RSNA – December, 2002 Internet Based Remote Servicing of Medical Equipment under HIPAA – A standard solution Joint NEMA/COCIR/JIRA Security and Privacy Committee John F. Moehrke, GE Medical Systems Chairman of Remote Servicing Focus Group Rob Horn, Agfa Healthcare

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 What you will learn today Remote Servicing is critical Remote Servicing presents new security risks Vendors are working on a common solution that will a.Reduce administration (Hospital and Vendor) b.Improve Accountability c.Provide a more secure environment Privacy is the Goal, Security is the way.

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 Security and Privacy Committee (SPC) Joint effort by NEMA-MII, COCIR-IT, and JIRA Mission: Ensure a level of data security and data privacy in the health care sector that:  Meets legally mandated requirements  Can be implemented in ways that are reasonable and appropriate  Reduces Healthcare costs of compliance Scope: All systems, devices, components, and accessories used in medical imaging informatics Scope is not exclusive of other products and is expected to be extendable to all Equipment that maintains Protected Health Information (PHI). To provide a common understanding and solution for complying with data security and data privacy legislation, currently focusing on the European Community, Japan, and the United States of America

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 Efforts of the SPC Security and Privacy :An Introduction to HIPAA Security and Privacy:An Introduction to HIPAA Security And Privacy Auditing In Health Care Information Technology Security And Privacy Auditing In Health Care Information Technology Security and Privacy Requirements for Remote Servicing Security and Privacy Requirements forRemote Servicing Identification and Allocation of Basic Security Rules In Healthcare Imaging Systems Identification and Allocation of Basic Security Rules In Healthcare Imaging Systems Remote Service Interface-- Solution ( A ): IPSec over the Internet Using Digital Certificates Remote Service Interface-- Solution ( ): IPSec over the Internet Using Digital Certificates All papers available at Current Members: AGFA, GE, Kodak, Konica, Merge Efilm, Otech, Philips, Siemens, Toshiba

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 Why do Remote Servicing? Benefit to Health Care Provider Better Availability and Integrity of the systems Quick response as no Travel involved Higher quality of service  Knowledge base available at the Vendor  Specialists can be applied to the problem/solution Benefit to Vendor Lower costs to service equipment More service offerings (preemptive diagnosis) Remote Service Centers (RSC) centralize knowledge and expertise

RSNA– December, 2002 Hospital Remote Servicing today Vendor Z Vendor Y Complex Wired Infrastructure Vendor X Remote Service Center Modem Connections Hospital Network

RSNA– December, 2002 Hospital Secure Remote Servicing Solution Vendor Z Vendor Y Vendor X Ex. Internet VPN Uses Hospital Network Access points

RSNA– December, 2002 Hospital Access Control Vendor Z Vendor Y Vendor X 2. Device under service 1. Individual Service Personal 3. Access point Edges 1. Individual Service Personal 1. Individual Service Personnel 2. Device under service

RSNA– December, 2002 Audit Repository Hospital Audit Trails Vendor Z Vendor Y Vendor X 2. Device under service 3. Access point Edges 3. Session specifics where and when 2. Device under service 2. when, and what Audit Repository Who, what, when

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 Health Care Provider gains Control and Manageability Control of each session and/or vendor Rules that restrict where vendor X can go, what tools they can use, when they can connect, etc Strong Access Point Authentication Audit trails to provide accountability

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 Solution “A” IPSec tunneling over the Internet  ESP/AH – 3DES and SHA1  IKE – Session Key negotiation  Certificates  1024 bit RSA certificates  Manually managed certificates  Filtering and Routing rules maintained by the Healthcare facility  Audit trails maintained at RSC  Vendor staff is authenticated at the RSC

RSNA– December, 2002 Hospital Solution A: IPSec over the Internet using digital certificates Vendor Z Vendor Y Vendor X IPSec Tunnel, ESP+AH 3DES, SHA1 IKE-RSA, PKI out-of-band

NEMA/COCIR/JIRA Security and Privacy Committee RSNA – December, 2002 Present Status Solution “A” approved by NEMA, COCIR, and JIRA Solution A is ready for use at Internet connected sites. More than a dozen hospitals have installed and began using solution “A” during The Focus Group is analyzing other remote servicing solutions.  IPSec that terminates inside the HCF network handling NAT  PPTP for small facilities  L2TP for small facilities