from an off the shelf mobile phone camera is sent to an AI backend and it gives a diagnosis and possible treatment options for a variety of skin diseases, particularly oral cancer. Such cases are very prevalent. What the panelist found is a landscape extremely complex in terms of the business model because when someone comes out with something like this, then figuring out who would it be paying is difficult. And suddenly the AI and IoT thing comes up and say that it can perform this diagnosis at par the level and in certain cases better than certain trained specialists. This does not support their case.

One of the panelists shared her thoughts on important factors to concentrate and realize why health care has not moved digitally as compared to other industries like banking, insurance and how a lot of digital interventions can happen in healthcare. There are a whole lot of opportunities.

The main thing to focus on is What is the problem? What is the solution? And who’s going to pay you? Because that’s where the panelists believe that lots of startups have a scope.

The customer is one, the doctor is another and hospital, the other spectrum. So how to manage this change and address the change management. If you give a thought on what to overcome, it gives you a kind of value that you try and achieve success and how do we overcome the quality assurance issues, change issues, challenges that one sees in terms of adoption. Let’s say for the doctors, it took a hundred years to the doctor to adopt stethoscope. Today, it’s widely accepted. IoMT is something that is obviously very innovative, very useful. But then not every doctor will accept it right away. How does one plan to overcome that barrier? So, they might just want one to focus on change management issues.

There are three components of the IT embedment in a hospital. One is the business side of it, which gets adopted immediately. There’s just no resistance to it. The second side is the paramedical side of it; it has pathology, radiology, and other such things. They take a little time but they come on board. The learning curve is much shorter over there. The third one is the clinical side, which is the most difficult, as in a hospital system there are doctors who are most resistant to changes and the reason being their upbringing and learning of clinical practices in a certain way.

The question arises “How does one change their practices?” Changed management is already happening at the college level. The medical students who are coming out now are more hands-on and are accepting the new technological changes. We will have to wait a little while, but they will accept it. When we talk about a change in the management, the problem that arises is not specific to India only. In the USA, George Bush had said that he wanted EMR to be adopted by everyone within the next ten years. Surprisingly, he didn’t even get 15% conversion in those ten years.

It is important to secure the data and look over the cost implications of data security issues in connected health work moving forward. There is a need for appropriate interventions at the transition level of doctors and patients, as well as the importance of advocacy and awareness‐raising at community level about connected health. There is also a need for financial support for encouraging the tech enthusiasts of the country to address health issues in India with connected health solutions. One needs to understand customer value as well. How do we speak the right language in terms of what would appeal to that particular user or customer or doctor or hospital for that matter only then we will see more IoMT adoption happening. Yes, there is a need to understand the regulatory framework. Startups needs to adopt a lean structure in collaboration with the medical partners and come up with innovative solutions. India has a fantastic opportunity, but clearly it does need elements to come together and work together.

Ransomware epidemic is spreading in healthcare like wildfire due to its increasing digitalization which is and will attract more attention of hackers.

The healthcare industry has been a victim of various cyber attacks in the last few years. According to recent studies, healthcare has outnumbered financial services and become the most cyber attacked industry. The latest in cyber-attack is ransomware wherein the hacker encrypts the data and threatens to publish it until the ransom is paid in form of bitcoins. In US alone, healthcare industry was the victim of 88 per cent of all ransomware attacks across industries last year.

The recent case of WannaCry ransomware crippled the IT systems of NHS, UK. And after hitting NHS, it spread globally targeting more than 99 nations. The hackers demanded payment of £300 – £600 to unlock systems and have earned about £55,000 in ransom.

Ransomware has indeed become a lucrative revenue source for hackers due to which the number of attacks is predicted to quadruple by 2020. Medical records have 10-20 times more value than the credit card data in the internet black market. Ransomware epidemic is spreading in healthcare like wildfire due to its increasing digitalization which is and will attract more attention of hackers. Also, the vulnerability of the health data tends the organizations to pay the ransom to get the data back to maintain privacy and confidentiality of patient data.

Even after so many cases of cyber attacks compromising millions of electronic health records each year, the healthcare industry is inadequately prepared to prevent and resolve these attacks. Whether it is India or US, cyber security is always discussed in forums and budget is allocated for the same but is not put to proper use. Cyber attacks happen due to outdated security infrastructure or employee negligence.

Hospitals and insurance companies have been the main targets of hackers. But, a new vulnerability is catching everyone’s attention i.e. medical devices. The next nightmare in ransomware attacks could be hacking of medical devices such as insulin pumps, pacemakers, defibrillators, implants etc.

Disfunctioning of medical devices can be catastrophic. Just imagine, hackers take control of one’s pacemaker and ask for ransom or else they would manipulate the device which could be fatal. This kind of attack has been showcased in the very famous TV show Homeland wherein the Vice President dies due to hackers remotely disable his pacemaker.

Just like the serial, the former US Vice President Dick Cheney’s doctors disabled his pacemaker’s wireless functionality due to fear of possible assassination attempts as revealed by him during an interview in 2013. This clearly showcases that medical devices can be the next target for hackers.

Regulators such as FDA are increasingly getting concerned about medical device security and have issued warning. In 2015, for the first time FDA issued safety notice to hospitals which strongly discouraged hospitals to use an infusion pump which was found to be vulnerable to cyber attacks. But it has been observed that FDA did not force the company to fix the devices being used in the hospitals and didn’t investigate other insulin pump models. This shows that FDA needs to be more stringent towards medical device security. The vulnerability of infusion pump was pointed out by a white hat hacker Billy Rios during his hospital stay.

Few of the medical device companies/providers have been proactive in strengthening their device security such as Johnson & Johnson in Oct 2016 warned 114,000 diabetic patients about a security lax that a hacker could exploit in one of its insulin pumps (J&J Animas OneTouch Ping). The hackers can disable or alter the dosage which could be fatal. J&J suggested ways to the patients for mitigating risk.

There have been no documented cases of medical device hacking till date but demonstrations have been conducted in research environment. One such example is of Barnaby Jack who succeeded in hacking an insulin pump and demonstrated giving off lethal dose of insulin without the pump alerting the user. Another example is that of St Jude Medical’s implantable devices such as pacemakers, defibrillators, and resynchronization devices. The radio frequency (RF) enabled St. Jude medical implantable cardiac device and corresponding Merlin@home Transmitter enables transmitting and receiving patient data stored on the device to the physician to monitor his health. But FDA reviewed the device and confirmed about cybersecurity vulnerabilities, if exploited, could be fatal.

Also, researchers at TrapX Security analysed three hospitals for medical device hacking. The deception technology was installed which utilized emulated medical devices in the hospitals. These emulated devices attract and trap hackers so that TrapX could trace the hackers activity. These fake medical devices such as Radiation Oncology system, LINAC , Fluoroscopy, PACS and Xray system appeared real to the hackers and TrapX could monitor hacker’s activity.

According to TrapX, these hospitals utilized older version of Windows that made it vulnerable and most medical devices did not have additional endpoint security software which made the attack undetectable. It was also noticed that the main goal of hackers was to steal medical records not to manipulate the device.

Another research at University of South Alabama showcased how they hacked pacemaker and killed a medical simulator called iStan. The $100,000 medical dummy comes equipped with robotics that mimic the human cardiovascular, respiratory, and neurological systems. The researchers could speed the heart rate up or could slow it down. Not only pacemaker, researchers could manipulate an insulin pump or a number of things that would cause life-threatening injuries or death. This clearly illustrates why medical device security is important.

With the advent of IoT, where devices are connected via internet should focus on cyber security. Industrial experts are realizing that cyber security is prime priority for all the devices connected to the internet.

Devices such as wearables, smart bed, smart emergency system, etc. are all lagging behind in cyber security. Apart from medical devices, surgical robots are not being scrutinized for cyber security. Just imagine, surgical robots been hacked which could lead to life threatening situation of the patient. One such demonstration has been showcased by researchers at University of Washington in 2015. They hacked a tele-operated surgical robot, Raven II. The experiment demonstrated three types of attacks that made telesurgery vulnerable with this robot. The researchers demonstrated how they took complete control over the robot and disrupted the operation.

All of this sounds scary but it can be prevented if we are well prepared. It is important to understand that not only regulators like FDA need not address the challenge of cyber security but also the medical device vendors and providers should take shared responsibility. It has been observed that providers point the device manufacturers to be accountable for cyber security for responding to vulnerabilities and providing fixes for the same.

On the other hand, the device vendors hold providers responsible for their negligence and having outdated network  protection. To be safe from such attacks, organisations should review their cyber defence strategies and budget. Also, employee training and awareness needs to be tackled to avoid falling for opening phishing mails and change passwords regularly.

It has also been observed that providers such as middle scale hospitals, clinics or laboratories have often overlooked cyber security as priority as they believe not much data is present with them and only the big organisations are in trouble. Which is not true, as hackers are aware of the precious financial and patient data these clinics hold and are aiming at clinics or small hospitals also to get the data. So, they should also focus on medical device security.

The next big thing in helping fight against cybersecurity is artificial intelligence (AI). According to some analysts, the advantage of using AI is it can help predict cyber attack before it happens with the use of behaviour analysis. It alerts security team on any behaviour deviation or authentication failures while accessing records. AI not only helps in detecting threats quickly but it is also cost efficient compared to the money paid by companies in ransom. It does not replace security tools but acts as an additional layer of security. AI can also help in analysing employee behaviour for avoiding any internal security breach. AI can help in bridging the shortage of skilled cyber security professionals also. According to Centre for Cyber Safety and Education, there is a shortfall of 1.8 million cyber security professionals by 2022 worldwide. Companies such as IBM are already investing in AI system Watson for cyber security.

Also start-ups such as Cognetyx are providing cognitive cyber surveillance solution to healthcare organizations. Use of AI for cyber security in other areas has been showcased, for example, the Las Vegas city officials and UK government to monitor their Public Services Network and protect their records from security threats. Whereas, the successful implementation of AI in healthcare cyber security is yet to happen.

The next wave of medical device cyber attacks can be prevented by collaborative approach and commitment from all the stakeholders. Not only the healthcare organizations should make sure their security practices and strategies are updated but the government should also help in skill development of cyber security professionals and encourage more research on medical device security by providing medical device at low cost. Since medical devices are expensive and require license, it makes it difficult for researchers to explore this area. At the end, we should not forget that we have to stay a step ahead of hackers to be a hard target for them.

Want to write for InnoHEALTH? send us your article at  magazine@innovatiocuris.com

Read all the issues of InnoHEALTH magazine:
InnoHEALTH Volume 1 Issue 1 (July to September 2016) – https://goo.gl/iWAwN2 
InnoHEALTH Volume 1 Issue 2 (October to December 2016) – https://goo.gl/4GGMJz 
InnoHEALTH Volume 2 Issue 1 (January to March 2017) – https://goo.gl/DEyKnw 
InnoHEALTH Volume 2 Issue 2 (April to June 2017) – https://goo.gl/Nv3eev
InnoHEALTH Volume 2 Issue 3 (July to September 2017) – https://goo.gl/MCVjd6

Connect with InnovatioCuris on:
Facebook: https://www.facebook.com/innovatiocuris
Twitter: https://twitter.com/innovatiocuris
Linkedin: https://www.linkedin.com/groups/7043791
Stay update about IC by visiting: www.innovatiocuris.com