×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Hospital Wireless Networks May Be Regulated Medical Devices

Soulskill posted more than 3 years ago | from the digital-lifeblood dept.

Government 185

Lucas123 writes "As hospitals continue to connect patient monitoring equipment, physician PDAs and laptops to wireless networks, and then collapse those data paths onto traditional IT networks, the closer the US Food and Drug Administration comes to regulating them, according to Computerworld. The focus of the FDA's regulation comes in its recently finalized 80001-1 standard that established risk management practices for those networks, the adherence to which may be voluntary, but would determine Medicaid and Medicare reimbursements. 'If you don't comply, then you have two choices. You can have the federal government come in and inspect your hospital, or you can decide not to accept money from Medicare or Medicaid. Voluntary sometimes isn't exactly voluntary,' said Rick Hampton, wireless communications manager for Partners HealthCare System in Boston."

cancel ×
This is a preview of your comment

No Comment Title Entered

Anonymous Coward 1 minute ago

No Comment Entered

185 comments

Good? (2)

Kenja (541830) | more than 3 years ago | (#34827464)

Current level of security and quality for medical IT is rather poor.

Re:Good? (4, Interesting)

Anonymous Coward | more than 3 years ago | (#34827698)

I'd have to concur. I've been in hospitals where the IT staff offered free wireless internet for the waiting areas- and the only open access point was to the "airgapped" network for the financials, etc. I'm sure that Medicare would LOVE to find out about THAT particular HIPAA violation. >:-D

Re:Good? (3, Insightful)

NevarMore (248971) | more than 3 years ago | (#34827800)

I I'm sure that Medicare would LOVE to find out about THAT particular HIPAA violation. >:-D

Then go tell them. If you've physically been in the hospital that could be your data, your loved ones data, or just plain due diligence if you were there for work and not for a medical reason.

Re:Good? (1)

Anonymous Coward | more than 3 years ago | (#34827842)

There is a serious need for IT professionals in healthcare -- at least people will tell you that right up to the moment you actually try to get a job. I've lost count of the doctors, med school professors, and hospital administrators who have claimed that there's this huge opportunity in healthcare IT. I've also stopped looking for the jobs that match these opportunities because I got frustrated long ago with the silent rejections, and the high barriers to entry raised by the places that would actually respond. The one opportunity that seemed realistic (MRP software development) was offering about $60K, for Boulder Colorado, which is unrealistic to say the least.

I'd really like to move my career from Aerospace IT into Healthcare, but I'm not willing to do it for a third of my current rate.
I think I have made a sincere, honest effort to find these jobs, albeit only in regions where I'm willing to relocate (Pacific Northwest or Colorado). Others who have different standards for location might have better luck.

Re:Good? (2, Informative)

Anonymous Coward | more than 3 years ago | (#34827982)

I think the quality of classic IT in a hospital isn't that bad. The status of our Windows network isn't that bad. There are issues, but I don't think we're any worse than any other industry. What is bad is the Biomed side of the house. The medical equipment stores patient data with no authentication or auditing capabilities. The systems that are based on off the shelf hardware and software (e.g. Windows PC hooked up to a medical device) can't be patched because the vendors won't certify the systems with those patch levels and turn around and blame the requirement on FDA approval.

Re:Good? (1)

HiThere (15173) | more than 3 years ago | (#34828376)

What's your rate of infections by viruses? If you're running a MSWind network, that might be a fair test. If it's zero, you may be doing pretty well.

This wouldn't work on a Linux or Unix network, as there basically aren't any viruses to probe the network, but on MSWind they might do a fair job of testing you.

N.B.: I'm *NOT* a sysadmin, so I may be talking through my hat. But at least it sounds like a fair first test. If viruses are getting through, you KNOW your network is pervious.

P.S.: Whenever I see a MSWind machine in a medical office, I shudder. I'm relatively sure those are insecure. If there were alternatives, I'd change doctors quickly, even though I like my current doctors as medical practitioners. Many of them are XP's. so I'm fairly sure they aren't well secured. (Could be air breaks, but I doubt it.)

Re:Good? (1)

vlm (69642) | more than 3 years ago | (#34828646)

What's your rate of infections by viruses? If you're running a MSWind network, that might be a fair test. If it's zero, you may be doing pretty well.

This wouldn't work on a Linux or Unix network, as there basically aren't any viruses to probe the network, but on MSWind they might do a fair job of testing you.

Its just an anecdote, but a casual acquaintance I met at HOPE 2006 in NYC or something, worked at a hospital and their solution to preventing LAN/network based infections was to create the semi-mythical one PC vlan.

So the linux side spoke dot1q and had a zillion interfaces and spoke smb via samba or whatever the heck the biomed device used. There was also some confusing discussion of mac address filtering, he was guite proud that any ole sysadmin could do iptables at OSI 3 and up, but he was doing all manner of layer 2 MAC filtering. For example, all the "whatchamacallits" had the same first three bytes of the MAC address, the OUI, and they were only allowed traffic from THE mac address of some remote monitor thingy.

He had a lot of semi-automated script and claimed if anyone swapped the server LAN card his switches would all autoupdate or something based on a vast pile of perl.

Some of the most sensitive "LAN" devices used a "LAN" of a crossover cable instead of running thru wifi and etherswitches. Obviously a little hard to monitor. So he used a hub (not a switch) and some dual ported RMON probe thingy to watch the sensitive "net".

He also did this mac address lockout thing such that only certain macs work in certain ports...

The point of this rambling recollection is you put a regular Fortune 500 IT dude in a hospital IT dept and you get security holes galore, a hospital IT guy merely needs some new outlook, some new ways of thinking.

Re:Good? (0)

Moryath (553296) | more than 3 years ago | (#34828600)

Actually part of the problem is that a lot of medical devices NEED to be closed systems.

I've got a friend who works in medical IT and it's a nightmare keeping systems certified. Anytime there's anything approaching a major Windows patch or upgrade, the device has to be re-certified to be sure that the patch didn't affect something to give bad readouts. This isn't an idle threat, given the various system incompatibilities that popped up in various ways over the years - there were a few systems that "broke" when some well-meaning person upgraded from XP SP2 to SP3 for instance.

They have systems still running win95, 98se, 2000, etc. on them. There are a few that are DOS-based putting out info on monochrome screens. It is actually a little frightening to realize what would happen if the unit had to be replaced quickly... on the other hand, the DOS units are hardy little bastards from back in the day when everything ran nice and cool and quiet on passive heat sinks.

Good. (5, Insightful)

RightSaidFred99 (874576) | more than 3 years ago | (#34827466)

I'm one of those much hated libertarian leaning people who thinks regulation should only be applied when absolutely needed. In this case, we're talking life and death data and I would expect medical systems to be heavily regulated both for security and availability/reliability.

So what's the controversy?

Re:Good. (4, Funny)

Kenja (541830) | more than 3 years ago | (#34827510)

You fool! You're suposed to let the free market decide! If too many people die at hospital A, just go to hospital B!

Re:Good. (2)

dkleinsc (563838) | more than 3 years ago | (#34827778)

Yeah, someone needs to send RightSaidFred99 to a Cato Institute reeducation center before he starts thinking that health insurance is a life-and-death kind of thing too and needs to be regulated!

Re:Good. (-1, Flamebait)

mangu (126918) | more than 3 years ago | (#34827838)

You fool! You're suposed to let the free market decide! If too many people die at hospital A, just go to hospital B!

That should be true for non-life-threatening circumstances.

The satire that leftists make of libertarianism is rather stupid and preaching to the choir.

Libertarianism isn't about getting rid of all regulations and having no government at all, that would be classical communism [wikipedia.org], the ultimate goal of Marxism.

Libertarianism is about being aware that one person's liberty ends where the other person's liberty begins. It's about making those limits more or less equal to everybody. The hospital's liberty to cut corners ends where my liberty to live begins.

The free market isn't the goal of libertarians, it's just one of the consequences. And it works for its purposes which are economic in nature.

Now go back to reading Trotsky, Bakunin, and Marx, I think you missed a few chapters.

Re:Good. (1)

Americano (920576) | more than 3 years ago | (#34827878)

Oh my. I really hope you have karma to burn.

Re:Good. (2)

Mordok-DestroyerOfWo (1000167) | more than 3 years ago | (#34827948)

Oh my. I really hope you have karma to burn.

Is it wrong that I heard George Takei when I read this?

Re:Good. (1)

danbert8 (1024253) | more than 3 years ago | (#34828002)

Oh my... Imagine a world with 4 colors! (probably not an exact quote, but you know the commercial).

Yeah, I can see where you got that.

Re:Good. (1)

Americano (920576) | more than 3 years ago | (#34828050)

Why would that be wrong? I wish I had the speaking voice that guy has, I'd be able to hold peoples' attention much more easily in meetings.

Re:Good. (3, Interesting)

mangu (126918) | more than 3 years ago | (#34828386)

Plenty of karma, don't worry. However no mod points, have been posting too actively of late. If I had I would give the GP (-1, offtopic).

Why is it that leftists always mock of libertarianism with this monotonous "free market" chant? Economic freedom is *one* of the infinite liberties a person can have. The free market works admirably for what it's meant to do, but it's not a tool for everything.

The free market is *not* intended to maximize the preservation of human life. We do need some regulations for that. Of course, there are private corporations, like this one [wikipedia.org] to verify that regulations are being followed, but they do not make the regulations, that's not what the "free market" is intended to do.

So, in the end, there must exist some form of governmental or non-market regulations in effect. No libertarian denies that.

Re:Good. (1)

Anonymous Coward | more than 3 years ago | (#34828998)

Why is it that leftists always mock of libertarianism with this monotonous "free market" chant? Economic freedom is *one* of the infinite liberties a person can have.

We mock because "liberties" bleed into each other. One person's economic freedom is very often at odds with someone else's health, or civil liberties, or you name it.

Libertarians tend to come off sounding like someone that refuses to put a leash on their dog, and tells everyone else in the neighborhood that they should simply put up fences if they don't like poop on their lawn.

Re:Good. (3, Insightful)

Zironic (1112127) | more than 3 years ago | (#34829034)

Because it's true. You constantly see people that claim they're libertarians while preaching that the free market will fix 'everything'. On another forum I saw a person claim that "All" regulation is "Evil", no exceptions, obviously they're either ignorant or crazy but those are the people that give libertarians such a bad rep.

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34829056)

I think you'll find plenty of libertarians denies that.

I now declare libertarianism to be the same... (1)

publiclurker (952615) | more than 3 years ago | (#34828420)

as fundamentalism, as it is impossible to differentiate between supposed satire of either group and the blather that they spew.

Re:Good. (1)

HiThere (15173) | more than 3 years ago | (#34828530)

There are rational libertarians. They aren't the majority. I don't know if there are any rational Libertarians.

To say that someone who takes the most common stand taken by a group of people who apply that label to themselves as representative of that belief is unreasonable is, itself, unreasonable. To take the well-reasoned view of a small minority who apply that label to themselves is much more unreasonable.

So, yes, I would say that libertarians believe the the supremacy of the Free Market!! at all costs. This doesn't mean that I believe it to be the belief of all libertarians, but rather that of most of them, or at least most of those with loud voices. I say this despite considering myself more of a libertarian than any other political grouping, and definitely not believing it myself.

Don't denounce people for pointing out the flaws in the political group that you most strongly identify with, change either the group or your identification. Do you feel you must defend the US when others point out that it illegally tortures people? It does. If you deny that fact, you are refusing to face reality. And most citizens are profoundly unhappy about it. Unfortunately, the most common reaction is to deny the facts. This doesn't do anything to fix the problem. Recognizing the problem doesn't do much, but at least it's better than that.

I agree that there are libertarians who believe as you do. But it's not the most common belief among libertarians. Much more common is the worship of the Free Market to the extent of denying that it has any faults or any circumstances in which it doesn't apply. (And they never thing that this would authorize murder for hire. That would create cognitive dissonance.)

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34828932)

Speaking in generalities and rambling does not lead to good conversation.

If only it were so easy (1)

sjbe (173966) | more than 3 years ago | (#34829010)

That should be true for non-life-threatening circumstances.

But it frequently is not true. In fact, even if you could get enough data to make a rational and fully informed decision (which is almost always impossible in real life), most people wouldn't know what to do with the information once they got it. It's possible to measure outcomes in many cases but there are so many variables that go into health care that most people would find it impossible to say Doctor A is better than Doctor B even if you just restrict the evaluation to medical outcomes - never mind externalities like cost, location, convenience, or soft factors like bedside manner. And even just staying with outcomes, it's frequently not clear cut what constitutes a better outcome.

It's very difficult to seriously comparison shop between health care providers because health care is a experiential good [wikipedia.org]. You only can evaluate the care after you have received it. You might consult friends and whatever limited data you have available to you about likely outcomes but all you are doing is evaluating the odds and probably doing a very crude job of it. Even the best hospitals with the best doctors and best practices have poor outcomes sometimes.

Libertarianism is about being aware that one person's liberty ends where the other person's liberty begins.

The problem with that is you have to define what constitutes your individual rights. Reasonable people can disagree on what those limits should be. "Libertarians" themselves can't even agree [wikipedia.org] on where the limits of government and personal liberty should be.

The hospital's liberty to cut corners ends where my liberty to live begins.

Actually it ends where the ability to finance your "liberty to live" (whatever the hell that means) ends. Finite resources are available for infinite health care needs. That's not an excuse to not provide the best care they are able to provide prior to reaching those financial limits but odds are you are going to run into the limits of what a hospital will do for you prior to hitting the limits of what they (theoretically) can do for you.

Re:Good. (4, Interesting)

Talderas (1212466) | more than 3 years ago | (#34827518)

Well. Since you need to comply with FDA regulations or not get your medicare/medicaid funding, it's a pretty big deal.

The problem exists in the transition. These improvements cost money and there's a good chance that networks in transition wouldn't meet the FDA requirements. That would cause the hospital to loose the medicare/caid funding and consequently have to turn away or eject patients that would be a huge cost to them that would otherwise get treatment.

Since there's that potential while in transition to a more modern network, hospitals may be quite unwilling to fund the improvements in the first place and preserve their funding.

Re:Good. (1)

Kagato (116051) | more than 3 years ago | (#34827830)

Maybe a really small hospital might have issues, but if you're mid or larger and can afford something like Epic MyChart, you can afford a competent network admin.

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34827984)

a really small hospital might have issues, but if you're mid or larger and can afford

Thus, regulation creates bias for large institutions. Oligopolies eventually dominate. Enjoy your McDoctor.

Were wireless networks actually killing anyone...? oh wait; not supposed to think.

Re:Good. (4, Interesting)

Americano (920576) | more than 3 years ago | (#34828190)

Were wireless networks actually killing anyone...?

If you read TFA, yes, actually, they were:

According to Shuren, the FDA last year received reports that six patients died and 44 people were injured as a result of health IT-related malfunctions. The FDA also received 260 reports of malfunctions that had the potential to harm patients.

Reporting of these numbers is strictly voluntary, so you do the math - if institutions volunteered these numbers, how many other patients and patient devices are being affected by some intern streaming House re-runs over the network? And do you really think it's inappropriate to mandate that certain controls must be in place on a general network that is relied upon by medical devices which require the network to operate, and which are sending sensitive medical data over the network?

I work for a financial services company; it's standard practice for us to firewall off our sensitive database systems and authentication systems, and restrict access to a very tightly controlled set of uses. If your retirement account or brokerage account was held here, would you want us to take down all the firewalls, network filtering, and access controls on the networks? I'm betting the answer is no. If you want that much protection on your financial information (which might embarrass you, but certainly won't kill you), why wouldn't you want controls at least as strict on networks & systems that could - quite literally - kill you if they malfunction for some reason?

Re:Good. (3, Interesting)

Americano (920576) | more than 3 years ago | (#34827996)

Or, as with just about any government regulation, the policy would be enacted and give hospitals X number of months or years to comply with the standards set forth in that policy, or face a loss of Medicare/Medicaid funding.

Here's what will not happen:
12:01 a.m., January 1, 2012: Regulation goes into effect.
12:02 am, January 1, 2012: All non-compliant hospitals cease to receive funding from Medicare and Medicaid, and the feds move in to shut down these illegal dens of medical "care" for their noncompliance.

They'll probably have several years to bring themselves into compliance, with a requirement that they document their risk mitigation policies until they are compliant, and if at the end of that time they can't show compliance, then they will risk losing their Medic[are|aid] funding.

Re:Good. (2, Interesting)

eth1 (94901) | more than 3 years ago | (#34828796)

Or, as with just about any government regulation, the policy would be enacted and give hospitals X number of months or years to comply with the standards set forth in that policy, or face a loss of Medicare/Medicaid funding.

Here's what will not happen:
12:01 a.m., January 1, 2012: Regulation goes into effect.
12:02 am, January 1, 2012: All non-compliant hospitals cease to receive funding from Medicare and Medicaid, and the feds move in to shut down these illegal dens of medical "care" for their noncompliance.

They'll probably have several years to bring themselves into compliance, with a requirement that they document their risk mitigation policies until they are compliant, and if at the end of that time they can't show compliance, then they will risk losing their Medic[are|aid] funding.

Exactly. What will really happen is this:
12:01 a.m., January 1, 2012: Regulation goes into effect, with deadline of 2015-01-01.
2012-01-01, IT: "We need to get started on this"
2012-01-01, Exec: "We don't have the money yet"
2013-01-01, IT: "We need to get started on this"
2013-01-01, Exec: "We don't have the money yet"
2014-01-01, IT: "We need to get started on this!"
2014-01-01, Exec: "We don't have the money yet"
2014-11-01, Exec: "We need this in two months or we're fscked!! We'll need you to work 168 hour weeks!"

Re:Good. (1)

darkstar949 (697933) | more than 3 years ago | (#34828018)

However, as some others have pointed out, what you are doing and how the new rules are written is very relevant. If you are having equipment monitoring vitals signs sending data over the network that is relevant to the monitoring of the patient, you better be sure that the information is getting where it should be. Likewise, if you are just providing a public WiFi for patients and families so they can check their email while they are at the hospital, then there isn't as pressing a need to make sure the network stays up.

At the end of a day, there are still some good reasons for having a physical wire connecting some network devices and when you have those reasons, you don't want someone upgrading to a new network type without having appropriate plans in place. If upgrading to WiFi ends up costing more money and the existing wired network works just find, why change it?

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34828318)

If your network doesn't meet requirements, maybe you shouldn't be sending life and death information down it.

captcha: Mistakes. Spooky.

Re:Good. (1)

vlm (69642) | more than 3 years ago | (#34828728)

That would cause the hospital to loose the medicare/caid funding and consequently have to turn away or eject patients that would be a huge cost to them that would otherwise get treatment.

This assumes that medicare/medicaid patients are, and always will be, your most profitable. If your assumption ever turns out to be wrong...

Re:Good. (2, Insightful)

Korin43 (881732) | more than 3 years ago | (#34827726)

The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare. It's perfectly fine if you have the money for the first option, but not everyone does.

Not to mention that some people would be willing to take the risk to save money. Everything you do in life has a risk, why regulate just that one? There are many cases where I'd be willing to go to a hospital with a crappy wireless network to save some money. I'd think twice about getting heart surgery there, but not everything a hospital does is that big of a deal.

No, it doesn't (0)

Anonymous Coward | more than 3 years ago | (#34827820)

The problem is that a heavily regulated system like this raises prices

That only holds true if your current level of IT security is so poor that this would require large scale changes. If it is already as it should be, it's a relatively small problem to get the paperwork sorted out. (Sure, it could take several manhours... But really, it's very difficult to make a claim that it would have any visible effect on prices).

Re:Good. (2)

blueg3 (192743) | more than 3 years ago | (#34827946)

The problem is that a heavily regulated system like this raises prices

It also tries to make arguments on blind assertions.

Re:Good. (1)

Korin43 (881732) | more than 3 years ago | (#34828258)

The problem is that a heavily regulated system like this raises prices

It also tries to make arguments on blind assertions.

So you think things get improved for free then? More rules means more time spent making sure you're following them, and in the case of the healthcare industry, it means paying insane amounts of money for something that's cheap for everyone else (but the cheap version doesn't come with the right certifications).

Re:Good. (1)

blueg3 (192743) | more than 3 years ago | (#34828424)

So you think things get improved for free then?

So, are you trying to argue that since it costs money to improve X, then if Y is an improved version of X, then Y is necessarily more expensive than X?

Re:Good. (1)

Korin43 (881732) | more than 3 years ago | (#34828676)

No, I'm saying that if it costs money to improve X, and you require that X be improved, then it will cost money. If Y uses X and isn't a charity, then Y will become more expensive to make up for it.

Re:Good. (1)

Maclir (33773) | more than 3 years ago | (#34828040)

The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare.

Wait a minute - I thought the original article was referring to hospitals in the USA - so then "best healthcare" is not an option.

"Yay, I got the best healthcare!..." (2)

apparently (756613) | more than 3 years ago | (#34828076)

The problem is that a heavily regulated system like this raises prices, so your only choices become the best healthcare or no healthcare. It's perfectly fine if you have the money for the first option, but not everyone does.

"...Boo, my social security number, credit card number, and license number were stolen due to a poorly-secured network!" And all because a few doctors couldn't take a small paycut to afford the cost of securing their systems.

Not to mention that some people would be willing to take the risk to save money. Everything you do in life has a risk, why regulate just that one? There are many cases where I'd be willing to go to a hospital with a crappy wireless network to save some money.

And why should the contents of my personal health records and financial records be put up for grabs, because you're willing to accept the risk? You act is if it's like the choice to wear or not wear a seatbelt, in which it's your life at stake if your coin comes up tails.

Re:"Yay, I got the best healthcare!..." (1, Informative)

Korin43 (881732) | more than 3 years ago | (#34828184)

The point is that I'm not forcing you to go to my hospital, but with these regulations, you want to force me to go to yours.

Re:"Yay, I got the best healthcare!..." (1)

apparently (756613) | more than 3 years ago | (#34829102)

The point is that I'm not forcing you to go to my hospital, but with these regulations, you want to force me to go to yours.

First off, it's not your hospital, it's not my hospital, it's the community's hospital.
Your mental calculus concludes that the cost of securing a network outweighs the risk of a network being compromised. My mental calculus concludes that not only does the degree of the risk necessitate the cost, it also has the benefit of potentially reducing costs associated with identity theft, law suits due to HIPAA violations, and of course, the reputation risk of the hospital and doctors associated with it.

Re:"Yay, I got the best healthcare!..." (1)

Korin43 (881732) | more than 3 years ago | (#34829218)

The point is that I'm not forcing you to go to my hospital, but with these regulations, you want to force me to go to yours.

First off, it's not your hospital, it's not my hospital, it's the community's hospital.

Your mental calculus concludes that the cost of securing a network outweighs the risk of a network being compromised. My mental calculus concludes that not only does the degree of the risk necessitate the cost, it also has the benefit of potentially reducing costs associated with identity theft, law suits due to HIPAA violations, and of course, the reputation risk of the hospital and doctors associated with it.

Well clearly you're much smarter than me, so I guess you're right that I shouldn't have choices. I'll just shut up and let you make all of my decisions for me.

Re:Good. (1, Insightful)

Archangel Michael (180766) | more than 3 years ago | (#34827964)

I'm one of those hated libertarian people, and you haven't even begun to explain anything libertarian.

This isn't between life and death, this is just communication between two machines (wireless networking). By confusing the two, you've fallen into the trap of the "do it for the children" crowd.

In this case we have a government that is withholding payments because they haven't inspected a network. Okay, I'm okay with that, except for one thing, this isn't about privacy or security or anything like that. It is about control of the processes.

This is just a bad case of "governmentus interferitus", where they think adding the layer of government fixes the problem. However before they can "fix" the problem they should show that it is a problem in the first place, not react like the typical, "something must be done, this is something, therefore it must be done" roll.

Next time a Congress Critter suggests a fix for a problem, ask them to explain the problem, and how their "fix" fixes it. Most likely, they have no idea on either, but they're doing it anyway, and it sounds like the previous "something must be done" phrase.

HIPA is great and all, but it also is a pain in the ass for most people, and has caused more problems than it solved.

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34828522)

Actually, none of the libertarians need even apply to this thread, since we're already shoveling money from the government into the private sector here.

If anything, the libertarian response should be "good! The government needs to give less money away so it can take less of my money through taxes!"

Re:Good. (3, Insightful)

Peeteriz (821290) | more than 3 years ago | (#34828776)

According to the TFA, this has killed at least 6 people in the last year, so in this case the communication between two machines was 'life and death'. Or wasn't it?

Re:Good. (1)

RKThoadan (89437) | more than 3 years ago | (#34828060)

I'm a little less libertarian than you and I see some potential problems. I don't really have many problems with this being regulated, but I'm a bit uncertain that the FDA is the best agency for this. I typically think that regulation is very similar to encryption. Both can make you much safer if done well, but they aren't done well very often (especially regulation) and end up just being a big inconvenience. Unlike many I genuinely believe that regulation can and should be done properly, which means it should be done by the right department and it should be very clear who regulates what. As regulatory agencies go, the FDA isn't horrid, but it seems like an odd choice to regulate a hospital's wireless network.

Re:Good. (1, Insightful)

Anonymous Coward | more than 3 years ago | (#34828112)

It also means they will not be able to buy $50-100 access points. They will have to be "medically certified" access points. That means they will have pretty green sticker on them, the same access point, but now it will cost $300-400. Great plan.

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34828124)

You just shut down all meaningful medical research in the US. There will be no medical research if you cannot get medical data. Perhaps you can still do some retrospective demographic studies -- but most research requires real data. Wireless or not, often obtains medical data by connecting (directly or indirectly) to medical equipment that is designed to supply this data to interested parties via RS-232, bluetooth or ethernet. If you have to get your data acquisition system approved by the FDA, you are SOL.

Medical research in the US is already way too encumbered by individuals that try to misapply the existing laws. Many well-meaning individuals already think HIPPA means you can't do research. Of course that is not true, but common perception of the existing laws and regulations is more important on a day-to-day basis than what the rules actually say.

Forgetting research for a moment, take a clinical point of view. Without a risk/benefit analysis, this decision is blindly misguided. Is there a documented case of someone being harmed because their patient monitor was being monitored remotely at a central station? Remote monitoring is usually enabled by an IT network. Now are there documented cases of someone being harmed because the patient was _not_ being monitored? Guess.

Re:Good. (0)

roman_mir (125474) | more than 3 years ago | (#34828178)

I am one of the REALLY HATED libertarians. I am against gov't regulations of everything.

Gov't has 2 jobs:
1. Minimum military.
2. Justice system.

That's it, no exceptions.

There should not be gov't involvement into any of this at all. FDA should be abolished, like all other agencies (except for what I specifically listed already.)

This is RIDICULOUS to have any special regulations for any of this stuff. That's what makes it so difficult to enter the field of opening your own hospital and there is no reason to have any of this certification.

If you DO CARE about certification, then you should go to hospitals that use some certification company to certify their instruments, etc.

This regulation is like all other gov't regulations, will bring costs up and will decrease competition. That's it.

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34828562)

This has little to do with life and death and more to do with forcing hospitals to accept nearly nothing for reimbursement, or have the Federal Government come in an inspect.

Re:Good. (0)

Anonymous Coward | more than 3 years ago | (#34828878)

I'm one of those much hated libertarian leaning people who thinks regulation should only be applied when absolutely needed. In this case, we're talking life and death data and I would expect medical systems to be heavily regulated both for security and availability/reliability.

So what's the controversy?

Confidentiality, Integrity, Avalibility. You would expect medical systems to be heavily regulated but they are not.

not really a surprise... (4, Interesting)

ducomputergeek (595742) | more than 3 years ago | (#34827468)

I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..

I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.

It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.

Re:not really a surprise... (0)

Anonymous Coward | more than 3 years ago | (#34827576)

It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.

Can there be software for that? I see an opportunity.

Re:not really a surprise... (4, Interesting)

Rich0 (548339) | more than 3 years ago | (#34827616)

Believe it or not, there is... I work in a regulated industry and we pay tons of money for software that basically helps us manage the paperwork that says we're doing everything right...

Re:not really a surprise... (1)

Kenja (541830) | more than 3 years ago | (#34827638)

Yup, I write software to help manage ISO9 & 6SIGMA compliance. Good gig, I work from home and dont even need to wear pants.

Re:not really a surprise... (2)

alphax45 (675119) | more than 3 years ago | (#34827750)

Please, for all of us, wear pants.

Re:not really a surprise... (2)

Kenja (541830) | more than 3 years ago | (#34827776)

You sound just like the delivery guy from the chinese restaurant.

Re:not really a surprise... (1)

operagost (62405) | more than 3 years ago | (#34829042)

Actually, I'm the guy who hacked your laptop, and unfortunately for me I turned on your webcam yesterday. Please also put on underwear.

Re:not really a surprise... (1)

alen (225700) | more than 3 years ago | (#34827934)

it costs a ridiculous amount of money

Re:not really a surprise... (1)

Americano (920576) | more than 3 years ago | (#34828230)

So business plan is:

1) write the software
2) sell it for "ridiculous amount of money minus one dollar"
3) profit?!

Re:not really a surprise... (-1)

Anonymous Coward | more than 3 years ago | (#34827626)

I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..

I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.

It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.

I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements. It was a pretty big deal back then since 80% of their business was either Medicare or Medicad. It took about six months to write out all the contingency plans and make sure they were doing proper back ups, could restore backs ups, had secure off-site storage of tapes, etc..

I do remember the big hang up was the fact their database server and terminals had have an airgap between them and the Internet, or at least that was the easist and cheapest way to meet the standards they had to and In fact the only line out was a dial up modem to submit billing to the state. It only took about a month to back up all their records to hard copy (just incase), get the new systems and transfer all the old data to the new system.

It took another five months to write all the damn documentation the government required for their certification/accrediation/inspection or whatever it was they had to pass.

this is not realy. [livemotions.ru]

Re:not really a surprise... (1)

Kjella (173770) | more than 3 years ago | (#34827762)

I consulted with a small medical equipment business 5 years ago when they were replacing a DOS based system they bought in 1993 with new software that met all the HIPPA compliance plus their state requirements.

You're not exactly doing consultants a favor by showing that you can't spell HIPAA [wikipedia.org], you know.

Re:not really a surprise... (1)

operagost (62405) | more than 3 years ago | (#34829016)

No, no. This is HIPPA, which is the standard set specifically for the use of malnourished Hungarian patients. You know: Hungry Hungary HIPPA!

YOU may BE ON TO SOMETHING !! (1, Insightful)

Anonymous Coward | more than 3 years ago | (#34827530)

Slashdot MAY get editors that aren't idiots !!

Mars MAY invade Earth eventually !!

God MAY stop playing around and squeeze us all like a pimple and start the next Big Bang !!

These all MAY actually happen !!

Appropriate in Hospitals (4, Insightful)

Rich0 (548339) | more than 3 years ago | (#34827582)

I think that this kind of regulation is appropriate - in certain cases. I think you need to do a FEMA (failure mode effects analysis - basically ask what could go wrong?) and then control your network accordingly.

Modern networking gear is very reliable in terms of transmission accuracy - if you send a packet from A to B and it gets there, it is extremely unlikely that it was modified (unless deliberately). It is not so reliable in terms of guaranteed transmission.

So, if we're talking about a network being used to display a lab test in a doctor's office, I'd argue that there is a pretty low risk of anything going wrong and strong control over the network should be unnecessary (beyond general good security practices that would apply in any business setting).

On the other hand, if we're talking about monitoring equipment, I'd say that control of the network is critical, unless there is some kind of backup for communicating alarms. If an alarm in a patient room is likely to be heard and responded to without the aid of the network, then it is probably important but not critical. If a patient alarm could be ignored if not broadcast over a network, then that network needs to be treated as a life-critical piece of equipment. That means that changes are carefully controlled, and the design has to be fit for purpose. Lives are at stake, and if some cheap router hangs up without a backup of some kind, or if a cable is left detached during maintenance and isn't caught by routine procedure, somebody could die.

The sad thing is that regulations like this are likely to get abused in two different ways (I've seen this happen in other regulated industries):

1. It will be over-applied in areas that are not really at risk, driving up all kinds of costs that consumers end up paying for, and often delaying the introduction of technology that could actually improve care.

2. Because of the huge cost associated with knee-jerk reactions and consultants/etc in #1, administrators will try to skirt the regulation as much as possible, which puts patients at risk in situations where the controls really are appropriate.

In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.

Re:Appropriate in Hospitals (1)

digitig (1056110) | more than 3 years ago | (#34827924)

So, if we're talking about a network being used to display a lab test in a doctor's office, I'd argue that there is a pretty low risk of anything going wrong and strong control over the network should be unnecessary (beyond general good security practices that would apply in any business setting).

On the other hand, if we're talking about monitoring equipment, I'd say that control of the network is critical, unless there is some kind of backup for communicating alarms.

The important thing is that somebody has looked at the use and decided that those levels are appropriate. And if it's not documented, it didn't happen.

It will be over-applied in areas that are not really at risk, driving up all kinds of costs that consumers end up paying for, and often delaying the introduction of technology that could actually improve care.

2. Because of the huge cost associated with knee-jerk reactions and consultants/etc in #1, administrators will try to skirt the regulation as much as possible, which puts patients at risk in situations where the controls really are appropriate.

In other regulated industries I've actually seen "turn the clock back" responses to regulation - where ancient practices that are grandfathered in get preferred to modern practices that are actually better, but which become more expensive to implement due to the presence of the regulation. In this way regulation can actually harm those it purports to benefit. Unfortunately, it usually is still better than the alternative.

Essentially, you need a system that requires somebody to do a HAZOP or functional hazard analysis to see what hazards any new system (or reversion to an old system!) presents. If the hazards are negligible then job done. If they aren't then you do full risk assessment and management, but the extent of that will vary according to the severity of risks. That's pretty much what is done for air traffic control in most of the world, and I think it works well. The problems come when the hazard analysis and risk management are done by inexperienced people or in a blame culture (building a safety culture is hard), or when the insurers won't accept risks that the regulators will.

Sounds familiar (1)

spamking (967666) | more than 3 years ago | (#34827596)

We can't even patch some of our systems or install an antivirus client on some of our equipment because it is considered a "medical device" and would lose FDA certification.

One proposed solution is to VLAN these devices so we don't have radiology equipment spreading conficker throughout our network . . .

Re:Sounds familiar (0)

Anonymous Coward | more than 3 years ago | (#34827682)

Why does the radiology equiment need to be given access to the internet anyway such that it would ever get infected by conficker?

Re:Sounds familiar (1)

spamking (967666) | more than 3 years ago | (#34828144)

Exactly. Our Bio-Med folks manage these devices but IT has been given the responsibility to patch many of them.

Re:Sounds familiar (1)

vlm (69642) | more than 3 years ago | (#34828812)

Why does the radiology equiment need to be given access to the internet anyway such that it would ever get infected by conficker?

So they can update the bugs in the software, as required by the FDA. Even if there are no known bugs, what if they later discovered the billionth patient would get irradiated to a crisp, they need to prove to the FDA they could theoretically deploy a patch.

Also some very expensive embedded hardware (not exclusively medical) phones diagnostic data home for troubleshooting. You're not going to print out a one million line trace file, are you?

But that makes sense anyway. (3, Insightful)

rdunnell (313839) | more than 3 years ago | (#34827754)

And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.

Re:But that makes sense anyway. (0)

Anonymous Coward | more than 3 years ago | (#34828714)

Umm, radiologists these days (and doctors in general) tend to be able to review images remotely. It's a very good reason to have your radiology machines on a main network. You simply need to make sure access is restricted to authorized users.

Re:But that makes sense anyway. (3, Informative)

eth1 (94901) | more than 3 years ago | (#34828996)

And that's part of the point. Why would you want your radiology machines on any sort of main network, regardless of whether they can or can't be updated? There's no reason for them to be widely available and the technology to firewall it off is not expensive when compared to the cost of, say, a collection of medical imaging systems that will sit behind it.

Well, since you ask...

I manage firewalls for several hospital chains. One of the main reasons that their radiology stuff is connected to their main network is that those images are all stored digitally, and need to be available all over the place (Dr.s' offices, etc., that may or may not be at the physical location of the hospital. Also, most hospitals these days don't have a radiologist sitting around in the ER all night/weekend, any more. They contract with a remote one, so they also have to be able to send those images elsewhere (over a VPN to the imaging service, for example). Often those systems are at least firewalled in a DMZ, but I have yet to see them on a completely separate network (although some clients are making noises in that direction).

Re:But that makes sense anyway. (2)

Gonoff (88518) | more than 3 years ago | (#34829228)

If the scanners are on the network you can...

  • see it from PC beside scanner
  • see it from consultants office
  • see it from any PC in hospital - if the user has permission
  • on call consultant can VPN in from home to look at it
  • show patient in ward
  • compare it against earlier pictures
  • compare it against reference scans
  • teleconference and discuss it
  • check whether your scanners actually work properly

Hospitals here have some pretty serious rules & policies on Information Governance. If it is properly looked after, we should use this equipment in ways that get maximum benefit for the patients.

Re:Sounds familiar (2)

Attila Dimedici (1036002) | more than 3 years ago | (#34827944)

While as other people have said, that equipment should not be on the main network, the reason you have this problem is that the person who wrote your validation documentation wrote it wrong. I work in a GxP laboratory environment and the key to this sort of thing is writing the validation correctly so as to allow patching of the systems and updating/changing the antivirus client without requiring a change control. Unfortunately, it has only been in the last 2-4 years that it has become accepted that it is ok to do so.
Even with the way that your validation documentation is written (at least as it appears to be from your comment), you could patch your systems and install an antivirus client on them, it is just that you would need to do a change control in order to do so. Actually, unless the original documentation was unusually anal, you could probably patch the systems without a change control. Of course that would require someone who both knows and understands computers and knows and understands the specific regulations as they apply to your specific application to have sufficient pull within the organization to do this.

Re:Sounds familiar (1)

digitig (1056110) | more than 3 years ago | (#34827988)

We can't even patch some of our systems or install an antivirus client on some of our equipment because it is considered a "medical device" and would lose FDA certification.

If it really are safety of life equipment there should be no way for a virus to get in, and that should be documented. If folks are connecting to the net or installing pirated games on safety of life equipment, the problem is not that you can't install an antivirus client. And as for patching the systems, if you can show that the patches are developed to FDA standards, you can patch them. If you can't, you shouldn't even be considering it.

Sometimes the hard way is the best way... (1)

rs1n (1867908) | more than 3 years ago | (#34827656)

While I can understand the desire to have the network of medical devices converge with data networks due to ease of management, sometimes it is safer, and better, to keep them separated at the cost of lower ease of use. For one, a network outage would not take out access to the medical devices that keep people alive. The last thing we need is for someone to hack into hospitals and mess around with medical equipment.

The article points out many issues with such convergence: network outages, security, spectrum limitations (for wireless networks), increased overhead and regulation, etc. All this simply to make management of such networks easier? Are you kidding me?

Watch as... (0)

Anonymous Coward | more than 3 years ago | (#34827718)

...a $1000 commercial AP point morphs into a $50,000 medical grade AP. Yay Medicaid/care.

Re:Watch as... (1)

Overzeetop (214511) | more than 3 years ago | (#34827814)

Depends on who you are. If you have a warehouse full of $1000 commercial APs and a box full of "Medical Grade / FDA certified" stickers in you desk drawer - it looks like you'll be retiring early!

spon6E (-1)

Anonymous Coward | more than 3 years ago | (#34827774)

Theo de Raadt, one i5 the ultimate

Say hello to the... (0)

Anonymous Coward | more than 3 years ago | (#34827876)

.. $2,000,000 router with 4 gigabit ports and draft-n!

What is the word then.. (1)

Aldenissin (976329) | more than 3 years ago | (#34827928)

If something is not exactly voluntary and yet called voluntary, what is the real word for that? And I don't mean non-voluntary. What is a word for something that is voluntary, but not 100%? I.e. there are consequences if you don't. Because then it isn't "completely" voluntary.

Mandatory (1)

gd2shoe (747932) | more than 3 years ago | (#34828612)

People are bound to disagree with me, but I'd say "mandatory". It has been mandated that non-compliance has consequences. The word is usually used as a strict synonym for compulsory, but that's overstepping.

In other words, you're not being compelled to comply, but consequences have been mandated. If you would say that you are being compelled, then you could not say that it is voluntary.

FDA vs FCC? (1)

schwit1 (797399) | more than 3 years ago | (#34828364)

Can the FDA regulate wireless networks? Just because the network is in a hospital?

I don't disagree that they should be as secure as possible due to the sensitive nature of the data.

ISO8001:1 2010 (1)

bugs2squash (1132591) | more than 3 years ago | (#34828428)

Does not appear to be available without paying for it (in Swiss franks even). If the US government is going to mandate something it could at least have the decency to post a free copy of what it mandates on a .gov web site for all to download.

Oh, That's Just Great.. (0)

BlueStrat (756137) | more than 3 years ago | (#34828512)

Yeah, "threaten" them with not paying for Medicare/Medicaid patients that they typically lose money on and that they'd prefer not to deal with anyway? So, what's to stop the hospitals from simply saying "Your proposal is acceptable", and refusing to treat (other than immediate emergency stabilization in preparation for transfer to other facilities) any Medicare/Medicaid patients?

There are already an increasing number of doctors who are dropping and/or refusing to accept any more Medicare/Medicaid patients due to Obamacare. I guess the government thought that hospitals shouldn't be left out. Perhaps we'll start seeing back-alley appendectomies and hip surgeries join back-alley abortions.

Strat

not just encryption, what about rf? (1)

trb (8509) | more than 3 years ago | (#34828810)

I imagine that FDA medical device directives would have rules for data security and for RF emissions as well. I am a bit more familiar with CE medical device directives, where there are different classes of compliance - a device that filters your blood has stricter rules than an exercise machine - but besides protecting patient data, I assume a computer or network device in a medical environment would have to have have low RF emissions, so that it doesn't interfere with other medical devices. When your microwave oven interferes with your cordless phone or your wifi network at home, it might be annoying, but a similar situation in a hospital would be a bigger problem.

Have they (0)

Anonymous Coward | more than 3 years ago | (#34829030)

spec'd any MS-only stuff? (DNRTA)

Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Sign up for Slashdot Newsletters
Create a Slashdot Account

Loading...