Security Measures for Medical Institutions in the AI and Cloud-Native Era

The Healthcare AI Platform Collaborative Innovation Partnership (abbreviated as HAIP) proposes cybersecurity measures for medical institutions in the AI and cloud-native era.

In recent years, with the severe shortage of medical personnel in healthcare institutions, there have been calls to promote reforms in the working styles of medical professionals through the utilization of AI and data. Furthermore, cyberattacks on medical institutions are incessant. Particularly, many recent cyberattacks are carried out using AI, and cases of attacking the AI itself are emerging, increasing the difficulty of countermeasures.

On the other hand, looking at the current situation in medical institutions, system management is carried out by one person per 100 beds or fewer. With this limited staff, it is extremely difficult to grasp all IT systems within the institution, connect to maintenance networks for medical devices such as CT and MRI, connect to maintenance networks for departmental systems like PACS and clinical examination systems, and monitor and implement cybersecurity measures for devices and systems with various network nodes, including IoMT (Internet of Medical Things) connected to networks such as patient monitoring systems and infusion pumps. Moreover, due to rising costs for personnel, materials, and utilities, many medical institutions face severe financial challenges, leading to a situation where security measures are not prioritized and investment is not progressing. Even when the government says, "Implement various security measures," there is a difficult reality where they don't know where to start and cannot translate it into concrete actions.

Driven by the desire to alleviate this situation even slightly, the research project "Typification and Demonstration of Network Security Configurations for Promoting the Use of Medical AI on the Cloud and Policy Recommendations (23AC1001)" was adopted for the fiscal year 2023 by the Grants-in-Aid for Scientific Research from the Ministry of Health, Labour and Welfare. Led by Koji Okamura, the research representative from the National Center for Child Health and Development, research has been conducted by Susumu Fujii and Naoki Nakamura from Tohoku University, Katsuhiko Ozaki and Hideki Fukuda from Tokushukai Information System Co., Ltd., Toshitada Matsui from the National Center for Child Health and Development, Masuaki Kaneko and Atsushi Ugajin from the Healthcare AI Platform Collaborative Innovation Partnership. We hope that by summarizing the results of this research in the form of recommendations and releasing an overview, we can be of some help to medical institutions. We welcome your candid opinions.

[Overview of Recommendations]

This proposal focuses on how to improve the security level of medical institutions with minimal IT investment and how to design incentives for IT investment in medical institutions (Figure 1). It is extremely important to continuously cycle through a series of processes for cybersecurity measures: 1 Assessment (Know Thyself), 2 Countermeasures (Implement security measures appropriate to one's means), 3-1 Audit (Objectively check if countermeasures are established), 3-2 Training (Can actions be taken in an emergency?), 4-1 Human Resource Development (Solidify the foundation and raise the overall level), and 4-2 Awareness Reform (Promote awareness of security, especially among management). Furthermore, to continuously carry out the above 1 to 4, 5 Institutional Support (Incentive Design) is necessary. It is important to elevate this to a certification system for medical institutions, actively disclose exemplary leading cases, and foster a culture of sharing across all medical institutions.

It is crucial to always consider how to minimize damage and continue providing medical care in the event of a cyberattack, and to conduct IT-BCP (Business Continuity Plan) training on a regular basis. The goal of security measures is not complete defense (ZERO risk) represented by perimeter security or zero trust security, but the realization of cyber-resilient security based on the perspective that complete defense is difficult (Figure 2). With AI-driven cyberattacks becoming commonplace, it is about implementing risk-based security measures based on the premise that complete defense is impossible (WITH risk). This will enable the realization of people-centric healthcare (shifting from hospital-centric to citizen/patient-centric healthcare, and towards healthcare that is supportive of medical and caregiving professionals).

Recommendation Document: Recommendations on the Importance of Cybersecurity Measures in Medical Institutions (PDF Link)

[Tools for Implementing Recommendations]

HAIP offers a "Web Security Assessment Service" that allows medical institutions to easily grasp their own cybersecurity status. This service visualizes the security measures of medical institutions by answering questions reflecting the "Guidelines for Ensuring the Safety of Medical Information Systems," the "Cybersecurity Checklist for Medical Institutions, etc.," and the concepts of ISMS, and provides advice for improvement. We recommend that medical institutions considering addressing the challenges outlined in this proposal utilize this service as a means of understanding their current situation first.

[Web Security Assessment Service]

https://secsrv.haip-cip.org/top

The "Web Security Assessment Service" will be introduced at the "International Modern Hospital Show 2026" (Dates: July 8 (Wed) - 10 (Fri), 2026, Venue: HAIP/AIHOBS Booth at Tokyo Big Sight). Please stop by.

[Overview of Healthcare AI Platform Collaborative Innovation Partnership]

Name

Healthcare AI Platform Collaborative Innovation Partnership (Abbreviated as HAIP)

(English Name: Healthcare AI Platform Collaborative Innovation Partnership)

Establishment Date

April 1, 2021

Location

1-1-1 Toyosu, Koto-ku, Tokyo

Board of Directors

Chairman: Atsushi Ugajin (Representative Partner & CEO, HumaNex.AI LLC)

Director: Akihiro Umezawa (Special Advisor to the Chairman, National Center for Child Health and Development)

Director: Katsuhiko Ozaki (Chairman of the Board, Tokushukai Information System Co., Ltd.)

Director: Hiroyasu Nakatsuka (General Manager, Second Corporate Business Promotion Department, Corporate Business Strategy Division, SoftBank Corp.)

Director: Norihiro Shimizu (Corporate Officer, Head of Healthcare Sector, Public Sector Business Unit, Microsoft Japan Co., Ltd.)

Director: Hiroaki Miyake (Department Manager, Business Development Division, Business Promotion Department III, BIPROGY Co., Ltd.)

Auditor: Tetsushi Kawamoto

Members

BIPROGY Co., Ltd.

Hitachi High-Tech Corporation

SoftBank Corp.

Tokushukai Information System Co., Ltd.

Microsoft Japan Co., Ltd.

National Center for Child Health and Development

InterSystems Japan Co., Ltd.

Hokkaido University

National Institute of Infectious Diseases

Juntendo University

Life Quest Inc.

J's Technology Co., Ltd.

Southwood Co., Ltd.

Quest Global Japan Inc.

ZenmuTech Inc.

AIHOBS Inc.

General Incorporated Association for Medical Traceability Promotion

HumaNex.AI LLC

Collabo Square Co., Ltd.

Cross Compass Ltd.

Innomedix Co., Ltd.

[Homepage]

https://haip-cip.org

[Contact for Inquiries]

Healthcare AI Platform Collaborative Innovation Partnership

E-mail: [email protected]