Health Watch: Can Medical Devices Be Attacked By Hackers?
NEW YORK (CBSNewYork) -- If you feel vulnerable when you're in the hospital it turns out you've got company -- so is the hospital itself.
According to cyber security expert Billy Rios, of Whitescope, many medical devices, such as the IV pump, are connected wirelessly to a centralized computer network, making it easier to monitor, CBS2's Dr. Max Gomez reported.
"It's a medical device, but the way this thing runs it's really just a computer," Rios said. "By design, you're allowing it to where someone else can control this thing remotely and do things to the pump, or do things to the device or equipment. You have to understand what you're doing before you do this."
Rios examined a number of popular hospital infusion pumps and the results were chilling.
"You could basically log into this device with no user name and no password," Rios said.
This means just about any hacker with an internet connection could remotely operate the device or change its settings. The same is reportedly true of people's personal medical devices such as insulin pumps and heart pacemakers.
The danger is serious enough that former Vice President Dick Cheney had his pacemaker's wireless function disabled. But Rios says most device manufacturers are slow to fix what they consider only theoretical problems.
"Normally what has to happen is we have to wait for someone to be killed, and that's not a good position to be in," Rios said. "We don't want someone to have to die in order for them to become a data point in order for us to make a decision."
Because of Rios' research, the FDA has issued an alert, warning health providers to discontinue use of some specific IV pumps. But because there is no actual defect, there was no requirement to do so, which also means there is no guarantee that the person controlling your life-saving device is someone with your best interest at heart.
Financing is part of the problem. The cost of adding security to an old machine can get expensive, especially whenthe same funding is needed to provide more life-saving devices. And sometimes, manufacturers may only offer a fix if the hospitals purchase new models from them.