ECRI Institute’s 2019 top 10 list of health technology hazards is in, and cybersecurity threats made it to number one for the second year in a row.

“Cybersecurity is starting to be recognized as a patient safety issue, not just an IT or business concern,” David Jamison, executive director of the Health Devices group at ECRI, told HCB News. “Attacks can disrupt a hospital’s ability to deliver care, which can have a profound effect on patients.”

The Department of Health and Human Services’ Office for Civil Rights reported 77 healthcare data breaches in the first three months of this year. That affected more than one million patients and health plan members, which is nearly twice the amount of individuals affected in Q4 of 2017.

ECRI published 50 alerts and problems related to cybersecurity in the last 18 months. That was a major increase compared to the prior period.

This year, ECRI is focused on one specific area of vulnerability — hackers exploiting remote access to get unauthorized access to a healthcare organization’s networked devices and systems. Jamison suggested that shoring up remote access defenses can go a long way toward preventing a cyberattack from being successful.

The report instructs healthcare organizations to safeguard assets by identifying, protecting and monitoring all remote access points. It also suggests following recommended practices, including instituting a strong password policy, maintaining and patching systems, and logging system access.

Number two on the list is blood and other bodily fluids that remain on or within mattresses or mattress covers after cleaning. This hazard was also on last year’s list.

Not every mattress cover seller recommends products and procedures that effectively remove those contaminants without creating weak spots that could lead to leaks. ECRI stresses that this problem needs to be remedied.

Retained sponges also continue to be an issue despite the standard practice of counting them before completing the procedure. ECRI recommends technologies that supplement the manual counting process.

Other hazards on the list include improperly set ventilator alarms, mishandling flexible endoscopes after disinfection, confusing dose rate with flow rate, incorrectly customizing physiologic monitor alarm settings, injuries from overhead patient lift systems, cleaning fluids seeping into electrical components and flawed battery charging systems.

ECRI creates this list based on the work its staff does every day, such as testing medical devices and systems, investigating incidents, talking with hospitals and manufacturers and researching patient safety concerns.

“We recognize that hospitals have limited resources,” said Jamison. “So when we select topics and develop recommendations, we do so with an eye toward helping hospitals direct their time and energy toward activities that can have the greatest impact on patient safety.”

He added that when they look at the "world of health technology management issues," they ask themselves which ones are impacting hospitals the most and what actions will yield the biggest improvement in patient safety.

Health IT Homepage