Digital Interaction In Telemedicine

Answer 1

Before we examine cybersecurity in the context of telemedicine, let us understand the extent of digital interaction in telemedicine with an overview of the steps involved in a teleconsultation:

The patient contacts the hospital seeking a consultation with a doctor. The hospital’s front office staff log the patient’s particulars in the hospital management system Additional information about the patient, including patient’s medical history and scans of test results, is requested. The patient emails the requested details or uploads the required information into the hospital’s repository of medical records which is linked to the patient information module in the hospital management system A teleconsultation is scheduled through videoconferencing. Payment is collected through a payment gateway During the consultation, the doctor records detailed case notes about the patient in the patient information module. Specific medical information may be shared by the patient through a chat application to avoid ambiguity The doctor advises the patient on next steps and sends a detailed report to the patient through email to maintain a written record of the interaction and prescribed treatment This is a highly simplified example of the telemedicine process, but even within this overview we can see multiple opportunities for cyberthreat activity:

Keyloggers in front office systems can capture credentials that provide access to the hospital management system. More sophisticated malware can capture screenshots and even record videos to help the attacker understand exactly how to enter the hospital’s information systems All medical records that the patient provides to the hospital can be intercepted through malware. Ransomware in the repository of records can cripple the hospital by preventing access to patients’ medical and other records Cyberattackers can redirect the patient to a fake payment gateway to steal the patient’s banking credentials, or hijack the patient’s payment Cyberattacks can intercept the videoconference and chat messages to steal information. Keyloggers in the doctor’s device can capture the doctor’s credentials, allowing the attacker to access the hospital’s information system with the doctor’s access privileges Written records sent by the doctor/hospital to the patient can be intercepted and accessed by the attacker if the records are not protected In addition, the hospital should also consider the security of communications between facilities when records, such as test results, are transmitted from one healthcare facility to another. Chat applications may also store chat records in data centres located in other countries and with poor internal access controls, raising concerns over compliance with data sovereignty and privacy legislation.