Making security the easy choice: Protecting mobile devices in clinical environments

This Cybersecurity Awareness Month, Dan Johnston discusses how mobile devices can improve clinical care and why getting security right is essential to protecting data, systems, and patients.

Mobile devices have become an important part of modern clinical care, giving clinicians greater flexibility to work at the point of care. But as their use expands, healthcare organisations also need to ensure these devices are secure, available and easy for clinicians to access without adding friction to already demanding workflows.

Making a difference in healthcare

The portability and ease of use of mobile devices have already brought many benefits to healthcare delivery. Their portability and convenience can support more efficient care, making them highly valued by clinicians. However, they also pose challenges, both in terms of security and the practical issues around managing battery life.

They can enable a clinician to attend to a patient at the point of care in a busy emergency department, whether to provide quick pain relief medication through a closed-loop medication administration process, enter vital signs as part of hourly checks and rounds, or complete fluid balance charts. These are all routine tasks that form part of everyday nursing care and may ordinarily require trolleys, workstations on wheels or even pen and paper in an environment that is often difficult to access and manoeuvre through a crowded area.

However, mobile devices also introduce security challenges because they change hands frequently and, in some organisations, multiple users may share a generic device PIN or application account. Because they are smaller than traditional PCs and laptops, entering long passwords can be fiddly, which can result in users adopting insecure workarounds for faster access.

Managing devices ensures availability

It is essential that mobile devices are secured to protect systems and applications from cyber threats, while also tracking who is accessing data within the clinical environment for both information governance and patient safety.

Another challenge with mobile devices is managing battery life to ensure optimum use. We all know how frustrating it can be to pick up your own device at home, only to find that the battery has not been charged. In the same way, healthcare environments need plenty of charging stations, as well as the discipline and processes required to ensure that devices are replaced after use.

I am sure I am not alone in finding a device during a shift and skipping down the corridor in glee with it in my back pocket, only to find that the battery is down to 10%. Do I hold on to it and use it while it lasts, or place it back on the charging station, only for someone else to grab it?

Some healthcare organisations have already solved this issue, with mobile devices being successfully managed and used. Clinicians need only ‘tap and go’ to log in before their shift. Built-in timeouts ensure that sessions are logged out and devices are digitally sanitised. In addition, charging stations are available to ensure continuous use, with batteries available to support ‘hot swaps’ and maintain the user’s session data without requiring them to log in again.

Secure workflows improve efficiency

One of the most important things about security is that it should protect users and systems without creating unnecessary barriers to work. This is particularly critical in healthcare environments, where clinicians are often working under pressure in busy departments. Having to remember logins and secure passwords puts additional pressure on care delivery.

For this reason, secure workflows using mobile devices need to be designed with the user in mind. In fact, guidance from the National Cyber Security Centre (NCSC) Secure by Design principles states that regular research and findings need to be considered during the design process to ensure that devices are easy to use and understand.

Principle 4 states that the outcomes should be: “A secure service with security controls that minimise friction for users” and, additionally, “Insecure practices are avoided by removing incentives for users to find workarounds.”

Identity is central to security

Security is a multilayered strategy of defences and mitigations, of which identity is a crucial part. In the healthcare environment, a user’s identity has real clinical value in three different areas: cybersecurity and efficiency, access and capability, and clinical governance and accountability.

Strong user identities are an effective way of protecting applications from cyber threats. In addition, providing clinicians with an easy and fast way to prove their identity and access healthcare applications helps to improve efficiency.

The workflow is essential to this. Key questions to consider during the design phase are:

• What is the user trying to accomplish when interacting with the device, and what needs to be protected at that point in the workflow?
• What level and type of security is appropriate for that activity, and how can it protect access without creating unnecessary friction or disrupting care?

Identity supports access and inclusion

IT departments can work with clinicians initially to identify which applications they are most likely to access. They can configure identity and access around a user’s role and department, helping clinicians move efficiently between the applications they need. This also meets the requirements of clinical governance. Logins and timings can be recorded for audit purposes, helping to ensure that the right people have access to the appropriate levels of authority.

Another advantage of providing easy, fast and secure identity logins is that they increase digital inclusion. As healthcare organisations undertake their digital transformations, it is important that all users, whether clinicians or administrators, can access the systems they need to carry out their jobs without technology becoming a barrier.

Future developments benefit patients

Investment in mobile devices over recent years has been huge, overtaking investment in PCs and laptops, whether for personal use or in the workplace. Mobile applications are also being used to support more workflows across sectors, including healthcare.

When security and accessibility come together, mobile devices can support a variety of innovative use cases that improve the experience of patients and staff at the point of care. One particular example that I have seen repeated around the globe, including in the UK, Norway and Australia, is the concept of the ‘silent hospital’.

The idea is that silent wards aim to reduce unnecessary noise while maintaining patient safety. They use technology to replace non-essential audible alarms and call bells with digital workflows that notify the right staff member directly.

Research has shown that in neonatal departments, for example, the number of healthcare devices used for monitoring, and the noise they make, can increase patient stress and anxiety.

There is a range of technology that needs to work together to achieve a quiet ward, including:

• Mobile nurse call systems, where patient calls are routed to staff smartphones or mobile devices
• Clinical alarm management, where alerts from monitors, pumps and other devices are prioritised and sent to the relevant clinicians
• IoT noise monitoring, where sensors continuously measure noise levels to help identify problem areas
• Location services such as Bluetooth, Wi-Fi and RFID technologies that help direct alerts to the nearest appropriate staff member
• Smart room controls, where occupancy sensors and automated lighting reduce disruption
• Integrated communications that combine messaging, task allocation and nurse call functions into a single digital workflow delivered to a user’s mobile device

In this way, mobile workflows can help create quieter environments that benefit patients. But success depends on robust identity, access and device management processes.

It is truly exciting to see the level of innovation being driven by mobile devices across different countries and environments, to the benefit of both patients and staff. These examples also show that mobile device security and management are key to designing a successful digital transformation.