Mobile Healthcare – Security Whitepaper aycan OsiriX PRO, aycan mobile and Apple's iPad as DICOM image distribution enhancement for PACS environments. Copyright aycan Digitalsysteme GmbH 2013 Mobile Healthcare - Security Whitepaper

Table of Content 1. Executive Summary 2. aycan mobile 3. Use cases 4. Security 5. Other aspects 6. References Mobile Healthcare - Security Whitepaper

1. Executive Summary Medical professionals want to use state-of-the-art mobile technology for their needs. Tablets and smartphones provide mobile access to medical information. Mobile devices offer advantages of viewing medical images on the fly. Their functionality is still limited by hard- and software. This new technology also introduces new questions about security and effectiveness. Due to the characteristics of tablet technology, the diagnostic use should be limited to high contrast, low resolution medical studies like MRI, CT, US, NM and PET. Local regulations about display technology...

2. aycan mobile aycan mobile provides a transparent way to share DICOM images in local and also to distant networks. The DICOM images are stacked into cases (at the aycan OsiriX PRO software inside the hospital/imaging center) and sent to iPads. Users have to setup a login at the mobile.aycan.com server. This server will never store any patient data and is only used for establishing the proper connection between sender and receiver. The existence of a new case is signalized to the iPad user through the Apple Push Notification service. After login to the aycan mobile App some meta data and thumbnails...

3. Use cases There are at least four use cases for the aycan mobile system: 1. Reviewing images with patients at their bedside. 2. On-call and other remote review, interpretation, and diagnosis of radiological images. 3. Teleconsulting with colleagues. 4. Distribution of images to colleagues on-site. Fig. 2 aycan mobile use cases Mobile Healthcare - Security Whitepaper

4. Security The overall security of the iPad is documented at the Apple website, section "iPad in Business". Topics are: – Device Control and Protection – Data Protection – Secure Network Communication – Secure Platform Foundation It is recommended to setup the Apple remote wipe feature, in case the iPad gets lost. Apps for iOS are reviewed by Apple before they are released for customers. This is a benefit for the integrity and security of the software and the iPad. Currently there are no known viruses and other compromising software published for iOS. 4.1 Confidentiality Confidentiality assures...

4.2 Integrity Integrity assures that the information is correct – that is, it has not been improperly modified. – The data is encrypted during transmission (over an encrypted channel) and during storage on the device (see 4.1 Confidentiality). From that point where the data left the source node until the data is displayed on the screen there is no possibility to alter the information at the data sets because modification would imply correct decryption and correct encryption after modification, which is not possible with reasonable effort. – The data transfer mechanism assures that incomplete...

4.4 Accountability Accountability is the application of identification and authentication to assure that the prescribed access process is being done by an authorized user. – Every person who wants to use the system has to have a valid user account. For each user account a unique user name has to be selected. It is recommended not to share user accounts but to have a dedicated account for each person that would like to use the system. – People who would like to exchange messages respectively images have to authorize each other before one is able to send data to the other. – Each message – either...

5. Other aspects 5.1 Diagnostic use In some countries are regulations about medical displays for diagnostic use. Users have to check local regulations whether the display of the iPad is sufficient for diagnostic purposes. The display of the iPad is a 9.7" touchscreen with Retina resolution (2.048 x 1.536 pixels at 264 pixels per inch (ppi)) – or the older iPad 2 with 1.024 x 768 pixels resolution. An external (medical) display can be connected to the iPad 2 by an adapter and the iPad can display 1.920 x 1.280 pixels on this external device. Fig. 3: iPad for Diagnostic Purposes The aycan mobile...

6. References iPad in Business – Security resources http://www.apple.com/ipad/business/it-center/security.html iPad Initiative, University of Chicago http://medchiefs.bsd.uchicago.edu/iPad.html aycan mobile user manual, section Safety Instructions Mobile Healthcare - Security Whitepaper