Date Published: November 2018
Comments Due:
Email Questions to:
Author(s)
Andrea Arbelaez (NIST), Ronnie Daldos (MITRE), Kevin Littlefield (MITRE), Sue Wang (MITRE), David Weitzel (MITRE)
Announcement
The National Cybersecurity Center of Excellence (NCCoE) at NIST is seeking comments on a draft project description that seeks to provide a reference architecture that will address the security and privacy risks for healthcare delivery organizations (HDOs) leveraging telehealth and remote patient monitoring (RPM) capabilities.
Traditionally, patient monitoring systems have been deployed in healthcare facilities, in controlled environments. Remote patient monitoring (RPM), however, is different in that monitoring equipment is deployed in the patient's home. These new capabilities, which can involve third-party platform providers utilizing videoconferencing capabilities, and leveraging cloud and internet technologies coupled with RPM devices, are used to treat numerous conditions, such as patients battling chronic illness or requiring post-operative monitoring. As the use of these capabilities continues to grow, it is important to ensure the infrastructure supporting them can maintain the confidentiality, integrity, and availability of patient data, as well as ensure the safety of patients.
The goal of this project is to provide a practical solution for addressing these cybersecurity challenges and secure the telehealth RPM ecosystem. The project team will perform a risk assessment on a representative RPM ecosystem in the laboratory environment, apply the NIST Cybersecurity Framework and guidance based on medical device standards, and collaborate with industry and public partners. The project team will also create a reference design and a detailed description of the practical steps needed to implement a secure solution based on standards and best practices.
This project will result in a publicly available NIST Cybersecurity Practice Guide (SP 1800 series), a detailed implementation guide of the practical steps needed to implement a cybersecurity reference design that addresses this challenge.
HDOs are leveraging a combination of telehealth capabilities, such as remote patient monitoring (RPM) and videoconferencing, to treat patients in their homes. These modalities are used to treat numerous conditions, such as patients battling chronic illness or requiring post-operative monitoring. As the use of these capabilities continues to grow, it is important to ensure that the infrastructure supporting them can maintain the confidentiality, integrity, and availability of patient data, and to ensure the safety of patients. The goal of this project is to provide a practical solution for securing the telehealth RPM ecosystem. The project team will perform a risk assessment on a representative RPM ecosystem in the laboratory environment, apply the NIST Cybersecurity Framework and guidance based on medical device standards, and collaborate with industry and public partners. The project team will also create a reference design and a detailed description of the practical steps needed to implement a secure solution based on standards and best practices. This project will result in a freely available NIST Cybersecurity Practice Guide.
HDOs are leveraging a combination of telehealth capabilities, such as remote patient monitoring (RPM) and videoconferencing, to treat patients in their homes. These modalities are used to treat numerous conditions, such as patients battling chronic illness or requiring post-operative monitoring. As...
See full abstract
HDOs are leveraging a combination of telehealth capabilities, such as remote patient monitoring (RPM) and videoconferencing, to treat patients in their homes. These modalities are used to treat numerous conditions, such as patients battling chronic illness or requiring post-operative monitoring. As the use of these capabilities continues to grow, it is important to ensure that the infrastructure supporting them can maintain the confidentiality, integrity, and availability of patient data, and to ensure the safety of patients. The goal of this project is to provide a practical solution for securing the telehealth RPM ecosystem. The project team will perform a risk assessment on a representative RPM ecosystem in the laboratory environment, apply the NIST Cybersecurity Framework and guidance based on medical device standards, and collaborate with industry and public partners. The project team will also create a reference design and a detailed description of the practical steps needed to implement a secure solution based on standards and best practices. This project will result in a freely available NIST Cybersecurity Practice Guide.
Hide full abstract
Keywords
application programming interface (API); application security; cybersecurity; data privacy; data privacy and security risks; health delivery organization (HDO); remote patient monitoring (RPM); telehealth; user interface (UI)
Control Families
Access Control; Assessment, Authorization and Monitoring; Configuration Management; Identification and Authentication; Risk Assessment
