PANACEA Research is designing, developing and deploying a Toolkit for people-centric cybersecurity in healthcare. The Toolkit spans four technical tools: A Dynamic Risk Management Platform, a Secure Information Sharing Platform, a Secure Design Support Platform, an Identity Management Platform, and five non-technical tools: A Training and Education for Cybersecurity Tool, a Resilience Governance Tool, a Secure Behaviours Nudging Tool, a Value Assessment Tool and an Implementation Guidelines Tool.

The PANACEA Report on User and Technical Requirements and Scenarios (April 2019) is the starting point for developing this new Toolkit. These requirements and scenarios focus on protection from cyber threats in healthcare organisations and medical devices. To this end, PANACEA has defined four models of health services & medical device lifecycle and their taxonomies. 

Healthcare Organisation Model

The Healthcare Organisation Model covers all the IT assets, spanning software applications, hardware infrastructures, medical and non-medical data, workstations and the network infrastructure, as well as medical devices, e.g. radiology equipment, cardiac pacemaker, homecare devices). Its catalogue includes clinical and corporate services that are articulated in 38 services, e.g. radiology, apps for patients, accounting and clinical reporting, wearable external medical devices, staff identification devices, employee-owned devices (BYOD), data centres and networking devices. This model also covers processes such as operational workflows, with 21 health processes ranging from emergency, operating rooms to clinical trials and home care services, as well as 15 administrative/technical processes, e.g. procurement, accounting and facility management. Roles span people within the healthcare organisation, e.g. health and non-health roles, and anyone interacting with it, e.g. suppliers, patients, their relatives and friends. Finally, it covers organisational functions, with 36 hospital health functions (e.g. general surgery), 18 territorial health functions (e.g. ambulance services, hygiene), 15 support functions (e.g. procurement and information system management).

Device Lifecycle Model

The Device Lifecycle Model covers all the device lifecycle phases (‘D-Lifecycle Phases’) and people operating them (‘device roles’). There are 5 types of medical devices: mobile, stationary, wearable external, implantable and supportive. These devices fall under the technological services, i.e., IT assets in the Healthcare Organisation Model. There are 12 lifecycle phases for medical devices, from defining the requirements to device disposal. Compliance with EU regulations is essential, as is device monitoring. In terms of operating medical devices over its lifecycle, key stakeholders not only include manufacturers but also notified bodies, service providers, patients and some of the healthcare providers’ roles defined in the Healthcare Organisation Model.

Systems Lifecycle Model

The Systems Lifecycle Model includes systems, system lifecycle phases and roles. Systems are all the IT assets (information and communication technologies) used in healthcare processes. Basically, these assets are a sub-set of the assets in the Healthcare Organisation Model. The Systems lifecycle phases range from defining requirements to phase out. Systems-roles include suppliers, healthcare providers and patients. 

Cybersecurity for Healthcare Model

The Cybersecurity for Healthcare Model covers technological services, non-technical measures, processes and roles. Technology services include software and hardware used to ensure cyber security, in both healthcare delivery processes and the lifecycles of medical devices and systems. PANACEA identifies 42 cyber security technological solutions intended as a complete portfolio of cyber security solutions. Non-technical measures also apply to healthcare delivery processes and the lifecycles of medical devices and systems. These include training, which is critical for cyber risk awareness and good behaviour practices, as well as procedures for performing technical activities, such as data labelling, phishing simulations, among others. PANACEA has catalogued 26 such measures. Processes are activities that should be executed in a healthcare organisation to ensure cyber security. PANACEA has catalogued 21 such processes as key to identifying, protecting, detecting, responding and recovering functions based on the framework of the National Institute of Standards and Technologies (NIST, U.S.). In this Model, roles refer to the people carrying out processes to ensure cyber security, including external providers. The model includes 52 such roles based on the NIST NICE Cybersecurity Workforce Framework.

End-user validation

As a people-centric approach to cyber security in healthcare, PANACEA Research has tested and finetuned the models with the support of its end-user partners: The Gemelli University Hospital in Rome, 7th Health Region of Crete and the South-South-West hospital group of the Health Executive Service in Ireland, including the lifecycle of an assistive technology robot (QTrobot) and the lifecycle of a software application for Clinical Trials management.

On top of this, PANACEA has mapped its technical and non-technical tools onto the Cybersecurity for Healthcare Model. Since the models are used to describe hospital, medical device and IT system lifecycles, PANACEA has defined ‘Instantiation Schemes’ of the catalogues and relationships as a set of guidelines, tables and matrixes for collecting the data needed for each instantiation. These schemes have also been part of the validation activity.

Future Steps

The four models will guide PANACEA Research partners through all future phases for the design, development and deployment of its Toolkit.

The models could also be used as a ‘Standards Map”, for instance, to compare cyber security solutions for healthcare organisations, or to tailor controls of cyber security frameworks, such as ISO 27001 and the NIST framework to the specificities of healthcare organisations like hospitals, territorial care centres and medical facilities.