9.5 Electronic Data Management, Data Integrity, System Hardening, & WMTS

Electronic Data Management, Data Integrity, System Hardening, & WMTS

Computerized medical equipment holds more than patient data: drug libraries, alarm profiles, imaging protocols, calibration files, and licenses. If any of these are lost or corrupted, the device may still power on but deliver the wrong therapy or image the wrong way. ACI's outline asks the CHTM to "ensure electronic data management of computerized healthcare technology assets occurs (e.g., backups, security, patching, updates)" (Operations item M). It also asks the manager to assure the "integrity of data collection, data storage, and data security" for PACS, EMR, and networked devices (Risk item E), and to support risk mitigation for networked devices, including physical security, patching, hardening, WMTS, and network segmentation (Risk item F). Section 9.2 covers threat intelligence, MDS2, SBOM, and segmentation; this section covers the day-to-day data and hardening work.

---

1. Know What Data You Are Responsible For

Each item needs a named owner — the vendor, IT, or HTM — written into contracts and the department's RACI chart.

---

2. Backups and Recovery

The HIPAA contingency plan standard (45 CFR 164.308(a)(7)) requires covered entities to have:

• a data backup plan (retrievable exact copies of ePHI);
• a disaster recovery plan to restore lost data;
• an emergency-mode operation plan to protect ePHI while operating in an emergency;
• plus addressable specifications for testing and revising the plans and for an applications and data criticality analysis.

Practical backup rules for HTM-managed systems:

1. Inventory every system that holds configurations or data, and record its backup method in the CMMS asset record.
2. Follow a 3-2-1 approach: three copies, on two kinds of media, with one copy offsite or offline. Offline or immutable copies protect against ransomware that encrypts network-reachable backups.
3. Back up configurations after every change — for example, export the drug library and imaging protocols after each approved update.
4. Test restores on a schedule. A backup that has never been restored is an assumption, not a control.
5. For vendor-managed servers, the service contract should state who backs up what, how often, and how quickly the vendor must restore it.

---

3. Patching and Updates

• Apply manufacturer-validated operating system patches, antivirus definitions, and firmware updates. Unvalidated changes can alter device behavior and void support.
• Test on a bench or non-clinical unit first, schedule a maintenance window, verify function afterward, and record the new software version in the CMMS.
• Track end-of-support dates for operating systems and applications as part of capital planning (section 7.1).
• When no patch exists, apply compensating controls such as segmentation, disabled services, and restricted remote access (section 9.2).

---

4. Data Integrity

Data integrity means data are complete, accurate, consistent, and unaltered from creation through storage and use. The ALCOA principles from FDA data-integrity guidance — Attributable, Legible, Contemporaneous, Original, Accurate — are a useful checklist for HTM records and device data.

Controls HTM should verify:

• Correct patient association for monitors, pumps, and imaging studies (modality worklists, barcode association).
• Time synchronization of devices and servers to the hospital's network time source.
• Audit logs that record who changed a configuration or record, and when.
• Transfer checks: interface monitoring and error queues so HL7 or DICOM messages that fail are noticed and resent.
• PACS quality control: procedures to find and correct misfiled or split studies.
• CMMS integrity: records are archived, never deleted; edits are traceable; mandatory fields are enforced (section 2.1).

---

5. Hardening and Physical Security

Hardening reduces a device's attack surface. Use the manufacturer's hardening guide and MDS2 answers, and change only what the manufacturer supports:

• Change default passwords and remove shared generic accounts where the device allows.
• Disable unused services and ports (for example Telnet, FTP, SMBv1) and remove unneeded software.
• Apply least privilege: no routine clinical use under administrator accounts.
• Use application allowlisting where the vendor supports it.
• Secure remote service access: vendor connections through approved VPN or portals with multi-factor authentication, time-limited access, and logging.

Physical security still matters for networked devices:

• Lock or cover unused USB and network ports; use tamper-evident seals on data ports where appropriate.
• Keep device servers and network closets locked, with controlled access.
• Secure portable devices that store data (cable locks, locked storage, location tracking).
• Account for every data-bearing device at decommissioning (section 2.3).

---

6. Wireless Medical Telemetry Service (WMTS)

The FCC created WMTS so patient telemetry could operate in protected spectrum instead of crowded unlicensed bands.

• Frequencies: 608–614 MHz, 1395–1400 MHz, and 1427–1432 MHz.
• Registration: Before operating, a facility must register its WMTS systems with the FCC-designated frequency coordinator, the American Society for Health Care Engineering (ASHE). Registration identifies the location and frequencies so interference can be managed. Update it when transmitters are added, moved, or retired.
• Interference management: Plan coverage with the vendor; investigate dropouts for co-channel or nearby-transmitter interference; keep a frequency plan so new systems do not collide with existing ones.
• Wi-Fi telemetry: Many newer systems use hospital Wi-Fi instead of WMTS. Wi-Fi has no interference protection, so it needs a medical-grade wireless design, quality-of-service settings, and change control (section 9.4).