Cybersecurity for the Carescape Monitoring Ecosystem

Through computer viruses, worms, Trojan horses, denial-of-service attacks, and other malware and attacks, the threats from malicious actors continue to grow for healthcare systems and real-time patient monitoring. GE HealthCare’s patient monitoring ecosystem contains multiple layers of defense to protect against threats.

One of the most comprehensive, real-time patient-data networks available today, the Carescape™ Network offers the ability to capture patient data in real-time and deliver integrated data across the enterprise to support informed decision-making.

• The Carescape Network architecture is comprised of the Mission-Critical (MC) network, the Information Exchange (IX) network, and the Carescape Gateway.

• The MC network is engineered to provide reliable performance of mission-critical information (parameters, waveforms, trends, alarms, etc.) and is protected from cyber threats by network isolation.

• The IX network can act as a conduit for non-real-time information (processed full-disclosure data, print files, etc.) exchanged with other systems within a hospital’s IT system and is protected behind a router/firewall when connectivity to the hospital enterprise is required.

The Carescape Gateway provides a mechanism for exchanging information between systems on the hospital’s enterprise network and devices on the MC network via the IX network. It forms a secure data bridge so data residing on either network can be shared across the two networks. At the heart of the Carescape Gateway’s defense is intelligent allowlisting that provides protection against threats, including advanced persistent threats (APTs) — by ensuring only authorized applications are allowed to execute.

By design, GE HealthCare’s patient monitoring products feature modern operating systems enhanced for cybersecurity, including kernel hardening and built-in security features to protect against cyber threats. Examples of this built-in security include communication port restrictions, prohibiting files to automatically run or execute, restricting file manager access and secure service interfaces.

To add an additional layer of security, customers have the option of deploying advanced authentication to the Carescape Network. By enabling 802.1X port-based network access controls and MAC Authentication Bypass (MAB) protocols, customers can ensure only valid devices have access to the Carescape Network — protecting the privacy and security for those in your care.