Researchers Hope This Invention Could Wave Away Medical Data Hacks

Doctors' scrawls on prescription pads and medical folders are so analog.

These days, they're prescribing and keeping track of patients' records using digital devices connected to wireless networks, sometimes remotely. More medical devices are also becoming increasingly small and wearable; they often connect with a hand-held controller or even your smartphone through Bluetooth or Wi-Fi, sometimes sending the data directly to physicians.

This convenience, accessibility and cost reduction for our health care comes with risks. A few keystrokes could end in a wrong treatment, for instance — in 2007, Dick Cheney's cardiologist disabled the wireless functionality of the former vice president's heart defibrillator out of safety concerns.

The overarching and long-growing problem is this: How do we protect the highly personal data flowing through wirelessly connected medical devices?

Enter Wanda, a prototype developed by Dartmouth College doctoral student Timothy Pierson and his team.

Wanda is essentially two antennas attached to a ruler, in a wandlike fashion. The device uses radio waves to establish a secure wireless connection between devices that generate data.

Here's how it works: The user turns on the medical device and the digital device it's getting linked to and then points Wanda — about 11 inches or less away — at the devices one at a time. Wanda then generates and transmits a secret password to each of the devices, connecting them securely within seconds.

Many Wi-Fi networks that transmit personal data aren't secure connections — and cybercriminals make more money hacking a person's medical information than from stealing his credit card details, says David Kotz, a Dartmouth computer science professor who leads the Trustworthy Health and Wellness project. It's developing a technology platform that secures and protects personal health information.

Plus, putting these devices in the hands of patients and relying on them to establish Wi-Fi networks is fraught with difficulties. Some patients don't have the technical know-how; others have a medical condition that poses a challenge. Most people, however, just create security passwords for their Wi-Fi networks that can easily be hacked, Pierson says.

This could lead to a data breach that may compromise the security of a patient's records, or even the patient's health if, for instance, the wireless heart pacemaker or dialysis machine is hacked. Internet security experts have warned for years that these devices are open to data theft and remote control by hackers — and the equipment to do so cost less than $20 in 2011, when a researcher hacked into his insulin pump and altered the settings.

Wanda's major appeal is its ability to generate a targeted, strong pass code that connects a medical device in essence without the patient's involvement. Researchers elsewhere have tried similar hypothetical approaches, but they require extra equipment to be included in the medical device, Pierson says.

Some of these ideas suggest that a secret password can be created by using a speaker and a microphone to send sound waves to devices, or by simultaneously shaking devices equipped with accelerometers that detect motion and orientation to establish a secure wireless connection.

Try shaking a treadmill or a refrigerator, Pierson says. "We haven't seen anything like [Wanda] on the market," he adds.

Pierson says he and his colleagues envision possibilities for Wanda beyond health care, especially as more of our household items get connected to the Internet. But for now, the team's focus is on Wanda's ability to protect sensitive patient data in a medical setting.

Wanda for now is only a prototype. Pierson says it has been received well by volunteer testers who have expressed interest in purchasing the device if and when it hits the market. A release date hasn't been scheduled because Pierson and his team are still in the process of filing for a patent.

The Senate health committee has been working on legislation that may help spur these kinds of devices through federal regulatory approvals. The lawmakers have set data security as a priority in their latest biomedical innovation agenda.