Risk Assessment Framework of mHealth System Vulnerabilities: A Multilayer Analysis of the Patient Hub

Abstract

Although there have been remarkable technological developments in healthcare, the privacy and security of mobile health systems (mHealth) still raise many concerns with considerable consequences for patients using these technologies. For instance, potential security and privacy threats in wireless devices, such as Wi-Fi and Bluetooth connected to a patient hub at the application, middleware and sensory layers, may result in the disclosure of private and sensitive data. This paper explores the security and privacy of the patient hub, including patient applications and their connections to sensors and cloud technology. Addressing the privacy and security concerns of the patient hub called for a comprehensive risk assessment by using the OCTAVE risk assessment framework. Findings reveal that the highest risk concerned d at a exposure at the sensory layer. In spite of the countermeasures presented in this paper, most served as a means to identify risk early as opposed to mitigating them. The findings can serve to inform users of the potential vulnerabilities in the patient hub before they arise.

IoT Integration in Telemedicine: Investigating the Role of Internet of Things Devices in Facilitating Remote Patient Monitoring and Data Transmission

“…The widespread adoption of IoT-enabled telemedicine presents several challenges that require attention. In particular, data security and privacy are of utmost concern, given the continuous collection of sensitive patient health information by IoT devices (Ali et al, 2020). The risk of data breaches and unauthorized access is a signi cant concern, emphasizing the need for robust encryption, authentication, and access controls to protect patient data (Tiersma et al, 2022).…”

Vulnerability and Threat Assessment Framework for Internet of Things Systems

“…In addition, the US-CERT released the ICS-CERT 8 vulnerability advisories by product vendors related to the IoT industrial control systems and medical devices, respectively classified by the ICSA and ICSMA identifiers. Other vulnerability databases exist in the literature, such as Japan's vulnerability notes ipedia vulnerability database (JVNDB 9 ), China's national vulnerability database of information security (CNNVD 10 ), and the Chinese industrial internet security emergency response center (CN-ICS-CERT 11 ). However, the majority of entries of these databases are based on information from the NVD, and use scoring systems based on CVSS.…”