Heightened Cyber Vulnerability to Patients with Cardiac Implantable Electronic Devices

Abstract

Cardiac implantable electronic devices (CIEDs) have shown to improve autonomy, quality of life, morbidity and mortality (relative reduction of mortality by 30% at 3 years follow-up) [1]. However, CIEDs possess a cyber vulnerability. With these exemplary safety concerns, we theorise: 1) Cybersecurity risks are difficult for medical institutions to plan (ambiguous nature of threat), which results in ineffective cyber defense measures, 2) Cyber threats can impair trust in the device, treatment plan and patient-provider relationship; and 3) As CIEDs “go” with the patient and the cyber risk can not be quantified, patients’ stress levels are higher from the perceived cyber threats than from a technical malfunction.

From a literature review and subsequent position paper submission, the rationale for the research project was formulated. The methodology consists of two qualitative studies assessing both providers’ and patients’ perspectives of cybersecurity risks with CIEDs and a risk assessment of CIED manufacturer manuals. For designing the two qualitative studies, we postulated: 1) providers lack understanding about cybersecurity risks with CIEDs and thus do not include these risks in the informed consent due to either “not wanting to raise patients’ anxiety levels except for known serious adverse events”, or not wanting to “extend time with consenting patients for low-probability issues” [13] and 2) patients are not aware of the cyber risks with CIEDs. From the results of these studies, we plan to develop white papers to promote standards and guidelines for cybersecurity related risks with CIEDs to the inform consent-processes as well as manufacturers’ manuals.