1. Device Management Infrastructure White Paper Brief Profile Proposal for IHE Year 2012-2013 Geoff Pascoe Philips Healthcare 15 November 2011

2. IT Infrastructure Planning Committee The Problem Separation between traditional IT infrastructure and devices is disappearingSeparation between traditional IT infrastructure and devices is disappearing –Devices are now computers –Networked and need to interoperate –May have access to longitudinal records –May manage PHI However, there remain and will continue to remain differences:However, there remain and will continue to remain differences: –An order of magnitude more deployed devices than classical IT systems –Often embedded systems –Often real-time –Sometimes connectivity is intermittent –May be mobile –More highly regulated Patches and configuration managed by manufacturersPatches and configuration managed by manufacturers Can’t install arbitrary cyber security softwareCan’t install arbitrary cyber security software –May cause direct injury to patients –Little physical security –Often Managed by Biomeds not IT The VA, alone has more than 50,000 medical devices insulated behind firewall protected VLANs. http://csrc.nist.gov/groups/SMA/ispab/docume nts/minutes/2011-03/1_ISPAB-VA- Presentation-medical-devices.pdf http://csrc.nist.gov/groups/SMA/ispab/docume nts/minutes/2011-03/1_ISPAB-VA- Presentation-medical-devices.pdf

3. IT Infrastructure Planning Committee How Might We Address the Unique Problems of Devices?

4. IT Infrastructure Planning Committee White Paper Overview (1) Develop a White Paper that deals with problem areas in the management of medical devices. Topics include:Develop a White Paper that deals with problem areas in the management of medical devices. Topics include: –Asset Management –Asset Tracking –Discovery –Automatic Configuration –Monitoring and Logging –Patch Management –Lifecycle Management –Risk Management Guidance –Event Communication—non-alarm system-to-system –Cybersecurity Status –Key Management –User-to–Device, Device-To-Network Authentication

5. IT Infrastructure Planning Committee White Paper Overview (2) Each area would further be prioritized and road mapped for future development.Each area would further be prioritized and road mapped for future development. The value(s), in terms of what is to be gained will be discussed more specifically within use case descriptions, as the value of each topic area is specific to each.The value(s), in terms of what is to be gained will be discussed more specifically within use case descriptions, as the value of each topic area is specific to each. The quantifiable costs and/or data to demonstrate the scale of the problem will be outlined within the white paper.The quantifiable costs and/or data to demonstrate the scale of the problem will be outlined within the white paper. It is expected that the completed white paper would address each topic in sufficient detail to easily, at a minimum, create detailed profile proposals, including detailed use cases and well researched candidate standards.It is expected that the completed white paper would address each topic in sufficient detail to easily, at a minimum, create detailed profile proposals, including detailed use cases and well researched candidate standards.

6. IT Infrastructure Planning Committee Mapping of Medical Device Issues to Topic Areas Asset Management Asset Tracking Discovery Automatic Configuration Monitoring and Logging Patch Management Lifecycle Management Risk Management Guidance Event Communication Cybersecurity Status Key Management Authentication Number of Devices XXXXXXX XXX Embedded X X X Real-Time X XX Intermittent Connectivity XXXX XX X Mobile X X X X Highly Regulated XXX X X Direct Injury XXX XXX Physical Security XXXXX XXXXXX Biomed Managed XX X

7. IT Infrastructure Planning Committee Why Should ITI Take on This White Paper? PCD needs to address these issues—If we don’t help them they’ll do it themselves. – –Much better to influence these areas while in development However, WE are responsible for infrastructure. – –These needs are not unique to PCD (e.g., RAD) – –WE are uniquely tasked with supporting other domains PCD is committing resources to accomplish it. Inherently low risk – –It’s a white paper – –Not driven by Connectathon schedule – –Topic areas are relatively modular so scope can be scaled, if necessary Excellent opportunity to trial a new way to work more effectively with other domains Most importantly, this is an opportunity to transition to a more proactive approach. Completion of white paper can be an important contributor to our long-term, multi-year strategic plan.

8. IT Infrastructure Planning Committee THANK YOU