Cybersecurity Standards for IP & Wireless Nurse Call

Cybersecurity in Nurse Call Systems: Securing the "Backdoor" of Healthcare Networks

Due to the push for improved infrastructure through advanced IP-based technology and the use of wireless communication instead of basic analog systems in place at many healthcare facilities, the overall attack surface area of any given healthcare facility has expanded. Nurse Call Systems are no longer just devices for signaling. They are, in essence, network devices that frequently interface with EHRs, mobile devices, and centralized data servers.

These systems could potentially be targets for unauthorized access using various types of attacks, such as ransomware, or for information breaches, unless protected with appropriate levels of security.

Vulnerabilities of IP-based Systems

Today's Nurse Call Systems use Internet Protocol (IP) technology to send alert notifications over the network. The speed of transmission and degree of integration possible through IP make them an exceptional technological advancement; however, they do mean that the systems are accessible over the facility's network. The typical vulnerabilities of these types of systems include:

Default Passwords: Most will ship with a factory default password that could be easily guessed.
Unencrypted Wireless Networks: Alerts from nurse call systems are sent using unencrypted wireless networks that can be intercepted, allowing someone with access to find out where a patient is located and obtain information about the patient’s room.
Legacy Hardware: Older digital Nurse Call Systems may have been developed using an outdated operating system that no longer receives updates or patches.

Securing Wireless Communications

The first point of permeation is an encrypted case where a facility has used wireless nurse call elements. There should be an encrypted system with high-level encryption (e.g., AES-128 or more), ensuring that no signal can be read.

Furthermore, it is possible to apply Frequency Hopping Technology to prevent signal jamming or interference by switching channels frequently. This ensures that life safety messages, which are time sensitive, will not be lost en route, even when other wireless messages are present in the vicinity.

Best Practices on the Current Compliance

To prevent loss of your facility and to remain compliant with HIPAA standards, your nurse call system must operate in accordance with these three rules:

Networking Plan: Separate your nurse call system (Virtual Local Area Network) into one VLAN on your Wi-Go Wi-Fi and general administration.
Frequent Firmware Audits: Have your vendor update your security regularly.
End-to-End Encryption: Data should be encrypted at each hop between the resident pendant and the nurse’s smartphone.