Device Management InfrastructureDevice Management InfrastructureWhite PaperWhite Paper

Brief Profile Proposal for IHE Year 2012-2013Brief Profile Proposal for IHE Year 2012-2013

Geoff PascoeGeoff PascoePhilips HealthcarePhilips Healthcare15 November 201115 November 2011

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

The Problem

• Separation between traditional IT infrastructure and devices is disappearingSeparation between traditional IT infrastructure and devices is disappearing– Devices are now computersDevices are now computers– Networked and need to interoperateNetworked and need to interoperate– May have access to longitudinal recordsMay have access to longitudinal records– May manage PHI May manage PHI

• However, there remain and will continue to remain differences:However, there remain and will continue to remain differences:– An order of magnitude more deployed devices than classical IT systemsAn order of magnitude more deployed devices than classical IT systems– Often embedded systemsOften embedded systems– Often real-timeOften real-time– Sometimes connectivity is intermittentSometimes connectivity is intermittent– May be mobileMay be mobile– More highly regulatedMore highly regulated

• Patches and configuration managed by manufacturersPatches and configuration managed by manufacturers

• Can’t install arbitrary cyber security softwareCan’t install arbitrary cyber security software

– May cause direct injury to patientsMay cause direct injury to patients– Little physical securityLittle physical security– Often Managed by Biomeds not ITOften Managed by Biomeds not IT

The VA, alone has more than 50,000 medical devices insulated behind firewall protected VLANs. http://csrc.nist.gov/groups/SMA/ispab/documents/minutes/2011-03/1_ISPAB-VA-Presentation-medical-devices.pdf

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

How Might We Address the Unique Problems of Devices?

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

White Paper Overview (1)

• Develop a White Paper that deals with problem areas in the Develop a White Paper that deals with problem areas in the management of medical devices. Topics include:management of medical devices. Topics include:– Asset ManagementAsset Management

– Asset TrackingAsset Tracking

– DiscoveryDiscovery

– Automatic ConfigurationAutomatic Configuration

– Monitoring and LoggingMonitoring and Logging

– Patch ManagementPatch Management

– Lifecycle ManagementLifecycle Management

– Risk Management GuidanceRisk Management Guidance

– Event Communication—non-alarm system-to-systemEvent Communication—non-alarm system-to-system

– Cybersecurity StatusCybersecurity Status

– Key ManagementKey Management

– User-to–Device, Device-To-Network Authentication User-to–Device, Device-To-Network Authentication

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

White Paper Overview (2)

• Each area would further be prioritized and road mapped for Each area would further be prioritized and road mapped for future development.future development.

• The value(s), in terms of what is to be gained will be The value(s), in terms of what is to be gained will be discussed more specifically within use case descriptions, discussed more specifically within use case descriptions, as the value of each topic area is specific to each. as the value of each topic area is specific to each.

• The quantifiable costs and/or data to demonstrate the The quantifiable costs and/or data to demonstrate the scale of the problem will be outlined within the white paper. scale of the problem will be outlined within the white paper.

• It is expected that the completed white paper would It is expected that the completed white paper would address each topic in sufficient detail to easily, at a address each topic in sufficient detail to easily, at a minimum, create detailed profile proposals, including minimum, create detailed profile proposals, including detailed use cases and well researched candidate detailed use cases and well researched candidate standards.standards.

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

Mapping of Medical Device Issues to Topic Areas

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

Why Should ITI Take on This White Paper?

• PCD needs to address these issues—If we don’t help them they’ll do it themselves.

– Much better to influence these areas while in development

• However, WE are responsible for infrastructure.– These needs are not unique to PCD (e.g., RAD)– WE are uniquely tasked with supporting other domains

• PCD is committing resources to accomplish it.

• Inherently low risk– It’s a white paper– Not driven by Connectathon schedule– Topic areas are relatively modular so scope can be scaled, if necessary

• Excellent opportunity to trial a new way to work more effectively with other domains

• Most importantly, this is an opportunity to transition to a more proactive approach. Completion of white paper can be an important contributor to our long-term, multi-year strategic plan.

IT Infrastructure Planning CommitteeIT Infrastructure Planning Committee

THANK YOU