hey there biohacking village thanks this
opportunity to speak today my name's
quadi and the name of my talk today is
there and back again a healthcare
cybersecurity policy tale
uh we're going to go ahead and get
started
a little bit about myself before i begin
uh first and foremost i'm a hacker so i
grew up in the hackers space
i go to hacker conferences i
really identify with the hacker mindset
and i use a lot of the same skills and
tools as hackers to do my day job
which is actually being an emergency
medicine doctor so
most of the time when i'm at work i'm in
the emergency department taking care of
all sorts of sick patients that come to
me whether or not they'd be having heart
attacks or strokes or having severe
infections like sepsis or over the last
year and a half or so been having
coveted infections
uh really combining those two worlds was
something that i've had the tremendous
honor of being able to do so i am both a
hacker and a doctor combine those
together
it really guides my research
so i do some active research on medical
device vulnerabilities hospital
infrastructure vulnerabilities and the
point of that really being i care a lot
about patient privacy and security but i
care more about
their health and safety and that cyber
attacks including transfer attacks are
impacting my patient's health and i want
to study that
i'm also unapologetically a geek sorry
not sorry you're going to see a lot of
geeky meme references in my presentation
and i'm sorry you're going to have to
deal with that
my twitter account is at cdmfmd hit me
up if you have questions
so
when contemplating what to speak about
today i had a lot of different things i
could go over i could talk about some
new research that came out i could talk
about some new aspect of the problem
that people might not understand from a
clinical workflow situation but really
the more and more i thought about it the
more i felt kind of hopeless
and it's that the
problem has not changed much since we
started talking about this right
hospitals are still under attack
in fact the ransomware attacks of the
last several years are increasing in
frequency sophistication disruptive
potential that's not going away
and then medical devices you know there
has been a lot of work done by the fda i
see maybe a shimmering uh glimmer of
hope in the future for uh really
improving the medical device
cyber security posture but with that
being said there's still a lot of
operational issues a lot of problems
with legacy medical devices and as a
consequence what we have is pretty much
the same damn conversation that we've
been having uh for the last 10 years on
this and um what what i wanted to do
with this talk is to say okay well uh
we've admired this problem uh so long
we've danced around some potential
solutions most of those uh we say are
call to action you know do something
about it but what are we talking about
would be required to actually
make this problem even a little bit
better at a scale that would matter
so i hope today to talk a little bit
about
maybe moving in a little bit of a
different direction and realizing that
um although it's very important for
hackers uh in the community to get
involved we're only so we can only do so
much and truly we need to be talking
about really big solutions uh to try to
move this needle
so
i think to reframe the problem is that
we're continued we're continually
having these issues and uh not having
much improvement we're pissed off and
we're tired
and that's not a dangerous combination
uh to have people not care about this
problem as much as they should and you
can ask a lot of people in the space i
think they feel the same way and they
work so hard to try to move the needle
and it doesn't really work
so the other thing to say is well hold
on a second is this even a fixable
problem and i think that the answer is
of course
you know you can't fix cybersecurity
vulnerabilities
that's not the nature of the problem
there are going to be inevitable flaws
in hardware and software uh that are
going to allow for vulnerabilities and
exploitation of those vulnerabilities to
change the function
of a system to where it wasn't intended
so this discussion that you know we need
to finally push this boulder to the top
of the mountain and then we'll fix this
issue we can move on is one that is just
not based in reality
instead what we should be understanding
is that we have a particularly
vulnerable
set of circumstances right now that we
need to fix and then we need to
establish sound policy and a good
foundation
to not fix this issue of healthcare
cybersecurity or vulnerable medical
devices but to instead be able to reduce
the risk to an acceptable level
so that we can take care of patients
patients get the care that they need you
know in a hospital in their clinic
wherever it may be
and the risk
of a large cyber attack disrupting that
and impacting their safety or their data
is greatly reduced so what is that going
to actually require it's not going to be
a fix we're not going to finally
do some legislative action or finally
some hackers are going to stand up and
it's going to be fixed instead this is
going gonna be something we're dealing
with a very long time and if we actually
take a little bit of an outward case of
it uh we could fix a vast majority of
the problems we have now of course there
will be new ones but then we have to
really look at a global approach and
understand how we tackle this issue not
just in the united states but across the
globe that's also a very very hard
problem so
a little bit of a continuation of the
we're pissed off and we're tired but i
think if anything it should encourage us
to be renewed in our
enthusiasm to try to try to make this
problem at least a little bit better
the first things i wanted to bring up
you know quite frankly is that we have
very little data
this is a problem
you know we can't make meaningful
decisions
and really get to the heart of an issue
if we can't even measure how big the
problem is
you know there are
many possibilities in this one that
the data if we thought it would show
that cyber security risks to patient
safety and care quality are overblown
that's a possibility
and that all of this energy and
time and technology and money that we
put into trying to make this problem
better could actually be better spent by
giving it to cancer research for example
um that's one possibility the other
possibility is that
there is
much
patient harm going on right there's uh
to the degree that we don't even
understand
and currently can comprehend there may
be drastic impacts of patient safety and
care quality to where this is a really
meaningful
thing to focus on and to work to improve
the truth probably lies somewhere in
between but again if we can't even
collect the basic data
we can't even measure the magnitude of
the problem it's unreasonable for us to
expect to have a decent solution
what is that going to mean for us moving
forward well we're going to have to
collect that data there are a lot of
problems
with that first of all
when i went to go write a paper i went
to go see if there was a centralized
repository or a database of ransomware
healthcare attacks right i want to see
really how prelim this was and most of
what i was getting are industry reports
there are companies that have a vested
interest in selling products and
services around ransomware protection or
response or mitigation whatever it may
be
and uh that they
use
their methodology to try to extract the
magnitude of the issue and um it's
better than nothing for sure but what i
would suggest we need is a more rigorous
approach to collecting this data a more
academic and scientifically validated
process why when we collect even
something as basic as uh how many
hospitals are getting hit with
ransomware and what are the impact and
magnitude of that
of those attacks the first thing i'm
going to kind of throw a wrench into
here is the discussion of whether or not
there should be mandatory reporting this
is not a easy thing to suggest or uh it
is so
obvious a solution to our problems
instead it's just a first step into
discussing you know would something like
if you're infected with a ransomware at
a hospital you have to report to a
centralized agency you know for example
when you were hit when you fully
recovered
what you were hit with and perhaps if
you paid the ransom and how much those
basic demographic type of things um
aren't present and i think what we
should be focusing on is how can we
encourage an environment where reporting
of this isn't disincentive and
disincentivized what do i mean by that
because ransomware attacks involve often
protected health information
many hospitals immediately after being
hit by ransomware do not discuss the
specifics of the ransomware they're
trying to recover they're trying to
negotiate potentially a ransom payment
they're trying to show up their systems
uh they and they are also afraid of a
violation of hipaa and a big fine
those are all kind of a perfect storm
for
hospitals and other healthcare
organizations to not want to have to
talk about this so how do we
destigmatize this as well as allow an
environment where reporting isn't seen
as such a negative thing and said the
value of the data is so important that
it's self-evident that people should
report and if that doesn't work you know
how do we compel organizations in a uh
give-and-take way to report that for
instance discussions of safe harbor or
anonymization of data to a meaningful
way with hospitals who get assurances
that they won't be identified if they
report that particular information
but even something as basic as that
would go a long way for us to record and
then measure the impact of cyber attacks
in healthcare
the other thing i'm going to say is that
it's very clear
that
in addition to have having a lack of
just very basic information we do not
have a research infrastructure in place
to study this what do i mean by this
heart disease cancer diabetes these are
horrible horrible pathophysiological
conditions that result in
lots of morbidity and mortality for
human beings across this entire planet
there are organization government
organizations that fund research
into these types of diseases for the
purpose of alleviating human suffering
and death what does that mean they
invest in researchers to actually study
these phenomena these particular
diseases well my second call here and
perhaps not too much of a controversial
one is really that these types of
agencies the national institute of
health the national science foundation
should prioritize funding into this not
just by giving dollars and cents but
also to encourage researchers across the
united states and globally to actually
make this an area of study
if you go and look at the research you
go go into pubmed and start looking into
the patient care implications of cyber
attacks you're going to find a handful
of papers if that that's amazing to me
we see this on the front page of
magazines almost every single day
newspapers magazines on the internet
almost every single day healthcare
ransomware healthcare cyber attacks
medical device vulnerabilities but yet
our infrastructure our scientists at the
heart of being able to study a problem
like this aren't focusing on it and i
think that's a missed opportunity so my
call is is then to develop a funding
stream for research and encourage
researchers across the globe to actually
study this
this paper
that we publish discussing how cyber
attacks
are like disasters for a hospital
hospitals prepare for certain disasters
as part of being a hospital if there's a
hospital in tornado alley they have a
plan for what happens if a large
tornado's around them or if a tornado
actually hits the hospital if they're in
an earthquake zone they have the same
these types of hazards to the hospital
and their ability to take care of
patients and do business
should take into consideration cyber
attacks and many of them do it's become
so relevant now that many forward
thinking hospitals are preparing for
cyber attacks like disasters this is a
relatively new concept and why am i
bringing this up i've talked about this
in other forms before of course it makes
sense cyber attacks can be so
debilitating to a healthcare
organization and of course they can look
like disasters but the point of it is
now we're learning something new
cyber disasters impacting a particular
hospital hit with ransomware for example
is one thing what happens to the care of
patients at that facility where they
don't have an electronic health record
or they don't have medical devices such
as ct scanners whatever it may actually
be there's the impact of patient care at
that specific hospital or hospitals that
are hit
but now we know something new
it's truly this concept of this
healthcare ecosystem unfortunately 2020
was such a horrible thing 2021 shaping
up to not be much better but we learned
something here which i think is
important to point out
and is very obvious
when you think about it
so hospitals and other healthcare
organizations we'll talk about a slide
in a minute about what this healthcare
ecosystem is like they form symbiotic
relationships and so what happens to one
affects the other
this makes sense
let's talk about that in the concept of
a ransomware attack if you have a a
metropolitan area taking care of five
million people
there's going to be a finite number of
hospitals
and other health care facilities in that
region right well uh not every hospital
is equipped to take care of every type
of patient we have trauma centers we
have stroke centers we have
cardiac arrest and um
heart attack centers that focus on
particularly sick patients and
specialize in their care and furthermore
there's a finite number of hospitals to
take care of all the patients but we
don't have redundancies meaning we don't
have backup hospitals if things go down
what we learned uh with a recent
ransomware attack was that
five hospitals in a geographic location
went down
and then all the adjacent hospitals to
that system that went down had to pick
up the slack
they saw huge influxes of patients to
the emergency department they saw
huge increases in the amount of
ambulances that had to come to their
facilities
they saw increased numbers of strokes
and heart attacks what does that mean it
means that even if you aren't hit by
ransomware because of the healthcare
ecosystem you can still be impacted what
you should take away from that
is that
hair can suffer across a geographic area
when one health care system of many goes
down
we could realize that we're only as
protected
as our least defended communities
meaning one hospital might invest a lot
in cybersecurity one may not but it
matters that they all do because what
happens that one will affect the other
as wise obi-wan here said
it's not just hospitals
you know we had this miracle um you know
i'm not religious i mean like a
spiritual or religious miracle but i
mean we had this amazing thing happen
where the
where covet happened and we were very
quickly able to develop a vaccine for it
that's amazing that required a lot of
science research infrastructure drug
development
and
logistics to actually make that happen
in the short amount of time that it did
that was to respond to a crisis and what
i think it shows is that of course that
makes sense that there are so many
pieces of this healthcare ecosystem all
of which are running vulnerable
connected infrastructure and that if
something happens at one part of the
ecosystem it's gonna affect the other if
the researchers uh doing coveted
research and developing that vaccine
were hit with ransomware even a delay of
weeks to months in that regard would
have resulted in millions more dead
and likewise with things like ppe
production etc
it's a
very complex and intricate web and what
we should realize is that we really have
a bigger problem than just biting off
medical device cyber security or just
talking about
hospital infrastructure security and
ransomware resiliency truly to actually
make a resilient
and
thinkable health care system we have to
raise the bar for everybody
this is the concept the cyber halves and
have nots
i worked in all of these hospital types
of hospitals i've worked in
hospitals that are very poor
that have no resources they don't have
two nickels to wrap together
they have they don't have the latest
connected medical devices they have old
antiquated electronic health records
they have very vulnerable infrastructure
and i've worked at other facilities that
had marble floors and
were very well resourced and and
could take and have the and have the
expertise in-house to do a decent job of
cyber security
these hospitals can be across the street
from each other sometimes or in the case
of rural uh hospitals or critical access
hospitals sometimes there's only one
hospital near you and the next one can
be 500 miles away
what we truly have are cyber haves and
have-nots in healthcare and what we need
to realize is that we need to raise the
bar for everybody because one affects
the other and it's just the right thing
to do
so how do we do that how do we
accomplish something like that given
that that's a pretty tall order
well um
perhaps the second thing i'm gonna talk
about today
is to say i've really
seen recently that we need to engage
this at a national policy level
and that we could
continue to try to solve this at the
micro level and that will be a big
important thing we're going to need
hospitals to step up individually of
course we're going to need medical
device manufacturers to continue to do
that clinics et cetera we need the
private sector to help accomplish that
but i think i'm thinking more and more
i'm convinced that we're going to need
some real national legislation on this
and what would that look like and how
would we be able to do this in a way
that's actually effective and not
counterproductive
when i thought about that and some other
people have been talking about using
this mechanism
to do such a thing
i wanted to bring it to everyone's
attention here and to discuss what
something like this might look like
and what
many people are talking about and what
it reminds me of is something called the
2009 high tech act as part of a large
investment
in america there was a big spending bill
and part of this was this high-tech act
at a part it was designed to improve
electronic health record adoption among
health care it did many other things but
just the at the heart of it that was one
of the biggest things they tried to do
so what do you what do you mean in 2009
we had a bill that said hospitals should
be off of paper records and be an
electronic health record the answer is
yes and prior to that many hospitals and
health care systems um
were still on paper in even in 2009
and so many people are shocked to find
that like well i don't go every hospital
i engage in now is on electronic health
record well it probably was because of
this 2009 high tech act and there were
people and there were hospitals before
that electronic health record sometimes
over a decade but it took this
legislation to really catalyze the
change
there are reportedly there were three
stages to the legislation and basically
stage one was data capture and sharing
stage two was advanced clinical
processes and stage three was to try to
leverage all that technology to improve
healthcare the thought was is that
electronic health records are much
better than paper they're more efficient
we can save money by sharing records
there are lots of reasons why the united
states would care about uh making sure
our hospitals were on electronic health
records
uh and it did a good job in doing that
now there were a lot of failures and
we're going to talk a little bit about
that in a minute but one of the things
that it succeeded in was at least
offering uh carrots you know this
concept of carrots or sticks you want to
incentivize people versus penalize them
as a way to catalyze change
what they did was
they would increase the amount of money
that the federal government would give
them for certain uh medicare funding for
patients so for example
you have medicare you go see a hospital
and if they met um stage one
they were self-certified that they met
this level of electronic health record
use that satisfied stage one well then
when they send a bill to the federal
government for your health care the
government would give them a little bit
extra because they met this particular
standard so that was the parrot if you
go to electronic health record you meet
these types of standards under stage one
or stage two or stage three as time went
on
uh then we're gonna give you a little
bit more money
well that was thought to be a way to
incentivize the hospitals to do that
they'd get these incentive payments and
they could use that to pay back the
investment that they made in the
electronic health record
and what was realized is that we can't
keep giving money out
for everybody for
for the type of stuff for in perpetuity
so it transitioned from a carrot to a
stick and where uh wherein as the years
moved on you'd get less and less money
and in fact at one point it flipped and
said you will give you less money taking
care of medicare patients uh unless
you're on electronic health record and
that was successful in a lot of ways of
making hospitals and healthcare
organizations go towards electronic
health records there were a lot of
failures uh
some people cite the involvement of
vendors in this
diluting the recommendations some
cited
failures in clearly defining
interoperability requirements and long
story short despite its failures it was
successful in catalyzing change the
question is can we use this model
as a
way to improve
health care cyber security in some type
of legislative action
so the thought is is this something that
could pass you know could you get the
house and the senate to agree on a bill
could you get the president to sign
something
that would improve meaningfully the
cyber security of health care
and could you do so by using this type
of
stages meaningful use type model
so
none of this
to my knowledge is very public
or exactly what would potentially end up
in a bill yet i think is still being
figured out but the thought would be
something like staged approaches you
know you can't take a rural critical
access hospital that has basically no
cyber security protections and expect
them to have a high level of protections
in a year without substantial
internal investment
money as well as expertise which we've
talked about time and time again we just
really don't have a lot of healthcare
cybersecurity expertise so you can't do
that overnight
the thought would be that you could do
it in stages
and perhaps you um list a bunch of
controls you can say hey multi-factor
authentication is useful in
in protecting some of these types of
attacks or reducing your risk perhaps
multi-factor authentication will be on a
list of certain controls
that could
be part of
a stage one
satisfying stage one
and then stage two may be a little bit
more stringent
you'd move towards a better architecture
for example or you would adopt
additional controls to continue to
harden your infrastructure and then
stage three of course hopefully meeting
some really meaningful defensive posture
for hospitals as well as have built in
the appropriate infrastructure at each
individual healthcare organization so
they can continue
uh defending updating patching learning
about the latest vulnerabilities and
defending their enterprise essentially
um there has been thoughts you know
about self-attestation you know auditing
hospitals and healthcare organizations
that say yes we meet these certain
benchmarks um
and then if you get audited and you
actually didn't then perhaps you could
suffer some tremendous fine
would we use and send incentivation
incentives should we use incentives like
cms monies right so
should we say you get more money
from the government for every patient
you take care of with medicare if
you're particularly secured
a very controversial one but one i want
to bring out is that
perhaps we use this type of legislation
to also provide some type of safe arbor
or protections for certain data breach
implications and i know that's very
controversial but let me just hear me
out for one second as there's a
potential mechanism to incentivize
hospitals to do this if a hospital was
to meet a certain criteria of cyber
safety or cyber security protections and
then they still get breached right they
have a state actor
or a zero day hits them
and they have loss of patient records
the thought being because they met
certain benchmarks that were clearly
defined by the law should they still be
liable for
hipaa fines under ocr for example and
some would say that that would be
incentivizing if hospitals to do this if
they could say we met a certain standard
we had this particular type of attack
and we shouldn't be fined the same
amount as if we had not invested in
cyber security at all
and then perhaps to
further
incentivize hospitals to not pay fines
but use that type of money to reinvest
back into cyber security would
potentially be another carrot to offer
hospitals to do this because it's clear
that such a endeavor as this would be
tremendously expensive
i think it's clear that many people who
would say the government should fund
something like this would probably also
say that we should have the same uh
carat eventually turns into a stick and
that certain hospitals that don't meet
standards eventually
should have some disincentive for
continuing to do that
could you tie
uh this bill uh into other types of in
additional efforts uh outside of this
meaningful use framework yeah you could
there's been uh john corman and others
have discussed this concept of a cash
for clunkers for old medical devices
with this big legacy medical issue
medical device issue how do we just get
those out of circulation the thought
would be that you could subsidize the
cost of buying new more secure medical
devices and turn in your old ones uh
could also be a part of such a
legislative action or a legislative bill
and then i think it's clear and you've
probably heard me talk about this
previously it's clear that we need to
educate nurses doctors technicians other
people in this space about health care
cyber security not only for a um
an issue of patient safety but also for
data protection you know they're users
of this technology and they're often
responsible for these breaches through
phishing attacks etc
there's a lot
there's a lot of things in here i think
that will be
[Music]
encouraging of a further dialogue and
conversation you know there'll be
many people on the spectrum
one the private sector can solve this
uniquely two hospitals are
over-regulated why would you encourage
something like this three uh this isn't
improving we need something else to spur
action
i hope that this talk was a
was received in a way to spur dialogue
and then encourage you to engage with
your representatives that is probably
the biggest thing i could recommend at
the end of this is that there's it's
clear that we need to do something big
and bold in my mind and doing that in a
mindful and uh thoughtful way as to how
it will impact
actual healthcare delivery is important
all of you out there listening today
have tremendous expertise and knowledge
in the space that needs to be
harnessed to craft
a meaningful bill
and so i would hope that if you have
strong opinions on any
part of this so and more that you made
those make those known to your uh your
representatives in congress and
elsewhere and then i hope that we as a
community of hackers can have meaningful
policy conversations because we possess
unique technical insights that often
representatives don't and so when
they're drafting language and using
particular
explanations of what particular controls
can be they can make mistakes and us as
hackers
are experts at gaming systems and we
don't want that to be the case in
something like this we want something to
be meaningful and with that i'm going to
go ahead and say send me any questions
you have on twitter
and if you have
any thoughts about something you'd like
in policy please send it my way uh
perhaps we could establish some type of
form and dialogue where we can collect
all that
hit me up on twitter and again thank you
very much