Infusion therapy devices have been in the newslately—due, in no small part, to concerns surround-ing their hackability. Below, two individuals repre-senting the infusion therapy manufacturing sector—Rob Suárez, vice president, chief information securityofficer at BD, and Matthew Hutchings, ICU Medical’svice president, global marketing and innovation, infu-sion systems—join Alyssa Moy, director, adoptionand integration at home and alternate treatment siteinfusion therapy services provider Option Care, todiscuss what’s new in infusion therapy andhow HTMprofessionals are integral in keeping infusion devicessecure. Don’t miss out.

24x7 Magazine: What are the top trends in theinfusion therapy sector, and how are they influ-encing the design of such technologies?Matthew Hutchings: There are really four key

categories driving the course of innovation in infu-sion therapy at ICU Medical: First, there’s the grow-ing importance of IV-EHR interoperability, or theconnecting of smart pumps to enterprise-grade elec-tronic health record systems and other third-partyapplications to help increase clinician and patientsafety, enhance workflow experiences, and improvedevice management within the health system.

With the increase in connectivity among systemscomes the second driving factor for us, which iscybersecurity and ensuring that our devices and cor-responding safety software are as safe and secure aspossible. Also, with greater access to a wider range ofclinical and business data comes the need to providemeaningful business analytics; more near real-timeinfusion data; and dash-boarding for medicationmanagement and accurate billing to turn this wealthof data into usable, actionable information that candrive clinical and business decision-making. And,finally, all this is taking place in an environmentwhere hospitals are demanding products and sys-tems that deliver clinical and economic value at theoverall lowest total cost of ownership.Rob Suárez: From a cybersecurity perspective,

we are tasked with simplifying and reducing theinteractions with medical technology when it comes

to authenticating users. For example, this may meanadopting multifactor authentication to avoid cum-bersome passwords. Also, there are advantages towireless connectivity for infusionpumps for analyticsand electronic medical record integration, which inturn require stronger security by design.Alyssa Moy: Infusion therapy has its risks, and

being able to monitor and report on a patient’sclinical outcomes has influenced how we developreporting capabilities and produce technology thatinterfaces with external providers to enhance apatient’s results. Patients are not one-dimensional;they deserve a multi-disciplinary approach to care—and, through technology, we have the ability morethan ever tomonitor their therapy adherence, predictoutcomes, and ultimately provide themwith superiorcare.

24x7: How has the infusion therapy sectorevolved in the past few years? How do youexpect it to evolve even more in the future?Moy:Three words come to mind: security, support,

and accessibility. Now more than ever, patients areconcerned about the security of their information—particularly when it comes to the electronic medicalrecord. We’re doing our best to create a ‘securityculture’ and adopt core preventive securitymeasures,which are sought after and appreciated by our cur-rent and prospective patients. Patients also expect acertain level of ongoing support throughout the dura-tion of their therapy.

A chronic illness no longer means limited mobil-ity or reduced quality of life, thanks to the help oftechnology—which allows patients and caregiversto manage their therapy electronically. Additionally,patients are willing to receive infusion therapy at‘alternate infusion sites’ that are more retail-centricand provide amenities throughout the infusion expe-rience. In the future, I expect patients and caregiversto further take charge and actively manage theirtreatment plans via mobile apps, artificial intel-ligence prediction tools, online payment plans, andthe ability to tele-communicate with their nurses andcare management providers on demand.Suárez: At BD, for instance, we have made signifi-

cant efforts [in recent years] to incorporate securitythroughout our quality management system, whichincludes design control, complaint handling and riskmanagement. More companies are adopting vulner-ability disclosure practices and improving transpar-ency on the security issues that exist in medicaltechnology. While we should still see more activityin coordinated vulnerability disclosures, this trend is

INSIDE THEINFUSION THERAPY

DEVICE SECTOR

FOCUS ON | ROUNDTABLE

Rob Suárez

Alyssa Moy

Matthew Hutchings

Reprinted with permission from 24x7 Magazine.Reprinted with permission from 24x7 Magazine.

24X7MAG.COM

promising. In addition, there is more infor-mation that is publicly available to helpmedical technology companies improvesecurity, such as the Medical Device andHealth IT Joint Security Plan.Hutchings: Thankfully, infusion therapy

has evolved from a time where every ele-ment of the IV system was viewed in isola-tion and seen as a standalone device. Theinfusion pump advanced to a “smart pump”that operated within a single hospital, tonow being considered a key componentthat needs to operate within the contextof a broader networked, enterprise-levelhealthcare organization’s ecosystem.

Connectivity and clinically relevantenterprise-wide communication betweenthe infusion pump, the drug library andmedication management systems, and theEHR havemoved to the forefront.As health-care systems in the U.S. continue to con-verge, the demands for increased interoper-ability, consolidated enterprise-wide drugsafety management, and analytics will bedrivers of existing product enhancementsand innovation in the future.

24x7: Infusion therapy devices havemade headlines recently for their sus-ceptibility to hacking. How is yourcompany addressing cyber-concerns?Hutchings: Given the fact that approxi-

mately 90% of patients admitted to U.S.hospitals receive IV therapy and that healthsystems may have thousands of IV pumpsin their inventories, this is a critical riskcase to address. ICU Medical has takenthis very seriously. We are proud of the factthat we are the first medical device manu-facturer to obtain certification under theUL Cybersecurity Assurance Program (ULCAP), a new cybersecurity managementprogram from UL designed to minimizerisks by creating standardized, testable cri-teria for assessing software vulnerabilitiesand weaknesses to helpreduce exploitation,address known malware, enhance securitycontrols, and expand security awareness.

We earned UL CAP certification forour Plum 360 drug infusion system thatprovides full interoperability with patientEHRs, reducing the need for manual inputand transcription of infusion data to man-

age patient safety and clinician workflows better. We now have CAP certification for ICUMedical MedNet safety software, as well. While the UL 2900 standard was written withFDA pre- and post-market cybersecurity and American National Standards Institute tech-nical panels guidelines in mind, we fully recognize that cybersecurity needs will continueto evolve—and our certifications and other cybersecurity measures are ongoing to helpensure security today and in the future.Moy: Option Care uses a risk-based, layered approach to security. We focus on four pil-

lars—governance, people, processes, and technology—to secure our environment withineach of these layers, from outward- to inward-facing connections. This security includesthird-party and otherdevices that connectwith our network. People are ourgreatest assetsand potentially our greatest risk. As a result, we developed an education and training cam-paign that takes place year-round and leverages “ambassadors,” who are non-IT employeeslocated around the country, to also spread the information security message throughoutour locations and enterprise.Suárez:We view cybersecurity as an ongoing process and all of our teams work in part-

nership with our customers, cybersecurity researchers, and regulators to ensure that wedesign secure products, identify present risks, and communicate with our customers in atimely manner about new risks as they are identified and how to mitigate them. While itmay seem counterintuitive, as the defenders of technology and healthcare, our communityneeds to adopt a similar culture of information-sharing and make it open, free and trans-parent. In a coordinated and responsible way, companies can better match the pace atwhich new cybersecurity threats are emerging.

24x7: What do you want to tell HTM professionals about the handling and main-tenance of infusion therapy devices and why?Suárez: Securing medical technology requires partnership and collaboration. Our goal is

to communicate security risks accurately and comprehensively, with readily available mea-sures that customers can take to reduce or eliminate that specific risk. We want customersto understand why specificmeasures are selected andhow they can helpensure products aresecure by design, in use and through partnership, because you can’t secure what you don’tknow. It is important to remember that all technology ages over time and vulnerabilitiesmanifest; as we see more vulnerability disclosure, it is also a sign of greater transparency.

Hutchings: A significant historical con-cern around infusion therapy devices hasbeen maintaining the device drug librarysafety software—the safety parametersmanaged by software updates on the infu-sion pump that limit over- and under-deliv-ery of medication. These devices are nowdistributed across an enterprise versus asingle hospital. Because of this, the his-torical challenges of locating devices to dopreventative maintenance—in addition toapplying upgrades, updates, and firmwarepatches to the devices themselves, along

with applying medication safety updates for drug delivery limits—have been exacerbated.That’s why we are providing customers with a real-time location system that includes abidirectional connection to enable real-time visibility into their IV pumps’ location andstatus, helping them save time while enhancing overall fleet operation.

24x7: What else do you want 24x7 Magazine readers to know about the infusiontherapy device sector?Hutchings:Medical devices, andparticularly infusion therapy pumps, have moved from

a nursing, biomedical, and purchasing conversation to the forefrontof healthcare IT.Thesedevices have been rapidly increasing in complexity and sophistication—not only in theiradvanced level of required cybersecurity, but also in how they address the safe delivery ofmedications.Moy: Market forecasts project CAGR growth of 5.6% within the next decade, with infu-

sion pumps being the largest contributor to the global infusion devices market. Moreover,infusion pumps have recently become more interconnected through wireless networksand incorporate dose-error-reduction systems to increase patient safety. These devicesopen the door to interoperability with innumerable systems to further improve infusionsafety, increase healthcare provider efficiency through automation of pump programmingand documentation, and improve clinical decision-making by monitoring when infusionshave discontinued and when changes are made to infusion rates. With this technologicalpotential at our fingertips, healthcare providers should think about proactively budgetingfor the future of ‘intelligent’ pumps versus ‘smart’ pumps to realize the benefits for boththe provider and the patient. l

24X7MAG.COM