“The current focus in medical device development and production is on manufacturers’ preferences and patients’ needs. Industry and government should also focus on implementing an overarching set of security standards or best practices for networked devices to address underlying risks,” the paper says. ”Should any high-profile failures take place, societies could easily turn their backs on networked medical devices, delaying their deployment for years or decades.”

The authors argue that the current emphasis on regulating medical practices and devices to try to increase security is a wrong-headed approach.

“The report recommends continued improvements to private-private and public-private collaboration. More coordination, not more regulation, is warranted. Regulators do not always keep pace with technological progress. They should have feedback from a full set of stakeholders through transparent collaborative forums that assure the regulator’s independent functioning without creating concerns of collusion with industry. Likewise, industry officials should continue to improve communication among themselves.”

In addition, the authors say, the general public — whose data is most at risk — needs to have a way to have a strong voice in striking the balance between data sharing and data risk.

The industry must build security into devices from the outset, rather than as an afterthought. As McAfee’s then-CTO Stuart McClure testified before the US House Committee on Homeland Security in 2012, “Cybersecurity has to be baked into the equipment, systems and networks at the very start of the design process.”

The full white paper goes into great detail on the threats to networked health care data and offers in-depth recommendations for enhancing data security. It is available here.