House subcommittee holds hearing on cybersecurity vulnerabilities in legacy medical devices

The House Energy and Commerce Oversight and Investigations Subcommittee April 1 discussed cybersecurity threats in legacy medical devices during a hearing. The subcommittee heard from experts on the dangers of outdated devices as the hardware can last several years longer than software.

“Our patients depend on millions of medical devices — many of them aging, machines — to deliver life-saving care,” said Christian Dameff, M.D., emergency physician and co-director for the Center for Healthcare Cybersecurity at the University of California San Diego Health. “The cybersecurity of our legacy medical devices thus becomes a literal matter of life and death."

Erik Decker, vice president, chief information security officer at Intermountain Health, discussed the current state of cyberthreat adversaries as well as the state of medical device security programs.

“The primary concerns with attacks against medical devices are related to patient safety and national security,” Decker said. “Additionally, they can be used for conduits for further attack against an organization. Though there have been no known public attacks against medical devices to cause harm to a patient, the studies and research have shown that such an attack is possible.”

Other witnesses for the hearing included Greg Garcia, executive director of the Health Sector Coordinating Council Cybersecurity Working Group; Michelle Jump, chief executive officer of MedSec; and Kevin Fu, professor from the department of electrical and computer engineering at the Khoury College of Computer Sciences at Northeastern University.