by
Gus Iversen, Editor in Chief | May 01, 2020
From the April 2020 issue of HealthCare Business News magazine
HCB News: At what point do software patches become a facility's concern rather than the concern of the device manufacturer?
SP: Patching of software is a shared responsibility, where the manufacturer’s task is to create the patch, validate it, and effectively communicate it to the devices/healthcare delivery organizations (HDO). The demarcation in responsibility can be made when HDOs have stricter controls over the software update being delivered to the devices on their network, (i.e., a manufacturer may produce and validate a patch, but HDO may allow it to get to the device during specific time periods only).
It is recommended that HDOs create and maintain a standard operating procedure (SOP) for when patches are made available from the manufacturers. Such an SOP should ensure that the manufacturer has validated the patch, ensure that the patch only gets delivered to devices when they are not actively being used, and ensure that if a subsequent issue emerges due to an update, it can be escalated to the appropriate team within HDO and the manufacturer organization, and they will work toward fixing it.
HCB News: Are there any first steps or key resources for HTM teams setting out to secure a software patch for legacy technology?
SP: Communication with medical device manufacturers is paramount when it comes to patching a legacy device/software that has a vulnerability. Additionally, the HTM teams should plan for end of life scenarios when software updates are no longer supported or available from a manufacturer for a specific device. In scenarios where a software patch is available from the manufacturer, the HTM teams should ensure that the manufacturer has validated the patch before rolling it out to the devices.
Back to HCB News
