Introduction

Telehealth once provided a limited range of services to subjects of care in specific environments. However, the scope of telehealth services is rapidly expanding through advanced information and communication technologies (ICT) such as mobile-based, cloud-based and other network-based applications. Additionally, emerging global pandemics have acutely increased the need to diagnose, prevent, monitor, treat or mitigate diseases and injuries without face-to-face, in-person contact between subjects of care and care providers, making telehealth a more commonly accepted medical practice.

These services are described as telehealth services because ICT are used to support healthcare activities. Telehealth services can include but are not limited to telemedicine, telecare, mHealth (healthcare supported by mobile devices), remote use of medical applications, tele-monitoring, tele-diagnostics and virtual care. Examples of health services include but are not limited to tele-pathology, tele-dermatology, tele-cardiology, tele-rehabilitation, tele-oncology and tele-orthopaedics. Healthcare activities that directly or indirectly support care recipients include but are not limited to teleconsultation, telephone advice, health alarm systems and health status monitoring at home. Telehealth services can support immediate healthcare activities using synchronous communications services such as a telephone or video conversation, or delayed health care activities using asynchronous communications services such as messaging services.

Furthermore, depending on the perspective, the subcategories of telehealth can also vary. Physicians might categorize telehealth by medical specialties, such as tele-neurology or tele-orthopaedics, while healthcare IT experts might focus on system topology and network configurations. When it comes to telehealth in cybersecurity, telehealth actors, interactions between each actor, data flow, service environment and technology should be considered. Therefore, establishing concepts and models of telehealth cybersecurity would be the first step to build a framework for cybersecurity in telehealth environment.

Telehealth cybersecurity concepts and models serve as a baseline for the analysis of cybersecurity threats and to determine countermeasures. Telehealth cybersecurity countermeasures need to consider not only technical aspects, but also management and physical approaches to operating telehealth services. This is because telehealth cybersecurity involves interactions between multiple actors situated in environments with different levels of cybersecurity. The cybersecurity policies and processes act as variables that influence the overall cybersecurity posture of telehealth.

People and physical requirements are addressed more deliberately in telehealth cybersecurity because participants beyond the network cannot be controlled. Actors on this side cannot even apply a band-aid to those on the other side. It will take time and effort to ensure that the quality of telehealth services matches that of general healthcare services. Actors need to account for variables that arise from not being able to see or directly address issues. Actors cannot know what is happening outside the camera’s view. Physically occurring risks, such as break-in, theft, vandalism, disconnection and deception, are also critical issues that need to be addressed in the telehealth environment.

The cybersecurity framework for telehealth environment is structured as follows;

— Part 1: Overview and concepts;
— Part 2: Cybersecurity reference models of telehealth;
— Part 3: Cybersecurity requirements for telehealth.

This document is the second part in the ISO 6268 series and it covers a telehealth cybersecurity reference model of the overall security framework for systems and services applied to telehealth.