There is a self-sufficient power supply in every operating theatre. If the power fails, batteries automatically switch on. The \"over-break\" of vital devices is delayed perhaps a few milliseconds. But how serious could the situation be if a device system or the device service were once hacked and manipulated?<\/p>\n
<\/p>\n
It seems increasingly real that globally organised extortionists are trying to cause damage in hospitals, as studies (see \"Vulnerability of Swiss hospitals to cyber attacks\") underline. Swiss hospitals and facilities have already been infected with DoS (Denial of Service) computer viruses.<\/p>\n
<\/p>\n
Similar to a blackout, encryption viruses can block individual operating facilities or cause further disruptions. During the carnival in Neuss in the Rhineland, a hospital had to shut down its servers because they had been hacked. In addition to a six- to seven-figure loss, the hospital was unable to treat any more seriously injured patients - for days.<\/p>\n
<\/p>\n
How could such cyber risks be avoided in Swiss institutions, and what legal countermeasures could be taken against them? Interview with Prof. Ursula Sury, data protection expert<\/p>\n
<\/p>\n
Prof. Sury, how difficult is it to spy on or alter data about medical devices?<\/strong><\/em> <\/p>\n Do you know of any cases where equipment has been tampered with in such a way as to cause a malfunction? <\/strong><\/em> <\/p>\n Is liability fully assumed after an anonymous hacking attack?<\/strong><\/em> <\/p>\n What legal measures are useful to protect against unauthorized access?<\/strong><\/em> <\/p>\n \"You have to prove it,\" says Prof. Ursula Sury.<\/strong><\/em><\/p>\n <\/p>\n Do you think the storage of sensitive data in devices and in clouds is legally regulated today?<\/strong><\/em> <\/p>\n Is the networking of medical technology a curse or a blessing for the healthcare system?<\/strong><\/em> In jedem Operationssaal gibt es eine autarke Stromversorgung. F\u00e4llt der Strom aus, schalten sich automatisch Batterien an. Die \u00ab\u00dcberbr\u00fc-ckung\u00bb lebenswichtiger Ger\u00e4te verz\u00f6gert sich vielleicht einige Millisekunden. Wie folgen-schwer k\u00f6nnte jedoch die Situation werden, wenn ein Ger\u00e4tesystem oder der Ger\u00e4teser-vice einmal gehackt und manipuliert worden w\u00e4re? Es scheint immer realer, dass weltweit organisierte Erpresser versuchen, […]<\/p>\n","protected":false},"author":62,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[4448],"tags":[4773],"class_list":["post-11271","post","type-post","status-publish","format-standard","hentry","category-allgemein","tag-05-2017"],"acf":[],"yoast_head":"\n
\nThis would ultimately have to be asked of an IT expert. However, it is generally known that inappropriately secured networked devices in sensitive as well as public hospital areas can be siphoned off and manipulated. This can be prevented with rigorous IT protection measures, corresponding obligations in contracts with IT suppliers and providers and ensuring secure handling by employees.<\/p>\n
\nIn general, yes, but not specifically. However, I think that wrong functionalities in me-dizinal devices bring the biggest problems. Furthermore, sensitive data could be passed on unencrypted for statistical (marketing) purposes.<\/p>\n
\nDifficult. You have to document everything - the security concepts (see \"dormant viruses\") and all the processes and procedures. In the case of liability, the question of fault always arises, i.e. whether security gaps have occurred in a hospital as a result of a demonstrable failure to exercise due care.<\/p>\n
\nThe principle of consent applies primarily. Patients or nursing home residents must be made aware of their rights and obligations with regard to data protection law.<\/p>\n
\nYes, there are sufficient legal regulations such as the Swiss Data Protection Act (DSG 10a). Unfortunately, these legal requirements are not being complied with very much at the moment. - However, it is always a quintessential question of operational protective measures and data processing.<\/p>\n
\nA fact that must be blessedly shaped!<\/p>","protected":false},"excerpt":{"rendered":"