The growing digitization of healthcare has led to the progressive connection of electromedical devices to the network, improving the efficiency of clinical processes on the one hand, but exposing hospitals to cyber threats on the other. This thesis addresses the issue of cybersecurity and privacy protection in relation to electromedical devices in hospitals. After outlining the digitization process in healthcare, the focus shifts to the roles of clinical engineering and interconnected electromedical devices. The main threats to the security of sensitive data and hospital IT systems are then described, followed by the relevant European regulations for the protection of cybersecurity and privacy. The next part of the thesis is dedicated to the internship experience carried out at the Padua University Hospital, specifically in the Clinical Engineering unit. The activity involved a detailed analysis of the cases present in a highly complex hospital-university, including a census of the characteristics of each electromedical device for connection to the network. A dataset was also defined for the collection of all the information necessary for a correct assessment of the critical issues in this area. Thanks to the definition of this dataset, which can be used both for technologies already in use and for those to be installed in the future, Clinical Engineering, in collaboration with the IT unit, will be able to evaluate and adopt appropriate risk mitigation tools that take into account the clinical context, the available technology, and the network structure.
La crescente digitalizzazione in ambito sanitario ha portato ad una progressiva connessione alla rete dei dispositivi elettromedicali, migliorando da un lato l'efficienza dei processi clinici, ma esponendo dall’altro le strutture ospedaliere alle minacce informatiche. Questa tesi affronta il tema della cybersecurity e della protezione della privacy in relazione ai dispositivi elettromedicali in ambiente ospedaliero. Dopo aver inquadrato il processo di digitalizzazione in sanità, l’attenzione si concentra sui ruoli dell’Ingegneria Clinica e sui dispositivi elettromedicali interconnessi. Vengono quindi anche descritte le principali minacce alla sicurezza dei dati sensibili e dei sistemi informatici ospedalieri e, di seguito, le normative di riferimento europee, a tutela della sicurezza informatica e della privacy. La parte successiva della tesi è dedicata all’esperienza di tirocinio svolta presso l’Azienda Ospedale-Università di Padova, in particolare nell’unità di Ingegneria Clinica. L’attività ha previsto un’analisi dettagliata delle casistiche presenti in un’azienda ospedaliera-universitaria ad alta complessità, comprendendo un censimento delle caratteristiche di ciascun dispositivo elettromedicale per il collegamento alla rete. È stato altresì definito un dataset per la raccolta di tutte le informazioni necessarie per una corretta valutazione delle criticità in tale ambito. Grazie alla definizione di questo dataset, utilizzabile sia per le tecnologie già in uso, sia per quelle di futura installazione, l'Ingegneria Clinica potrà, in collaborazione con l’unità di Informatica, valutare e adottare idonei strumenti di mitigazione del rischio, che tengano conto del contesto clinico, della tecnologia disponibile e della struttura della rete.
Cybersecurity e dispositivi elettromedicali: censimento e valutazione delle vulnerabilità in ambito ospedaliero
BATISTINI, SIMONE
2024/2025
Abstract
The growing digitization of healthcare has led to the progressive connection of electromedical devices to the network, improving the efficiency of clinical processes on the one hand, but exposing hospitals to cyber threats on the other. This thesis addresses the issue of cybersecurity and privacy protection in relation to electromedical devices in hospitals. After outlining the digitization process in healthcare, the focus shifts to the roles of clinical engineering and interconnected electromedical devices. The main threats to the security of sensitive data and hospital IT systems are then described, followed by the relevant European regulations for the protection of cybersecurity and privacy. The next part of the thesis is dedicated to the internship experience carried out at the Padua University Hospital, specifically in the Clinical Engineering unit. The activity involved a detailed analysis of the cases present in a highly complex hospital-university, including a census of the characteristics of each electromedical device for connection to the network. A dataset was also defined for the collection of all the information necessary for a correct assessment of the critical issues in this area. Thanks to the definition of this dataset, which can be used both for technologies already in use and for those to be installed in the future, Clinical Engineering, in collaboration with the IT unit, will be able to evaluate and adopt appropriate risk mitigation tools that take into account the clinical context, the available technology, and the network structure.| File | Dimensione | Formato | |
|---|---|---|---|
|
Batistini_Simone.pdf
accesso aperto
Dimensione
1.27 MB
Formato
Adobe PDF
|
1.27 MB | Adobe PDF | Visualizza/Apri |
The text of this website © Università degli studi di Padova. Full Text are published under a non-exclusive license. Metadata are under a CC0 License
https://hdl.handle.net/20.500.12608/92532