Nuvolo > Case Studies > Pediatric Health Care Provider Enhances Device Security with Nuvolo OT Solution

Pediatric Health Care Provider Enhances Device Security with Nuvolo OT Solution

Technology Category

Application Infrastructure & Middleware - Event-Driven Application
Platform as a Service (PaaS) - Device Management Platforms

Applicable Industries

Healthcare & Hospitals
National Security & Defense

Applicable Functions

Maintenance
Warehouse & Inventory Management

Use Cases

Cybersecurity
Tamper Detection

Services

Cybersecurity Services
System Integration

About The Customer

The customer is one of the largest pediatric healthcare providers in the United States, serving over a quarter million children across multiple locations each year. They rely on over 5,000 medical devices, including MRI, CT scan, and infusion pumps, that are connected to their network. This network connectivity allows healthcare teams to share health monitoring data, procedures, and outcomes more efficiently. However, the safety, availability, and accessibility of these devices were at risk. The healthcare provider is committed to ensuring the security of their medical devices and quickly addressing any issues to comply with the Health Insurance Portability and Accountability Act (HIPAA).

The Challenge

One of the largest pediatric healthcare providers in the United States, serving over a quarter million children across multiple locations each year, was facing a significant challenge in ensuring the security of their network-connected medical devices. The healthcare provider relied on over 5,000 medical devices, including MRI, CT scan, and infusion pumps, to offer complex clinical care. However, the safety, availability, and accessibility of these devices were at risk. Unauthorized access to a device could disrupt devices, steal data, or gain access to other parts of the network. The IT security team struggled to identify the device owner, device make and model, software version, and device location when unusual behavior was detected on a device. There was no single device inventory with a common data format, and there was no easy way to normalize the data for consistency. Remediation was taking too long, putting children’s lives at risk.

The Solution

The healthcare provider chose Nuvolo OT Security for its fully tested, out-of-the-box integration with their security monitoring solution. Nuvolo met their functionality requirements, which included orchestration, automation, and real-time response to security events. Nuvolo’s single device inventory replaced their multiple computerized maintenance management systems (CMMS). The new single inventory consisted of common data fields with normalized data, which was critical to ensure security events could be acted on quickly. Nuvolo OT Security automated the process to create work orders against security event records, creating a shared dashboard view for the HTM and security operations center (SOC) teams. The solution also enabled the healthcare provider to correlate security events to other devices and provided contextualization to help them respond more efficiently to alerts and vulnerabilities across multiple devices within the same timeframe.

Operational Impact

The implementation of Nuvolo OT Security significantly improved the healthcare provider's ability to manage and secure their network-connected medical devices. The solution provided a single device inventory with common data fields and normalized data, enabling the IT security team to quickly identify and address security events. The automation of work orders against security event records facilitated communication and coordination between the HTM and SOC teams. The ability to correlate security events to other devices and provide contextualization helped the healthcare provider respond more efficiently to alerts and vulnerabilities across multiple devices within the same timeframe. The solution also reduced false positives, minimizing alert fatigue for the IT Security team. Furthermore, Nuvolo's out-of-the-box reports met the healthcare technology and security team's specific device security events reporting requirements, enabling technicians to prioritize their remediation efforts.