Securing Telehealth Remote Patient Monitoring Ecosystem

Download the Draft Practice Guide

The NCCoE has released the second draft version of NIST Cybersecurity Practice Guide SP 1800-30, Securing Telehealth Remote Patient Monitoring Ecosystem. Use the button below to view this publication in its entirety or scroll down for links to a specific section.

Download the PDF »

Current Status

The NCCoE released the second draft of the NIST Cybersecurity Practice Guide, SP 1800-30, Securing Telehealth Remote Patient Monitoring Ecosystem, on May 6th, 2021. The project team is currently reviewing feedback provided during the public comment period. 

For ease of use, the draft guide is available to read or download in volumes:

  • SP 1800-30A: Executive Summary (PDF
  • SP 1800-30B: Approach, Architecture, and Security Characteristics (PDF)
  • SP 1800-30C: How-To Guides (PDF)

Or download the complete guide (PDF).

Additionally, you can read the two-page fact sheet for a brief overview of this project.

To stay up to date on this project or join the community of interest please email the project team at hit_nccoe@nist.gov .

Summary

Traditionally, patient monitoring systems have been deployed in healthcare facilities, in controlled environments. Remote patient monitoring (RPM), however, is different in that monitoring equipment is deployed in the patient’s home. These new capabilities, which can involve third-party platform providers utilizing videoconferencing capabilities, and leveraging cloud and internet technologies coupled with RPM devices, are used to treat numerous conditions, such as patients battling chronic illness or requiring post-operative monitoring. As the use of these capabilities continues to grow, it is important to ensure the infrastructure supporting them can maintain the confidentiality, integrity, and availability of patient data, as well as ensure the safety of patients.

The goal of this project is to provide a practical solution for securing the telehealth RPM ecosystem. The project team will perform a risk assessment on a representative RPM ecosystem in the laboratory environment, apply the NIST Cybersecurity Framework and guidance based on medical device standards, and collaborate with industry and public partners. The project team will also create a reference design and a detailed description of the practical steps needed to implement a secure solution based on standards and best practices.

This project will result in a publicly available National Institute of Standards and Technology (NIST) Cybersecurity Practice Guide, a detailed implementation guide of the practical steps needed to implement a cybersecurity reference design that addresses this challenge.

Collaborating Vendors

Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as “Technology Partners/Collaborators” herein) signed a Cooperative Research and Development Agreement to collaborate with NIST in a consortium to build this example solution.

Cisco