Today, medical devices such as implantable cardiac defibrillators and pacemakers can be equipped with wireless technology to allow for remote device checks. Researchers from three leading universities have demonstrated that a patient’s private medical information could be extracted from these devices and reprogrammed without the patient’s authorization or knowledge.
However, there has never been a reported case of a patient with an implantable cardiac defibrillator or pacemaker being targeted by hackers, and the researchers emphasized that the study was designed to identify and prevent future problems.
The study was led by Kohno, Kevin Fu, an Assistant Professor of Computer Science at the University of Massachusetts Amherst, and Cardiologist Dr. William Maisel at the Beth Israel Deaconess Medical Center and Harvard Medical School. Their report will be presented and published at the IEEE Symposium on Security and Privacy in Oakland California on May 19, 2008.
Dr. Maisel notes that one of the purposes for the research is to encourage the medical device industry to think more carefully about the security and privacy of patient information, particularly as wireless communication becomes more common and operates over greater distances.
In the computer laboratory, the research team used an inexpensive software radio to intercept and capture signals sent from an implantable device. They were able to obtain detailed information about a hypothetical patient, including name, diagnosis, date of birth, and medical ID number. Researchers were able to determine the make and model of the device and access real-time electrocardiogram results as well as data on the hypothetical patient’s heart rate and cardiac activity.
Three prevention mechanisms have been developed that include a notification device to audibly alerts patients of security sensitive events, a device that authenticates requests for access from outside devices, and a vibrating device that patients can sense. All three mechanisms required no power from the battery.
The team only studied one common model of implantable cardiac defibrillator so the susceptibility of similar devices to privacy and security risks is uncertain. The researchers believe future studies are needed to assess potential risks for all of the implantable devices equipped with wireless technology.
