- Published
- Updated
Handling a device-related cybersecurity incident solely as an IT problem may overlook clinical consequences. Delayed data, lost access or incorrect display can affect participants and outcome assessment. Connect technical and clinical review pathways.
Define the assessment
Use evidence to identify affected and unaffected functions. Disconnection is not the same as cessation of local measurement. Possible unauthorised changes also require assessment of data reliability. Relevant authorised teams should assess incident communication, safety and applicable notification decisions.
Worked example
For example, access to a device server is temporarily blocked as a security precaution. Local measurement continues, but remote review is unavailable. Rather than closing the event when the system reopens, the team examines delayed assessments, participant support and integrity of recovered data. It also identifies functions that remained unaffected.
Practical checks
- Bound affected devices, versions, functions and time periods through source records.
- Assess measurement, transfer, display and decision-process effects separately.
- Check data integrity and acceptance of the clinical workflow during system recovery.
Decision and limitations
Closure requires more than restored connectivity. Track outstanding clinical reviews and data issues with assigned owners. Do not describe every cyber incident as participant harm, but do not assume absence of harm before assessment. Report the conclusion supported by evidence and remaining uncertainty together.
Frequently asked questions
- Does reopening the system close the incident?
- Not alone. Reconcile data, delayed assessments and participant implications as well.
- Is every connection problem a cyberattack?
- No. Investigate the cause and describe observations and uncertainty rather than asserting an unconfirmed attack.