NIST SPECIAL PUBLICATION 1800 -8 Securing Wireless Infusion Pumps in Healthcare Delivery Organizations Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B), and How -To Guide s (C) Gavin O ’Brien Sallie Edwards Kevin Littlefield Neil McNab Sue Wang Kangmin Zheng This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800 -8 The first draft of this publication is available free of charge from: https://www.nccoe.nist.gov/sites/default/files/library/sp1800/hit -infusion -pump -nist-sp18 00-8- draft.pdf NIST SPECIAL PUBLICATION 1800 -8 Securing Wireless Infusion Pumps in Healthcare Delivery Organizations Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B) ; and How-To Guides (C) Gavin O’Brien National Cybersecurity Center of Excellence Information Technology Laboratory Sallie Edwards Kevin Littlefield Neil McNab Sue Wang Kangmin Zheng The MITRE Corporation McLean, VA August 2018 U.S. Department of Commerce Wilbur Ross , Secretary National Institute of Standards and Technology Walter G. Copan, Undersecretary of Commerce for Standards and Technology and Director NIST SPECIAL PUBLICATION 1800 -8A Securing Wireless Infusion Pumps in Healthcare Delivery Organizations Volume A : Executive Summary Gavin O ’Brien National Cybersecurity Center of Excellence Information Technology Laboratory Sallie Edwards Kevin Littlefield Neil McNab Sue Wang Kangmin Zheng The MITRE Corporation McLean, VA August 2018 This publication is available free of charge from : https://doi.org/10.6028/NIST.SP.1800 -8 The first draft of this publication is available free of charge from: https://www.nccoe.nist.gov/sites/default/files/library/sp1800/hit -infusion -pump -nist-sp18 00-8- draft.pdf NIST SP 1800 -8A: Securing Wireless Infusion Pumps 1 This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.1800 -8. Executive Summary ▪Broad technological advancements have contributed to the Internet of Things (IoT) phenomenon, where physical devices now have technology that allow them to connect to the internet and communicate with other devices or systems. With billions of devices bein g connected to the internet , many industries, including healthcare, have leveraged, or are beginning to leverage , IoT devices to improve operational efficiency and enhance innovation. ▪Medical devices, such as infusion pumps, were once standalone instrumen ts that interacted only with the patient or medical provider. With technological improvements designed to enhance patient care, these devices now connect wirelessly to a variety of systems, networks, and other tools within a healthcare delivery organizatio n (HDO) —ultimately contributing to the Internet of Medical Things (IoMT). ▪As IoMT grows, cybersecurity risks have risen . According to the Association for the Advancement of Medical Instrumentation (AAMI) Technical Information Report 57 (TIR57), “this has c reated a new source of risk for [the] safe operation [of medical devices].” In particular, the wireless infusion pump ecosystem (the pump, the network, and the data stored in and on a pump) face s a range of threats , including unauthorized access to protect ed health information (PHI), changes to prescribed drug doses, and interference with a pump’s function. ▪In addition to managing inter connected medical devices, HDOs oversee complex, highly technical environments, from back -office applications for billing and insurance services , supply chain and inventory management, and staff scheduling , to clinical systems , such as radiological and pharmaceutical support. In this intricate healthcare environment, HDOs and medical device manufacturers that share responsibility and take a collaborative, holistic approach to reducing cybersecurity risks of the infusio