SiKIS

Hospitals process vast amounts of patient health data. The hospital information system (HIS), a specialized software solution in the healthcare industry, is at the heart of medical care and data management. With the growing threat of cyberattacks against hospitals, the need for action is clear. How secure are these systems, and how well is sensitive data protected during transmission? The e-Health team at Fraunhofer SIT is investigating this in the SiKIS project (Security Properties of Hospital Information Systems).

The plan is to evaluate the communication technologies used in German hospitals as well as the central software systems. First, the current state of the German healthcare system will be assessed in two steps:

1. What standards are used for exchanging messages within hospitals and with other external stakeholders in the healthcare industry? Examples of such data exchange standards include HL7, DICOM, FHIR, DICOMWeb, etc.
2. Which hospital information systems (HIS) are in use? This includes market relevance, functions, and interfaces to other hospital systems, as well as the various architectural models, such as local hosting within the hospital (on-premise) or cloud hosting by the software vendor.

Penetration testing for HIS test systems

Based on this, an IT security analysis of the data exchange formats as well as several HIS is to be conducted. Here, the researchers are still seeking HIS manufacturers and hospitals willing to collaborate with them and have their HIS evaluated via penetration tests at no cost. 

Potential vulnerabilities are reported to the manufacturer in close collaboration with the project sponsor, the Federal Office for Information Security (BSI), through a Coordinated Vulnerability Disclosure process. This process allows security-critical issues to be detected early and resolved as soon as possible.

Based on the previous results, final recommendations for action will be prepared for hospitals and clinics at the end of the project, which are intended for publication by the BSI.

Project Details

• Duration: November 2023 – November 2024
• Client: Federal Office for Information Security (BSI)
• Project budget: approximately 200,000 euros