Cybersecurity Risks and Vulnerabilities in Robotic-Assisted Surgery

ObjectiveThis study identifies cybersecurity vulnerabilities and risks in robotic-assisted surgery (RAS) and proposes a cybersecurity framework and an assessment tool for RAS systems.BackgroundRAS systems are increasingly integrated into networks which raise cybersecurity concerns. These systems can enhance surgical outcomes but are potential cyberattack targets, which can affect clinician care, patient safety, and organizational operations.MethodSurveys and interviews were conducted with stakeholders (clinicians, researchers, cybersecurity professionals, and hospital administrators) to collect perspectives on RAS cybersecurity. Thematic analysis was used to develop an RAS cybersecurity framework. Then, stakeholders contributed to creating an RAS cybersecurity assessment tool using Failure Modes, Effects and Criticality Analysis (FMECA).ResultsSurvey responses (n = 84) revealed that 48.8% of respondents were familiar with RAS cybersecurity. Only 24.6% of clinical respondents were aware of their organization's cybersecurity policy. Interviews (n = 15) identified vulnerabilities such as inadequate training, limited communication between manufacturers and healthcare systems, and gaps in regulations. Failure modes focused on consequences of cyberattacks on RAS systems, with severity assessments related to patient health and technology reliability/integrity completed and outcome actions identified.ConclusionUnderstanding RAS cybersecurity challenges is still in its infancy. Key vulnerabilities include insufficient training, limited data sharing, and external threats. The framework illustrates the interconnectedness of stakeholders, while the FMECA assessment tool addresses current vulnerabilities in RAS systems.ApplicationRAS cybersecurity vulnerability and risks should be carefully considered when integrating systems into healthcare organizations, and the RAS cybersecurity assessment tool can be used by stakeholders to systematically identify and analyze potential cybersecurity failure modes.