EPIC Software

Epic software is used by many hospitals that is HIPPA compliant. It is used to track all additions, modifications, and ensures the complete patient history is recorded. Check out this blog to learn more about EPIC software!

EPIC software is used by many hospitals to track patient care and manage the overall patient experience.  When something goes wrong during a patient stay that leads to long-term injuries or death of the patient, it is highly common that medical malpractice litigation ensues. 

Health Information Personal Privacy Act, HIPPA

The Health Information Personal Privacy Act, commonly referred to as HIPPA, places several important requirements on health care providers.  HIPPA requires that all access to a patient’s electronic medical record commonly referred to as EMR, track all addition, modifications, and allow access while ensuring the complete revision history of the EMR is maintained. 

EMR Audit Log

Audit logs or audit trails are required to ensure that reconstruction of the complete revision history can be established.  EPIC printed reports of patient’s EMR can be produced using various filters that result in a less than complete production of the patient’s full electronic medical records.  Some of the filters that are routinely used include:

  • Date filter to show only the time the patient was receiving care at the healthcare provider
  • Production of only non-confidential notations
  • Production of only the final version of the EMR without the detailed revision history
  • Filter notes exclusive to the named defendant health care providers
  • Filter by department

These filters described previously when used in producing a patient’s EMR result in an incomplete production of the EMR.

Sticky Notes

EPIC has a communication platform known as Sticky Notes. This serves as an instant messaging mode of communication between healthcare workers discussing a specific patient.  EPIC lacks a report that can allow easy printing or export of these notes. This creates a common misperception among health providers that these notes are not part of the legal discoverable record.  In fact, there are other ways to access these sticky notes, which are an important part of documenting the patient care provided.  An in-person inspection of the EMR using a camera to record the user’s screen can allow for obtaining these important communications. These sticky notes are part of the EMR and are subject to preservation by HIPPA. 

On-Site Inspection

During an onsite inspection to obtain the complete EMR, it is important to ensure that the user accessing EPIC has full administrative rights to the system.  In some health care organizations, sticky notes may be accessible only to physicians.  Regardless, obtaining these important communications can be a vital source of information to reveal important events leading up to a lifelong injury or death.

Enigma Forensics has assisted in numerous medical malpractice cases working with either the plaintiff or defendant’s side of litigation. Our experts dig through each record to analyze ultimately to find the “smoking gun!” We call ourselves the data detectives! If you are working on a medical malpractice case and would like to win, call Enigma Forensics at 312-668-0333.

To learn more about Electronic Medical Records check out these blogs.

In-Person Direct Access Provides Additional Information

An in-person on-site discovery will allow you to view what the EMR notes look like at different points in time, and gain access to inactive or deleted records. Check out this blog to learn more!


In-person direct access is what is often required to be able to get a complete view of what happened, because some of the data doesn’t show when you’re just looking at the produced printed charts. Such missing items may include: routing history, what the notes look like at different points in time, access to inactive or deleted records, and communications. Below is a screenshot from a popular Health Information System, Epic.

EPIC

Epic Notes View

So this is Epic and here you see the notes view and when you’re entering into the system, there’s routing which can give you additional detail about what happened in terms of the routing of the notes. You have a note time, a filed time, and a note time. In this case, all these records with exception of this one down here, the 10:04 AM note time was filed 15 minutes later. So it’s important to have both date and timestamps because sometimes, the file times are many days after discharge or nowhere contemporaneously to the events and that’s important if notes are being entered into this EMR days after something awful happened, you really want to know when those notes were filed. If they’re filed long after things went wrong, oftentimes, that suggests that fabrication of the EMR took place. You can see here, here’s some of the routing, it allows for you to specify different recipients and so knowing that routing of information, that’s important because it’s not always evident when you’re looking at the chart. Here’s an example of adding a note and you can see here, there’s the ability to copy and paste different notations. The date and time on these notes when you first go to create a note, default to the current computer’s clock time but it’s totally possible to change the date and time to put it back in time by dates or hours and that information is relevant. Here’s an example of the Cerner notes. Again, Cerner allows the user to change the date to something other than the current date and time. And it still stores, again, the creation time of that note, even if the note purports to be days earlier. And there are also different filters here, when you’re looking at the EMR with power notes on Cerner, there are different filters, such as my notes only, there’s inactive, active, and so on.

Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.

Part 1 of 4: “The Keys to Unlocking Electronic Medical Records”
https://enigmaforensics.com/blog/keys-to-unlocking-the-emr-audit-trails-electronic-medical-records/
Part 2 of 4: “HIPAA”
https://enigmaforensics.com/blog/health-insurance-portability-and-accountability-act-of-1996-hipaa/
Part 3 of 4: “Navigating to Trial or Settlement”
https://enigmaforensics.com/blog/navigating-to-trial-or-settlement/
Part 4 of 4: “In-Person Direct Access”
https://enigmaforensics.com/blog/in-person-direct-access-provides-additional-information/

Navigating to Trial or Settlement

Where does one start when requesting Electronic Medical Records or EMR’s? Enigma Forensics has created a process for you to follow to help navigate to trial or settlement.


Process of Navigating to Trial or Settlement

Lee Neubecker: So now I’m going to a little bit about the overview and process of working one of these cases with electronic medical records, such as myself. And typically, the cases start off with the need to make the request for the complete electronic medical record. Oftentimes, attorneys contact us when this has already been done but they suspect that the data is deficient in some way or fabricated.

So, we often will review the records produced, identify examples or problems with filters, anything that looks suspect, and then assist with drafting a supplemental request to produce.

If the supplemental materials are produced, we review that. We look for deficiencies in the records, and oftentimes there will still remain deficiencies. So in that case, we have to spend time analyzing the EMR and working on a report of sorts that shows examples of what’s missing. And at that point in time, we’re trying to compel the judge to order an inspection. On the converse side, if we’re working for the hospital, we’ll be looking through the EMR and often reporting to them whether or not there was a fabrication by hospital staff and that’s important for insurance carriers because they want to understand what the risk is if they litigate a case to trial. And it may be more advantageous to simply settle the case if there are some problems in the EMR.

So after we’ve drafted the motion to compel, well, typically, we write an affidavit in support of the motion to compel an onsite direct inspection. That motion gets filed by the attorney with our affidavit attached and then there’s a hearing. These days, the hearings tend to be on Zoom telephonically, and oftentimes the judge will ask questions. Essentially when we’re doing an onsite, what we want is we want to be able to see the entire record of the patient as the physician can see it, the communications between providers, and the complete revision history. This often requires videoing or taking photos of the data to capture data that are not easily printed from current reports with the HIS system.

So when the onsite inspection happens, it’s not uncommon that there will be multiple experts there. I’ve been hired to observe an inspection by a plaintiff counsel that is seeking to look at the EMR. In that role, I’m looking to just document and understand how they’re requesting the data, whether data is being withheld despite the onsite, and to advise my client in terms of what the data is that was produced and whether there are any issues with it. The onsite inspection isn’t where the analysis happens. It’s usually an effort to try to dump all the data out, run reports, make sure the settings are documented appropriately, and really that the only filter being used is the filter for the patient. There should be no other need to filter anything. Those records are the patient’s records. They have a right to that content and this process is one that is going to become much more common as we continue with the understanding of medical records and audit trails becoming more prevalent. After the onsite inspection, there’s a need to review that data. Oftentimes normalize it again, compare it against earlier produced EMR. That analysis might document that early on, that the health care organization was willfully holding back information that was key and important. And so, in instances where that happens, there’s a need to write a report to document those changes or deficiencies. And long before the trial happens and the reports issued, the expert witness that you use is your EMR expert will have to be deposed most likely. And what I usually find, at least in cases I’ve been involved with is that the cases typically settle after the deposition. Because at that point in time, you’re really looking at what does the factual record reflects? There are not so many opinions so much as there are facts. In some cases, there are opinions about why does the chart shows lots of entries that all were created days after discharge and they’re all unrounded hours with no minutes. In a situation like that, my opinion would be that’s likely fabrication because usually if you’re entering notes and other procedures contemporaneous to events, you’re going to have randomization of the minutes and everything is not going to be stacked up at zero, zero minutes on the hour.

So if a case is going to trial, there’s a need to prep your EMR expert, to let them review the timeline, the earlier affidavits in the data that was collected so that they’re prepared for trial. In most cases, so cases tend to settle and they usually settle after the onsite inspection and collection of data. Sometimes they’ll settle much earlier. I’ve seen cases settled as soon as I get involved and help with writing a request for supplemental production but sometimes the cases go on further. In my experience, the further along through this process the plaintiff gets, if we’re able to identify willful withholding of records, the settlement offer tends to be much higher.

1. Request Patient’s Complete EMR

  • Provide the complete EMR audit trail for [Patient Name] detailing any health care provider’s access, review, modification, printing, faxing, or deletion activities in a comma delimited format with any and all corresponding native files or records that may relate to the patient as required by the HIPAA § 164.312(a)(1).
  • Audit trail should include the complete revision history of the EMR 
  • Provide the name of all medical software applications utilized to store EMR
  • Provide the data dictionary for each software application containing EMR 
  • Provide all User and Administrator Manuals for each EMR software application

Email [email protected] for a complimentary sample request for EMR

So, I gave an overview of this. There are slides here that I’ll walkthrough. I want to have plenty of time for questions. So, I’m not going to read each of these but in summary, you want to make sure that you’re getting all the data and there’s an outline here, if you email [email protected], she can send you a complimentary sample request for EMR that helps you form that request. Obviously, you may want to retain us to help you tweak that for your specific circumstances. It’s a good idea though to ask for the user manuals when you’re doing this process and you want to make sure that you’re clear about asking for the complete revision history.

2. Review EMR Records Produced 

Identify Examples of Withheld Records or Apparent Manipulation

  1. Filters beyond the patient used such as user id or department
  2. Lack of production of records from the beginning of the notable time period until the date the EMR report was generated
  3. Audit trail lacks details of the revision history
  4. Production of the data in a non-usable format

So I talked about the review of the records produced and typically, we’re trying to identify examples of withheld records or other things that we can find or prove that are deficient from the production. Audit trails that lack the definition of what was being changed are an example, the production of data in a non-usable format, going onsite to have it exported. So it’s not produced in a crazy, out-of-order duplicative format is often helpful.

3. Request Supplemental Production of Deficient Records

  • Ask for what you want specifically before filing a motion.
  • Request the complete revision history showing the life cycle of the patient’s EMR.
  • The supplemental request for the production of deficient records is likely to not bear fruit but is necessary to show you tried to work things out before seeking judicial intervention.

So when we’re asking for the records that we’re missing, we want to be specific on that and ideally pose that directly to opposing counsel in an email. So that it’s documented and that way, if you’re hearing a motion, you can show the judge that you’ve already tried to be specific about what you were asking for. It should always include the revision history. That phrase is so important. Usually, that’s missing from productions. And it’s often, the case that even though you ask for things correctly, they still aren’t produced as requested. So, having that clear documentation of asking for it in email is important.

4. Review Supplement Production of Records Received

  1. Immediately review the supplemental production upon receipt.
  2. Check to see if the request that was made was answered correctly.
  3. To the extent that production remains unresponsive, communicate that to opposing counsel before filing your motion.

So when the supplemental production comes in, we want to typically look at that quickly, try to see if they’ve complied or failed to address certain sections. If they failed to disclose their filters or they filtered things differently than requested, you want to create a paper trail and send a follow-up email asking for that, and then if they don’t comply, that’s going to help you with your motion to compel when appearing in front of the judge.

5. Affidavit in Support of Motion to Compel Onsite Direct Inspection

  1. Detailed foundation for the request
  2. Reference prior requests and data produced
  3. Communicate the deficiencies in the produced EMR
  4. Establish examples where the revision history showing changes is important
  5. Establish that the reported dates are not necessarily the original entry time and that modification history can be obtained by directly examining the EMR system

So the affidavit that we’re generating is typically outlining these deficiencies. It might be sharing exhibits that include the emails that you sent asking for the data. We want to make sure that we’ve detailed the foundation for the request, pointing out examples of what was asked for what was produced, how that was deficient? Giving examples where the revision history showing changes is important. Specifically, the lack of when the records were actually created or last updated, who updated them, when? That information is very important and it’s often not in the initial round of production of EMR.

6. File Motion To Compel Onsite Inspection Of EMR  

So, finally the motion to compel the onsite inspection of EMR, there’s a useful case out of Kentucky, Western District of Kentucky, the Borum versus Smith case. I think on our website, if you search at enigmaforensics.com for Borum, B-O-R-U-M, there’s a hyperlink to this case and it’s a federal case that lays out the arguments establishing and overcoming objections made by a hospital resisting an onsite inspection. So this can be very useful to lay the groundwork for arguing your motion to compel.

7. Court Testimony in Support of Motion to Compel Onsite Inspection

  • Having your EMR expert at this hearing is important
  • Overcome objections
  • Establish protocol for examination
  • Allow recording of the HIS software as it relates to the patient
  • Allow for the reproduction of previously produced EMR to verify filter settings and obtain the data in a delimited format
  • Ensure that all versions of notes including inactive and historical versions are included in the production of EMR

When that motion to compel hearing is held having someone like myself there to be able to answer questions of the judge, overcome objections, help to establish protocols for the exam to ensure that it’s effective and not a waste of everyone’s time is important. Recording of the HIS software should be allowable. An agreement to redact or call out anything that might’ve been captured that doesn’t relate to the patient is something that I see there’s no issue to but the ability to document and the record is critical. Ideally, during this onsite, you want to be able to reproduce what they produced previously so that you can confirm whether or not they had filters applied to it. If their earlier production of EMR only includes active records and no historical records, producing it in a more complete manner will help you to demonstrate to the court that the hospital was holding back important records that were your patient’s or your client’s records, that they have a right to. So again, making sure that inactive historical versions are included in the production of EMR is very important.

8. Onsite Inspection – Capture of Patient’s EMR 

  • Inspection can occur using Zoom or other remote desktop tools
  • An in-person inspection can be advantageous
  • Your EMR expert should be able to direct the health care provider’s IT admin to perform any query or other activity that relates to the patient
  • Data can be saved to external media for later examination
  • Your EMR expert should be allowed to capture photos or video from the live system

So inspection onsite during the pandemic, a lot of things have shifted to Zoom or WebEx, that can certainly happen. An onsite inspection does have advantages and I usually recommend the onsite where possible. Now that vaccines are widely available, the concerns over going onsite should be much less. During this inspection, I always recommend that the healthcare providers, IT person with admin rights actually be the person that’s typing at the keyboard and moving the mouse but at the direction of the requesting party. That helps protect from any potential harm to the hospital information system and really shuttle out for full observation of the EMR as it exists within the system.

Typically, data is exported to external media and at the conclusion of that, the data is shared with a producing party, in requesting party subject to the right for either party to deem data confidential or redact, which typically, the confidentiality requirements, hospitals are already following that for the most part. So really, as long as the data is restricted to the patient, there really shouldn’t be much reason to hold back data that belongs to a patient as long as it’s just that patient’s data. That data will be examined after the onsite when there’s time to analyze it.

9. Review Records Captured Onsite

  • Limited time for onsite inspection and collection of data
  • Consider delaying review if a settlement offer is likely
  • EMR expert compares initial productions vs. onsite data collected
  • Identify examples of manipulated records or previously withheld records
  • Consider disclosing some of these smoking guns before proceeding with a written report by an EMR expert 

So after the onsite, that’s when there’s more time to look at the data to analyze it, to compare it. If there’s an expectation that smoking guns were captured during the onsite, sometimes a plaintiff expert might want to just hold off for a week or two if they think that a settlement’s likely so that the costs aren’t incurred. To discuss the comparison of initial productions versus what was collected on-site, trying to identify examples of manipulated records or previously withheld records can be important in understanding what happened with the case.

So whether or not you write a formalized report or just disclose some of the smoking guns, that’s a decision that plaintiff counsel often considers. Defense counsel often needs to consult with their insurance carrier and have someone like me help tell them what the situation is so that they can decide, does the case have merit or should you proceed to trial and not make a settlement?

10.  Write Final Report

  • Detail examples of previously withheld information
  • Detail examples of fabrication or manipulation of information
  • Clarify what happened with the EMR

So the final report that gets written up again, details, examples of previously withheld information. Examples of fabrication or manipulation of information and trying to clarify, in human words, a storyline of what took place.

11. Expert Witness Deposed

  • Survive Daubert challenge
  • Avoid mistakes
  • Establish a foundation for the admissibility of electronic evidence
  • Clarify any opinions expressed in the affidavit(s) or report(s)

So, when the deposition phase occurs, it’s important that your expert be able to survive a Daubert challenge. You don’t want to have all the work tossed out because the collection of data was not done properly or not performed by someone that has appropriate experience. It’s important to try to avoid mistakes, which sometimes typos happen and whatnot but trying to minimize mistakes typically requires giving your expert time to review and proof their report. Having other peer review processes performed and engaging with your expert to make sure that everything is clear and understandable. And ultimately, you’re trying to establish a foundation to admit important information that relates to EMR so that you can clarify what events took place and having your expert be able to explain that to a judge is really important.

12. Trial Testimony with Prep

  • Select an expert that is skilled at presenting technically complex information to non-technical audiences.
  • Verify that your expert has court testimony experience.
  • Ensure your expert has time to review materials before trial.
  • Most cases never make it to trial and settle earlier where the EMR speaks for itself.

So one of the things you want to look for when you’re picking an expert, you want to look for identifying an experienced expert that has testified on cases before and is capable of taking technically complex information and presenting it in an easy-to-understand manner. And that isn’t always easy for many geniuses out there that understand a lot of complex information. You want to make sure again, that your expert has time to refresh and review the materials before trial. Experts that are busy are going to be in many different cases and shifting between one med mail case matter in another involving EMR takes some time to shift.

So, I like to try to work on a case solidly for a period of time, get it up to a report, finish that and then come back to a case at the next checkpoint so that I can focus and not be split between two similar but different cases. As I said before, most cases never make it to trial because ultimately, the electronic medical records, if obtained and produced in their entirety with the date and time that they were entered, modified, and whatnot, that data will typically speak for itself. So, whether you’re defending a case or pursuing one, getting an understanding of events that took place, it’s highly critical.

13. Case Settles or Case Dropped

  • In our experience, in cases where EMR has been withheld or manipulated, settlement agreements are usually reached.
  • Establishing that the medical record doesn’t support allegations of abuse can result in a case being dropped.
  • Settlement offers increase when you are able to prove that the health care provider purposely withheld information.
  • Proving willful fabrication or manipulation of the EMR can help win the highest settlement.

So when we find examples of manipulation of information, settlement agreements are usually reached because if a hospital took a case to trial and it was proven that they manipulated the records, they would face far more litigation from other plaintiffs as a result of that. In some cases, some of the outcomes might not be to have a cash settlement, it might be for a parent to regain custody of their child because there were inappropriate allegations of harm that aren’t substantiated by the electronic medical record. If you can prove that a healthcare provider purposely withheld information, it’s really helpful to get a settlement or a favorable outcome if you’re on the plaintiff’s side. And again, as I said, what I’ve seen is the highest settlement offers usually come if you prove the willful fabrication or manipulation of EMR.

I had a case back in, I think it was around 2004 involving a heart catheterization operation that went wrong, and days after the operation, the patient was discharged and then passed away. It’s an unfortunate circumstance that left a family with one less parent. In that case, so years after the accident, the surgeon produced a CD disk that contained the video clips documenting the surgery. But what happened when I examined the CD, I was able to establish that the CD had been created a month previously. The CDs have headers that show the date and time that they’re created by a specific computer.

Furthermore, I looked at the video clips, there were DICOM video files. DICOM is digital imaging and communication of medicine and these video files had embedded metadata that showed the sequence number and the date and time and length of the clip. Well, what had happened is I think it was clip six, seven, and eight were deleted nine, 10, and 11 were renumbered to be six, seven, and eight. So there were three video clips that were removed and then the renaming of the files effectively made it look like the deleted clips never existed. Well, in doing forensics on that, I was able to establish what had happened and then during my deposition, I testified to that. At the end of it, the attorney for the hospital asked me, do you have any proof that the hospital had anything to do with this? Keep in mind, the surgeon was the one who produced the CD years after the operation.

Oh, my reply to the attorney for the hospital was if, given the opportunity to examine the hospital’s equipment, I could determine whether or not the CD that was produced was generated by their equipment and my deposition ended. Quickly after that, they asked for my business cards and then the maximum settlement of the insurance coverage from both the surgeon and the hospital, that offer was made in the case of, so it was a favorable outcome.

One other thing too, in many cases that have caps on liability, if the plaintiff is able to prove willful manipulation, in some states, those caps go away. So, if you’re defending a hospital in one of these cases, having someone like myself help you determine if the EMR shows willful manipulation or fabrication. That can be very important because exposure to the hospital could be much greater than in the case where things simply, you know, mistakes happen and unfortunately, mistakes happen and good people suffer harm as a result of disease, surgeries, and whatnot. But in situations where bad things happen and then individuals in a healthcare organization take efforts to fabricate the record, to make it look other than what events really took place, that can be very risky for a healthcare provider. And knowing that early on in a case is really important that hospitals know that and other health care providers. So in those situations, I’ve had a lot of experience digging in and answering those questions quickly before the plaintiff gets their answers. I’ve also helped the plaintiff get the answers to those questions and reached satisfactory settlements.

Watch other videos making up this 4 part series, Unlocking the EMR Audit Trail.

Part 1 of 4: “The Keys to Unlocking Electronic Medical Records”
https://enigmaforensics.com/blog/keys-to-unlocking-the-emr-audit-trails-electronic-medical-records/
Part 2 of 4: “HIPPA”
https://enigmaforensics.com/blog/health-insurance-portability-and-accountability-act-of-1996-hipaa/
Part 3 of 4: “Navigating to Trial or Settlement”
https://enigmaforensics.com/blog/navigating-to-trial-or-settlement/
Part 4 of 4: “In-Person Direct Access”
https://enigmaforensics.com/blog/in-person-direct-access-provides-additional-information/

FDA Cybersecurity Regulations: Medical Devices

A cardiac pacemaker is a lifesaver for many and is considered an implantable medical device. The FDA imposes regulations to protect these devices. Experts Lee Neubecker and Sterling Medical Devices, top engineer, Keith Handler examine FDA Quality System Regulations, ISO standards, and FDA guidelines used by Sterling Medical Devices that are essential to the manufacturing practices.

FDA Cybersecurity regulations in medical devices is a tough topic! Consider the cardiac pacemaker, probably the most notable life-saving implantable medical device. Did you know that it is operated by a computer chip? Just like any other computer they can be vulnerable to cybersecurity breaches.

Experts Lee Neubecker and Sterling Medical Devices, top engineer, Keith Handler examine the FDA’s Cybersecurity quality system regulations, ISO standards, and guidelines followed by Sterling Medical Devices to ensure cybersecurity for all their devices.

Tune in to Part 2 of our 3 Part Series on Medical Devices

The FDA Cybersecurity Regulations: Medical Devices Video Transcript Follows.

Lee Neubecker (LN): Hi, I’m back on the show today with Keith Handler, Keith, thanks for being back on.

Keith Handler (KH): Thanks again for having me.

LN: And Keith, again, is from Sterling Medical Devices, and today we’re going to talk about what measures are in place, that the FDA imposes to help ensure cybersecurity on medical devices, especially safety of PHI, and safety of the operation of those devices for end-users. Thanks again for being here.

KH: Yeah, thanks for having me. So, cybersecurity. It’s a tough topic, and the FDA is still figuring out how exactly to deal with it. They have issued guidance that attempts to categorize how high the risk is of cybersecurity for a device and the basic standards you need to follow in designing, and testing, and documenting your processes for developing that device. That guidance is currently how we generally implement most of our analysis processes and controls. The FDA has chosen to recognize certain certifications, such as UL 2100-1-2.

LN: And what is UL 2100-1?

KH: 2100-1 is a certification for network-connected systems, as far as cybersecurity is concerned, and 2100-1-2 is a subset of that standard, specifically for medical devices connected to the internet or a network. Mostly that standard follows the 2100-1, with a couple of modifications, based on the fact that medical is safety-related.

LN: Have you seen any changes in the standard since the WannaCry attack that took out a lot of the UK hospitals?

KH: Nothing that I can point to specifically. You know, that really comes down to changing specific vulnerabilities, our knowledge about them, and the attack vectors that we know that are capable of executing these things, cataloging them, making sure that we plan for them in future designs.

LN: So I know Bluetooth is a protocol that’s vulnerable to exploitation. I think at one point in time, there was a warning that everyone should take their pacemaker and get it updated. Were you familiar with that?

KH: Yes.

LN: Can you tell people a little bit more about what happened?

KH: Yeah, well, in that specific case, I’m not actually 100% sure what occurred there, but most of the time your issues are, with a lack of authentication, a lack of encryption, you need to be sure that what the device is talking to on the other end is exactly who they expect it to be, what they expect it to be, and you have to make sure that that communication is secured and unchanged, unaltered. Typically, that’s done by using specific security libraries, integrating them in careful ways, making sure that all communication over the wire is encrypted, things like an asynchronous key generation.

LN: I think, just from my memory of events, one of the problems they discovered is that these protocols, there’s a period of time before authentication occurs, in the preamble when there’s broadcast of the Mac address, the wireless name, and whatnot, where there’s a potential to create an overflow situation, to actually compromise a device before encryption and authentication occurs.

KH: Yes, in certain system designs it is that way.

LN: And, unfortunately, these protocols are, you know, they’re everywhere. So, at the time, I believe that the chip makers and various equipment providers, not just only in the medical area, but across the board, had to create fixes that help protect against these types of cyber-attacks.

KH: Yes.

LN: So, you were talking about UL 2100-1-2, what about TIR57? Can you explain what that is?

KH: So, AAMI TIR57 describes how to marry up the processes of medical safety risk analysis and security analysis. It’s an attempt to show that the security analysis process is actually very similar and very familiar for anybody that’s done the safety risk analysis before. More of less, it takes ISO 14971 and applies security risk management to it with a mix of a little bit of some NIST standards in as well. But the general idea is to really categorize what assets you’re protecting in your system, and the known vulnerabilities that your system has, and then from there, you attempt to determine a list of known attack vectors and categorize the profiles of your possible attackers. With a combination of that type of information, you can assess what the real vulnerabilities and risks are for your system, and design in controls, from the ground up, to make sure that you’ve protected against them.

LN: Yeah, well, this is really fascinating stuff. I appreciate you being on the show, and I look forward to our next segment talking more about cybersecurity and how to keep these devices safe.

KH: Thanks again for having me, Lee.

Don’t Miss Part 1 of this 3-Part Series on Medical Devices

Part 1 of the 3-Part Series on Medical Devices

View Related Articles

To Learn More About Sterling Medical Devices

https://sterlingmedicaldevices.com/company/

FDA Cybersecurity Medical Devices Regulations

https://www.fda.gov/medical-devices/digital-health/cybersecurity