The medical industry is in the throes of entering a new epoch in imaging technology. Healthcare professionals are upgrading to ultra-high definition 4K resolution as the innovative technology provides four times the clarity than that of high definition. Typically, diagnostic and surgical procedures are guided via information gleaned from various imaging procedures.  With so much weighing on these scans, the ultimate goal is to obtain unparalleled picture quality punctuated by incomparable clarity.

Our variety of UHD display options from major brands including Barco, Sony, NDS, LG, and Eizo provide clients with a variety of smart choices. For those balancing prudent budgets that include improvements to equipment, Sony’s LMD-X55MD offers affordability, efficiency, and versatility. Available in 31 inches, its slim, ergonomic design and splash proof covering will improve any operating room.

In addition to a sleek exterior, the surgical monitor is equipped with Sony’s OptiContrast technology and original Advanced Image Multiple Enhancer, which allows users to visualize images without glare or reflection. The LED backlit monitor features Quad View Mode and a user-friendly interface, which allows users to view up to four images simultaneously, manipulate images via image mirroring as well as allowing users to take advantage of side-by-side comparison, picture-in-picture, and picture-out-picture.
In minimally invasive surgeries, large displays play an integral role in facilitating the visual components necessary to perform procedures. The HYBRIDPIXX, an Ampronix original UHD 4K display recently made public, is unrivaled in image quality as it is equipped with our patented 4KBoxx.

The HYBRIDPIXX 4KBoxx video manager gives physicians the ability to select desired images and exhibit them in various layouts on the UHD display. Beneficially, hundreds of potential layout options offer a multitude of customization possibilities. With the ability to input up to 27 analog or digital signals, the HYBRIDPIXX is an ideal candidate for large scale viewing and multi-screen monitoring.

Those interested in adopting UHD 4K technology ought to consider endoscopic camera options, which will vastly improve the visual aspect of minimally invasive surgeries. These cameras have the ability to exhibit vibrant and clear images of internal structures to any UHD 4K display. Currently, Panasonic’s 4K Ultra HD 3MOS Camera is the smallest 4K camera head available.

Panasonic’s 4K camera has the ability to capture images in 3D and edit with tools to zoom-in and crop. The colour enhancement technology and video processor offers outstanding image reproduction and colorization capabilities. The camera has maximized connectivity with an output of up to 1600 lines, a resolution of 3840 x 2160 at 60p, and dual channel outputs.

The shift towards UHD 4K technology is quickly becoming a medical industry standard. Ampronix is proud to be at the forefront of leading technological shifts by equipping healthcare providers with only high caliber products. Moving forward, the company will be stocked with UHD 4K recorders from brands like Panasonic and Sony, slated for release in the upcoming months.

About Ampronix
Ampronix is a renowned authorized master distributor of the medical industry’s top brands as well as a world class manufacturer of innovative technology. Since 1982, Ampronix has been dedicated to meeting the growing needs of the medical community with its extensive product knowledge, outstanding service, and state-of-the-art repair facility. Ampronix prides itself on its ability to offer tailored, one-stop solutions at a faster and more cost effective rate than other manufacturers. Ampronix is ISO 13485:2003, ISO 9001:2008, and ANSI/ESD S20.20-2014 certified.

www.ampronix.comEmail: info@ampronix.com

Almost precisely a decade ago, the US National Institutes of Health remarked that point-of-care (POC) testing might offer a paradigm shift towards predictive and pre-emptive medicine.
Recent advances in areas such as genetics testing, biosensors and microfluidics continue to enthuse proponents of such scenarios.
However, several challenges still need to be addressed, along the way.

Quicker, better and cheaper
POC testing, which simply means diagnostic tests are done near the patient rather than a clinical laboratory, provides diagnostic information to physicians and/or patients in near-real time. Samples do not need to be transported, or results collected.  Short turnaround times are accompanied by high sensitivity and a sample-to-answer format, as well as reduced costs to the health service.

Push-and-pull
Unlike many other medical innovations, the push of POC technology has been accompanied by a pull from users. Patients find POCs convenient and empowering. Many POCs allow them to monitor their health and medical status at home. Alongside the growing availability of medical information on the Internet, and other enabling technologies such as telemedicine, POCs also mark the coming of age of personalized medicine.

Classifying POC tests
POC tests can be broken down in terms of size/disposability and complexity. At one end are small handheld tests, above all for glucose, and lateral flow strips which determine cardiac markers and infectious pathogens, or confirm pregnancy. 
In recent decades, strip technology has been coupled to meter-type readers, typified by the now-widely used glucose meter.  Due to their compact nature, such POC tests are often specialized and limited in overall functionality. However, some can be quite sophisticated. New POC tests for early detection of rheumatoid arthritis, for example, require only a single drop of whole blood, urine or saliva, and can be performed and interpreted by a general physician within minutes.
On the other side of the equation are laboratory instruments, which have been steadily reduced in size and complexity. Recent launches include small immunology or hematology analysers. These POC tests provide higher calibration sensitivity and quality control and are used for more complex diagnostic procedures. Such devices have been accompanied by increasing levels of automation, which translates into increased speed. However, it also leads sometimes to challenges in training users.

Technology drivers
Three key technologies driving the POC market currently consist of genetic tests, biosensors and microfluidics. Combinations of biosensors and microfluidics have recently been developing at an especially dramatic pace.

Genetic testing
Traditionally, genetic testing involved DNA analysis to detect genotypes of interest, either for clinical purposes or related to an inheritable disease. However, results took days or weeks, limiting the applicability of genetic testing in a POC setting.

Emergence of molecular genetics
In recent years, molecular genetics has emerged as one of the most exciting frontiers for POC testing.  It detects DNA and RNA-level abnormalities that provoke and fuel most diseases. As a result, it offers precise diagnosis, determines the susceptibility of a patient to a specific disease and assesses his or her response to therapy. Molecular diagnostics can also establish a patient’s prognosis over time far more scientifically than what is often no more than a physician’s informed guess. 
One of the first POC gene tests was US biotech firm Cepheid’s GeneXpert, developed to detect the chromosome translocation associated with chronic myeloid leukemia. The small benchtop device provided results in less than two hours, with minimal manual labour involved.
Several companies have been developing tests to analyse genetic polymorphisms which influence the effectiveness of drugs. For instance, Spartan from Canada has developed a one-hour test to analyse CYP2C19, the cytochrome P450 enzyme that activates the antiplatelet inhibitor clopidigrel. Different alleles of the CYP2C19 gene can impair the enzyme’s ability to metabolize the drug, leading to major adverse reactions. Others are developing quick turnaround tests (below 20 minutes), for instance, to detect polymorphisms associated with warfarin response, in order to guide dosage.
These developments focus on analysing very specific targets, with clinical decisions based on a handful of expected results. POC testing in such contexts evidently saves time and permits faster patient care.

Gene sequencing: challenges and breakthroughs
The case is different when the POC effort involves sequencing a gene or a whole genome. This is largely because the interpretation of (otherwise-quick) results are still time consuming and need trained experts.
In spite of this, some innovators are confident about the opportunity for handhelds in genomic sequencing. MinION is a 90 gm handheld device, and is seen by its developer Oxford Nanopore as a first step to ‘anything, anywhere’ sequencing. MinION, which has been used in UK hospitals and in West Africa during the Ebola outbreak, performs nanopore-based sequencing within just a few hours.
There is much more, however, that remains to be smoothed out. MinION shows a high error rate compared to existing next generation sequencing (NGS) platforms and it is impractical for use with larger genomes.
As these kinds of POC genomic technologies continue to develop, other enabling innovations are also likely to make an impact. For example, some researchers have harnessed mobile phone technology for gene variation analysis and DNA sequencing. Its implications in a POC setting would clearly be massive.

Biosensors
As mentioned above, another technology driving POC diagnostics consists of biosensors.
Biosensors are biological materials, closely associated with a transducer to detect the presence of specific compounds.
A biosensor system consists of a biospecific capture entity to detect the target molecule, a chemical interface to control the system function and a transducer for signal detection and measurement. Transducers can be electrochemical, optical, thermometric, magnetic or piezoelectric. Their aim is to produce an electronic signal proportional to an analyte or a group of analytes.
The biospecific capture entity (typically whole cells, enzymes, DNA/RNA strands, antibodies, antigens) is chosen according to the target analyte, while the chemical interface ensures the biospecific capture entity molecule is immobilized upon the relevant transducer. 

Key requirements
One key requirement in a biosensor is selective bio-recognition for a target analyte, and the ability to maintain this selectivity in the presence of interference from other compounds. The selectivity depends on the ability of a bio-receptor to bind to the analyte. Bio-receptors are developed from biological origins (e.g. antibodies) or patterned after biological systems (such as peptides, surface- and molecularly-imprinted polymers).
The second requirement in a biosensor is sensitivity. This depends on a wide range of factors, such as the properties of the sensor material, the geometry of the sensing surface and resolution of the measurement system. One of the most important factors in this context is surface chemistry, used to immobilize the bio-recognition element on the sensing surface.

BioMEMS
In the field of POC, there has for some time been considerable excitement about biomedical (or biological) microelectromechanical systems, known by their abbreviation BioMEMS.
BioMEMS are biosensors fabricated on a micro- or nano-scale, resulting in higher sensitivity, reduced detection time and increased reliability. Reagent volumes are also reduced due to the smaller size of BioMEMS, which increases their operational cost-effectiveness.
The miniaturization inherent to BioMEMS means greater portability, which is of course a cardinal requirement for POC applications.
Next-generation POC systems are expected to go beyond diagnostics to advance warning, by ‘learning’ about patients (including vital signs such as heart rate, oxygen saturation, changes in plasma profile etc.), and discovering problems in advance through the use of sophisticated algorithms. Such monitoring systems are likely to comprise different types of wearable or implantable biosensors, communicating via wireless or 4G links to their smartphones and onwards to a medical centre. Such systems would dramatically reduce response time and make testing available in environments where laboratory testing is simply not feasible.

Microfluidics: lab-on-a-chip
Microfluidics, also known as lab-on-a-chip, miniaturize and integrate most of the functional modules used in central laboratories into a single chip. The technology is seen as a high-potential driver of POC diagnostics, not least in developing countries.
There are three principal families of POC microfluidic tests – lateral flow devices, desktop or handheld platforms and (emerging) molecular diagnostic systems. The systems range from zero-instrumented POC devices for the detection of pathogens to fully-instrumented equipment such as NGS sequencing and droplet-based microfluidics.
Microfluidic applications have grown at a dizzying speed, due to the inherent advantages and promises of the technology. These include the ability to manipulate very small volumes of liquids and perform all analytical steps in an automated format – from sample pretreatment, through reaction and separation to detection. Assay volumes are therefore reduced dramatically, while sample processing and readout are accelerated. Other salient features of microfluidics consist of parallel processing of samples with greater precision control, and versatility in formats for different detection schemes. These of course translate to greater sensitivity.

Technology trends
Key technology trends in the field of microfluidics, which have a direct bearing on POC use, include growing miniaturization, higher efficiency chemical reagents, accelerated sampling times as well as larger throughputs in synthesis and screening. As with BioMEMS biosensors, the advantages of microfluidics also consist of low device production costs and disposability,
Some researchers are looking at the commodification of microfluidics – for example, mass production by using inexpensive materials such as paper, plastic and threads, coupled to cost-effective manufacturing processes.
Paper has drawn the highest degree of attention, given that it is lightweight, biocompatible with assays and ecologically friendly.  In terms of operation, paper microfluidics is seen as an innovative means to escape the limitations of external pumps and detection systems. Flow in paper is driven by simple capillary forces. Another major advantage of paper is its application in colorimetric tests for detection by the naked eye.  Given the proliferation of smartphones equipped with high-resolution cameras, some experts view paper microfluidics becoming the tool of choice for POC diagnostics in developing countries.

Biosensor-microfluidics combinations: developing at a ‘violent’ pace
Efforts to merge biosensors with microfluidics have also been demonstrated since the mid-2000s. Progress has been encouraging. Last year, a University of Copenhagen research team, led by biotechnologist Alexander Jönsson and visiting Canadian scientist Josiane Lafleur, noted that the “marriage of highly sensitive biosensor designs with the versatility in sample handling and fluidic manipulation” offered by microfluidics promises to “yield powerful tools for analytical and, in particular, diagnostic applications.” Their article, ‘Recent advances in lab-on-a-chip for biosensing applications’, was published in the February 2016 issue of the journal ‘Biosensors and Bioelectronics’, and noted that areas where microfluidics  and biosensors converged was “rapidly and almost violently developing.” Nevertheless, the authors also found there is still much more to be done, with the observation that “solutions where the full potentials are being exploited are still surprisingly rare.”

The growth in the use of modern, implantable cardiovascular devices has been accompanied by efforts to have them monitored by professionals at a distance. The principal driver for this has been convenience. However, over recent years, remote monitoring (RM) of cardiovascular devices is emerging not only as an alternative to the clinic, but in some cases as a source for enhancements to quality of care. Several professional societies have issued authoritative guidelines recommending RM for all eligible patients.

Device complexity and data transfer
Formally known as cardiovascular implantable electronic devices (CIEDs), equipment such as pacemakers, cardioverter defibrillators, loop recorders and hemodynamic monitors are technologically complex and equipped with an array of microelectronics, high computational capability and onboard firmware.
In turn, this allows for assessment, storage and remote transfer of a range of data via a transmitter placed in proximity to the patient. Examples of such data include device function, diagnostics and fault codes, to therapy delivery and intra-cardiac hemodynamics, as well as reports on patient clinical status and alerts on cardiovascular events.

Developments in remote monitoring technology
On their part, remote monitoring techniques too have undergone their own evolution  – from the original telephonic check-up of pacemaker battery levels and wand-based systems with patient-driven downloads, to current generation products which transmit data through stationary or mobile transmitters by either analogue/digital wired or wireless communication. Once transmitted, medical staff can check the information via a secure Website. Both the type and volume of transmitted data is similar to that obtained from direct interrogation.
Technically, it is important to differentiate between ‘remote interrogation’ and ‘remote monitoring’. The former involves periodic device interrogation performed manually at home by the patient or automatically at predefined points by the monitoring system. RM involves continuous device monitoring, one of whose key features is to trigger transmissions in case of alerts.

Convenience and workflow bottlenecks
Remote monitoring eliminates the need for routine, periodic visits to a clinic after CIED implantation. Most international guidelines specify that patients fitted with CIEDs should be followed up routinely, with the frequency depending on the device type and model – for instance, at Months 1 and 3  for implantable cardioverter defibrillators (ICDs). Key checks include those on battery, lead impedance, sensing amplitude, pacing threshold and arrhythmic events.
One of the most perceptible advantages of RM is of course convenience. Before it became available, patients with CIEDs had to visit clinics for periodic checks. This was a problem for several categories of patients – above all, those living in rural areas and those needing to be escorted by families due to frailty. These factors assume additional significance since the number of CIED patients has not only been increasing due to maturing technology and expanded indications, but also because an ageing society means that more people are in need of the devices. As a result, it is becoming ever-tougher to make appointments for CIED checks, and many patients who do not have RM can spend several hours waiting at a hospital for their turn.
Remote monitoring eliminates such bottlenecks and choke points. Analysis of RM data before a patient visit can shorten the time required for direct interrogation and intervention, especially should a need arise to determine the cause and management of a problem. If such a problem is only detected during a clinic visit, a patient would have to wait for the results to be verified, while the problem is detected, analysed and resolved.
According to some estimates, time required by physician to review RM data is approximately 10 minutes compared to a half-hour to complete CIED follow-up visits in a clinic.
Apart from routine transmission, special real-time protocols exist in RM for alerts, such as data anomalies, inappropriate therapy or other abnormalities. In such cases, the transmitter is usually linked to a central secure server to back up or distribute the results to a larger number of experts for further analysis and opinion.

RM data essentials
Typical data reported by RM include arrhythmic events (real-time intra-cardiac electrocardiogram, to determine if the event is supra-ventricular or ventricular), premature ventricular contractions (based on PVC frequency recording), atrial fibrillation (especially promising for patients with no prior history of AF, to allow rapid anticoagulant drug administration and prevent stroke), non-sustained VT (although this is mainly considered for ICD or CRT-D patients, rather than those with pacemakers) and VT/VF (to enable a therapy decision and whether it can be managed at home).

The Finnish ICD study
Meanwhile, rigorous observational and randomized studies have demonstrated a variety of clinical benefits, along with a high degree of patient satisfaction as well as cost effectiveness.
One of the first major studies on remote monitoring of ICDs was carried out in 2005-2006 at the Oulu University Hospital, Finland. The system consisted of a portable patient monitor, a secure database and website, at which clinicians could view and analyse data.
The study’s goal was to provide comprehensive information on the safety, ease of use, satisfaction and data acceptance by both clinicians and patients, and the cost-effectiveness of remote monitoring in a location characterized by long travel distances to the clinic.
The outcomes were satisfactory.
There were, first of all, no device-related adverse events.
80% of the remote-monitoring sessions were performed by the patients without any assistance. Indeed, ease of use and satisfaction by both patients and clinicians made an especially strong case. Most patients found the instructions ‘clear’ or ‘very clear’, with monitor set up ‘easy’ or ‘very easy’. What was equally significant was the lack of any major difference in patient feedback from the first test, at 3 and 6 months, and even during unscheduled visits.
On their side, clinicians too drew similar conclusions on ease of use and satisfaction, with the majority finding data comparable to traditional device interrogation. Just two of 137 physicians felt an in-office visit would have provided more detailed information on device function, as it was not possible to measure the pacing threshold remotely.

Early detection of clinical events
Since then, other studies have reconfirmed the immense promise of RM.
In 2010 ‘Circulation’ published results of a trial on automated remote monitoring of implantable cardioverter-defibrillator called TRUST (Lumos-T Safely Reduces Routine Office Device Follow-up).
This study, on 1,339 patients, confirmed that the burden of visiting a clinic was greatly reduced by using RM, and that it saved valuable time and resources. The study found that in-hospital evaluation numbers dropped by 45% without affecting morbidity.
The TRUST trial also established that RM facilitated early detection of clinical events, in some cases dramatically. For example, the median period from onset to physician evaluation of combined first atrial fibrillation (AF), ventricular tachycardia (VT), and ventricular fibrillation (VF) events with RM was 1 day. By comparison, conventional care reported a median period of 35.5 days. System-related problems (such as lead out-of-range impedance) occurred over four times less frequently with the RM group, although the incidence in either setting was far too low to make meaningful comparisons.

Wireless RM and cardiac hospitalization stays
The utility of wireless remote monitoring with automatic clinician alerts was the subject of another trial called CONNECT (Clinical Evaluation of Remote Notification to Reduce Time to Clinical Decision).  This multicentre, prospective, randomized study of almost 2,000 patients with high-energy CIEDs lasted for 15 months. Its results were published in ‘The Journal of the American College of Cardiology’ in 2011, and reported a decrease in mean length of stay per cardiovascular hospitalization visit from 4 days in an in-office setting to 3.3 days with RM. The CONNECT study also found a dramatic reduction in the median time to a clinical decision in response to events, from 22 days at a clinic to 4.6 days using RM.

Other benefits of RM
RM has also established some other dramatic benefits. In 2013, ‘The European Heart Journal’ reported on ECOST, a randomized study on remote follow-up of ICDs. ECOST found that patients with RM had a 52% reduction in inappropriate shocks, fewer hospital admissions after such events and 76% fewer capacitor charges, leading to longer battery life.
In December 2014, a report in ‘The Journal of Arrhythmia’ noted that in prophylactic ICD recipients, the recommended 3-month in-office follow-up interval could be extended to 12 months with automatic daily RM, and that this reduced the ICD follow-up burden over a 27-month period after implantation. The 12-month interval resulted in more than halving the total number of in-clinic ICD follow-ups. In addition, no significant difference was found between the two groups (3-month in-clinic follow-up versus 12-month RM) in mortality, hospitalization rate, or hospitalization length over the observation period.

Mortality reduction with RM
Indeed, some experts propose that RM may reduce mortality in patients with CIEDs.
One study called ALTITUDE assessed long-term outcomes after ICD and cardiac resynchronization therapy (CRT) implantation and the impact of RM on almost 70,000 ICD and CRT-plus-defibrillator (CRT-D) patients. It found that one- and 5-year survival rates were 50% higher in comparison to about 115,000 patients who received CIED follow-up in office visits.

The future: patients generally satisfied with RM
As technology continues to evolve, both new possibilities and questions are emerging.  In the years to come, remote monitoring holds forth considerable promise for future research, given that massive amounts of data have already been collected from patients. 
In spite of some typical first-mover tech concerns, RM has proven to be easy to use and well accepted, even by the elderly people and patients with low education levels. There are some patients, however, who do not accept RM. This is mainly due to suspicions about technology and the risk of losing human contact with nurses and physicians. In such cases, patient education is critical.
The other challenge involves keeping track of a flood of data and alerts from a fast-growing pool of patients. As described previously, RM detects cardiovascular events much earlier than conventional follow-up. As a result, it is becoming essential to assess whether this translates into clinical benefits for patients, or whether earlier detection of events due to RM excessively increases clinic visits; the latter might well reduce clinical benefits.
On their part, patients continue to be satisfied with RM in terms of ease of use. One Italian study at San Filippo Neri Hospital in Rome has reported a more favourable change in quality of life over a 16-month period in RM patients, compared to those lacking access to RM. Benefits which have been specifically highlighted include the patients’ peace of mind, psychological well-being, and safety.

Hospitals depend on information to effectively manage and deliver health services. Given the unremitting escalation in cyber-attacks and patient data breaches at hospitals today, the role of the CISO (Chief Information Security Officer) has moved to centre stage.  
As their own responsibilities have expanded, hospital CISOs have also faced the need to understand perspectives of other boardroom leaders. These range from business practices to risk management, the economics and cost-benefit of security as well as legislation about privacy and liability. Indeed, some American hospitals refer to the CISO as Chief Information Privacy and Security Officer.

Data breaches and ransomware threats escalate
The frequency of reported data breaches at hospitals has grown especially sharply in the US. Over just two days in the middle of September this year, Children’s Hospital Colorado, Morehead Memorial in North Carolina and Georgia’s Augusta University Hospital reported security breaches which potentially affected personal health data of several thousand patients.
Europe has also seen its share of attacks. In May 2017, the National Health Service in Britain was hit by a ransomware attack which crippled the ability of some 16 units to access patient data.  In July, an insider breach at health insurance giant Bupa exposed data of 108,000 customers.
In France, over 1,300 attacks on hospitals and healthcare facilities were voluntarily reported to the Ministry of Health in 2016.

Scale of threat grows, so do delays in response
Nevertheless, a data breach scandal in another business sector depicts the sheer scale and impact of the phenomenon. In September, Equifax, a major US credit reporting agency, announced its IT systems had been compromised, potentially exposing credit card details, Social Security numbers, and other personal information for up to 143 million Americans.
Although critics of Equifax complained about the delay, the longest gap in discovery of a breach concerns Tewksbury Hospital in Massachussets, which took 14 years to discover that a clerk had been inappropriately accessing patient records since 2003.

The role of the CISO
Such events have propelled CISOs to the frontlines of information security, strengthening a trend that dates to the late-2000s.
In 2011, a PricewaterhouseCoopers (PwC) survey found that 80% of businesses had a CISO or equivalent, compared to less than half in 2005. Almost two-thirds reported to the Chief Executive or the Board of Directors, and the rest to a Chief Information Officer (CIO). 

60 percent of US healthcare facilities have CISO role
The situation in the healthcare sector has mirrored, if slightly lagged, this trajectory. In 2017, 71 percent of respondents to a US cybersecurity survey by HIMSS (the Healthcare Information and Management Systems Society) stated their organizations allocated a specific budget for cybersecurity.
Almost half said this was over 3 percent of the budget, while one in ten said the share was more than 10 percent. Another interesting finding from the HIMSS survey was that 60 percent of respondents said their organizations employed a CISO or senior information security leader.

The CISO in Europe
The above figures refer to the US. Europe is likely to be some way behind. Nevertheless, it too is catching up. In France, for example, the Association for the Security of Health Information Systems (APSSIS) made specific recommendations at a recent annual conference on the role of the CISO (known in French as ‘responsable de la sécurité des systèmes d’information or RSSI) and the need for close coordination with the CEO.
In the UK, HCA Healthcare, London’s largest private hospital group (including top facilities such as The Harley Street Clinic, Princess Grace Hospital and The Wellington Hospital) announced an opening for a CISO at the end of August 2017. The HCA described the CISO job as being “responsible for providing strategic leadership and operational oversight for the security of information technology and systems and Information Governance…” Specific tasks which were identified include risk assessment and management, patient privacy, development of policies, standards, procedures, and guidelines, as well as threat/incident response and corporate communications on security.

The CISO and compliance: ISO standards
CISOs are in fact responsible for information-related compliance in all business sectors. Compliance principally involves two information security frameworks published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

IEC/ISO 27001:2013
The first, IEC/ISO 27001:2013 is a guideline with requirements “for establishing, implementing, maintaining and continually improving information security management.”  The second, ISO/IEC 27002:2013, is a standard, and provides implementation rules. It focuses on the confidentiality, integrity and availability of information; it also provides best practice recommendations. Both are applied internationally.

ISO 27799:2016 focuses on healthcare
Hospitals, nevertheless, face very specific information security challenges. These are embodied in another standard, ISO 27799:2016, to protect the confidentiality, integrity and availability of personal health information. This ISO standard provides implementation guidance for the controls in ISO/IEC 27002:2013 and supplements them where necessary, to make them relevant for health-specific information security requirements.

ISO 27799:2016 applies to information in the form of words and numbers, sound recordings, drawings, video or medical images, whether it is stored in print or in writing on paper or electronically. Also covered are the means used to transmit the information – by hand, through fax, over computer networks, or by post.
It is important to note that although ISO 27799:2016 and ISO/IEC 27002:2013 jointly define information security requirements for healthcare, they do not specify how these should be met. In other words, they are technology-neutral.

Differences between ISO and HIPAA
ISO 27799:2016 is, however, not a legal requirement unlike HIPAA (the Health Insurance Portability and Accountability Act) which regulates the security and privacy of health information in the US, though the two have much in common. Nevertheless, for hospital CISOs, the difference is a major factor.
The latest Data Breach Litigation Report from St. Louis law firm Bryan Cave reports 76 class action data breach lawsuits in 2016, up by 7 percent from the previous year.
However, these actions are potentially only the tip of an iceberg, with only 3.3 percent of publicly reported data breaches leading to litigation. What is more pertinent to hospital CISOs is the fact that 70 percent of publicly reported breaches related to the medical industry, with negligence accounting for 95 percent of all cases.

The Common Security Framework
In the late 2000s, an initiative known as the Common Security Framework (CSF) sought to become the overarching framework to comprehensively map different security standards and practices and provide a one-stop solution for hospitals and the healthcare sector. It was established by the Health Information Trust Alliance (HITRUST) – a US-led healthcare industry organization which has sought to ensure that information security becomes central to both the adoption of technology and the exchange of health data.

HITRUST in the US
HITRUST, in many senses, marks the coming of age of the CISO, in the US. Its founders consisted of CISOs from a broad range of healthcare actors, including Blue Cross Blue Shield, CVS Caremark,  Hospital Corporation of America, Humana and Kaiser Permanente, alongside top executives from Cisco Systems, Johnson & Johnson Health Care Systems and Philips Healthcare.
HITRUST has however yet to make any impact in Europe, where attention to healthcare information data security has been directed either to the electronic health record or included within the broader ambit of protecting personal data.

The Smart Hospital in Europe
Indeed, CISOs in Europe’s hospitals pay far greater attention to ISO 27799:2016 and ISO/IEC 27002:2013, with a leadership role at ISO taken by CEN, the European Committee on Standards.  Recently, this has been accompanied by recommendations from ENISA (European Union Agency for Network and Information Security).
As part of the so-called Smart Hospital programme, ENISA has specified good practices for hospitals, with explicit mention of the role of the CISO. Nevertheless, ENISA too takes cognizance of the central role of ISO and the “2700x series of standards.”

National initiatives
There are several national initiatives, too. In France, for example, APSSIS (the Association for the Security of Health Information Systems) has played a major role in charters to be signed by staff within territorial hospital groups (GHT), so as to make them aware of best practices in computer security.

In Germany, ZVEI (the German Electrical and Electronic Manufacturers’ Association) has published guidelines on the use of IT in medicine, including what it calls “secure medical subnetworks”. In February, ZVEI released a position paper on standards for the use of electronic products used in a medical setting and the legal obligations of operators using such systems.
One of the nightmare scenarios here is, of course, the likelihood of hacking of medical devices.  In 2016, Johnson & Johnson warned customers about a security bug in one of its insulin pumps , while St. Jude has sought to deal with the fallout of vulnerabilities in some of its defibrillators and pacemakers.

Health-specific experience
The issue of health-specific technical experience is now driving recruitment of hospital CISOs.  Healthcare has lagged sectors like banking or retail with regard to IT adoption. Indeed, even when hospitals began to implement IT, functionality rather than security was the priority. As a result, most hospitals have a back-office choking with legacy applications, often numbering in  the thousands. Knitting them into a secure architecture is hardly straightforward.
One consequence of such factors is an inadequacy in the number of IT professionals familiar with both healthcare and security. 

Training and certifications
To access the requisite talent, some argue for jettisoning the search for healthcare experience, and focus on hiring an experienced CISO from another industry, followed by training in healthcare issues.  Others favour the opposite – to look for talent in healthcare IT, but train them in security.
The College for Healthcare Information Management Executives (CHIME), and its affiliate, The Association for Executives in Healthcare Information Security (AEHIS) have launched programmes directed wholly at training hospital CISOs.
The CHIME Certified Healthcare CIO (CHCIO) programme, is in fact the first certification programme exclusively for CIOs and IT executives in the healthcare industry. CHIME members who have been in a healthcare CIO or equivalent position for at least three years and want to enhance their professional stature are eligible to become certified. Currently, over 400 IT professionals are CHCIO-certified. This level of figure is also endorsed in a professional forum like LinkedIn, which lists 240 CISOs at hospitals – out of a total of over 7,500.

For now, generally speaking, one is more likely to find CISOs at larger hospitals and academic medical centres in both Europe and the US. Mid-sized facilities still dedicate the CISO role to a CIO (Chief Information Officer), supported by IT staff who devote part of their time to security issues. Such a piecemeal approach is however fast revealing its limitations, as shown by the growing wave of cyberattacks.