Original Research

IoT medical device risks: Data security, privacy, confidentiality and compliance with HIPAA and COBIT 2019

Na-ella Khan, Riaan J. Rudman

Received: 15 July 2024; Accepted: 06 Dec. 2024; Published: 19 Feb. 2025

Copyright: © 2025. The Author(s). Licensee: AOSIS.
This is an Open Access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

Abstract

Purpose: This study aimed to develop a comprehensive framework to enable the identification of risks pertaining to data security, privacy and confidentiality when using medical Internet of Things (IoT) devices.

Design/methodology/approach: A qualitative, non-empirical study was undertaken to identify data-related risks when using medical IoT devices using a systematic literature review and two governance frameworks.

Findings/results: Within the medical field, risks of using IoT are concentrated around data security, privacy and confidentiality throughout the data lifecycle prevalent within each layer of the IoT architecture. A comprehensive framework was developed to identify these risks at each layer within the architecture in order to facilitate sound information technology (IT) and data governance.

Practical implications: This research documents evidence of the risks posed by IoT devices within the medical field particularly pertaining to IoT data. It provides those charged with governance with a tool to identify all significant risks in this field that is compliant with Health Insurance Portability and Accountability Act and Control Objectives for Information and related Technology 2019.

Originality/value: This research provides a comprehensive framework that can be used by those in charge of governance including IT specialist for risk identification during implementation for sound IT and data governance of medical IoT devices using recognised benchmarks. The use of the benchmarks ensures that all significant risks are identified, compared to previous research that identified risks in an ad hoc manner.

Keywords: IoT; data governance; health-care; HIPAA; COBIT 2019.

Introduction

The healthcare profession can be seen as an essential service to maintain the health of a nation encompassing specialities such as oncology, paediatrics and cardiology. Historically healthcare was hospital bound because of the need for a physical examination – making patients’ care more hospital focussed and costly (Pradhan et al., 2021). The rising cost of care and resource limitations within the medical industry led to the embracement of technological advancements, the most notable of which is the use of Internet of Things (IoT) devices. The IoT devices in healthcare enable real-time data collection, analysis and sharing of data with other devices and the cloud aiding in remote patient monitoring and emergency response services (Jha et al., 2022; Karunarathne et al., 2021). These devices transmit data via wireless networks such as Wi-Fi, LoRa and Bluetooth within a hospital network facilitating data integration to provide better treatment (Morar et al., 2021). Internet of Things creates new opportunities within healthcare by integrating relevant diverse data to improve health service quality (Kelly et al., 2020). Information technology (IT) specialists and those in charge of governance may be eager to adopt IoT into their operations because of its proposed benefits in respect of, for example, cost reduction and personalised medication management (Karunarathne et al., 2021). Furthermore, the interconnected nature of IoT also creates opportunities for further analysis of integrated data to gain insights into better decision-making within any industry (Middleton et al., 2013).

Healthcare organisations can generate value by using integrated medical data; therefore data is an asset that needs to be managed and protected (Atlam et al., 2021). However, the use of IoT leads to mass data generation that because of its sensitive nature needs to be safeguarded (Institute of Directors Southern Africa [IODSA], 2016). Furthermore, the interconnected nature of IoT poses risks to patient data security, privacy and confidentiality, subjected to regulatory requirements outlined in the Health Insurance Portability and Accountability Act (HIPAA) of 1996 (United States, 1996). Health Insurance Portability and Accountability Act represents a healthcare legislation drafted by the United States (US) that sets global standards for regulation with respect to patient data including personal data throughout its life cycle. When implementing IoT, the healthcare industry must be prepared by gaining knowledge about the impact that IoT devices will have on business operations and about the ways to identify risks arising from the use of these devices.

According to IODSA (2016), corporate governance should be a mindful act of compliance that considers an organisation’s unique circumstances. In a hospital environment, the use of IoT and the sensitive nature of patient data transmitted is unique and needs to be governed with this in mind. As corporate governance includes IT governance and data governance as core components (Abraham et al., 2019b; Pearce, 2017; Smallwood, 2020), these components need to be considered in order to address the risks associated with IoT in this field to ensure compliance with corporate governance principles. Furthermore, many studies may make implicit references to corporate governance but few address how corporate governance principles should be applied as is true for many industries (Myeza et al., 2023).

Within an IoT environment, the risks may be pervasive as IoT infrastructure is permeating in nature. Adequate mitigation of risks is required to meet corporate governance requirements, which are best addressed through the use of a comprehensive framework such as Control Objectives for Information and Related Technology (COBIT) 2019 that addresses risk mitigation through corporate governance principles, IT governance principles and data governance principles (Information Systems Audit and Control Association, 2019). Governance over IoT devices in the medical field will contribute to responsible use thereof in a sustainable manner that will protect the patient and contribute to better healthcare resulting in enhanced management of these devices in a hospital environment. Therefore, those in charge of governance including IT specialists must consider the risks associated with IoT and IoT data in order to protect patient data when using IoT to ensure corporate governance and contribute towards worlds sustainability and enhanced business management.

Methodology

Research objectives

The introduction of IoT has expanded healthcare systems beyond the hospital, integrating patient data from homes and communities into a wider platform extending across the healthcare domain (Li & Carayon, 2021). The interconnected nature of IoT allows for data sharing across different stakeholder levels, for example patients, doctors and clinicians, shifting the focus onto the patient (Li & Carayon, 2021). However, this accessibility raises concerns regarding security breaches and data leaks hampering patient’s data privacy and security (Li & Carayon, 2021). Despite embracing IoT, the industry often lacks awareness regarding associated risks and lacks the skills to identify them. This research aimed to identify data security, privacy and confidentiality risks associated with IoT in the medical field in order to create a comprehensive framework to identify these risks, which can be utilised by those in charge of governance (including IT specialists and auditors) to ensure that sound corporate governance practices are established while achieving enhanced business management and furthering sustainability efforts. The study focussed on wearable and implantable IoT devices and outlined the IoT data lifecycle including its transmission over networks using Internet protocols rather than delving into the technical design and programming of IoT and its enabling technologies.

Research methodology

A positivism philosophy with the purpose of gaining an understanding and obtaining theoretical insights into the nature of IoT and IoT data within the medical field in order to produce a comprehensive framework for identifying risks related to the use of IoT devices and IoT data in the medical field was used coupled with a deductive reasoning approach to gain specific insights from existing literature and theories within this field of study. A qualitative, non-empirical study was conducted to gain an understanding of the industry and technology that provided a foundation for the identification of appropriate frameworks that were used in identifying the risks associated with IoT and its impact on IoT data, commencing with a systematic review of relevant literature on the subject matter from 2002 to 2023 including relevant journal articles from accredited local and international journals, white papers, theses, electronic sources and books to obtain an understanding of the industry, underlying technology and applicable governance frameworks.

In order to add scientific rigour to the literature review and obtain a strong theoretical basis for the research, the three-stage process suggested by Levy and Ellis (2006) was employed, resulting in the 390, 995 articles initially identified being narrowed down to 167 relevant articles. During the input stage, a wide selection of articles were selected to gain an understanding of the underlying literature to get an indication of the scope of knowledge on the subject; thus the quality, academic value and reputation of the literature were not considered. The search was wide and generic whereby suitable data were gathered from quality literature databases such as Elsevier^®/ScienceDirect^®, IEEE, Google Scholar and Scopus using the following keywords: ‘IoT’, ‘IoT devices’, ‘health-care’, ‘data governance’, ‘IoT architecture’, ‘governance frameworks’, ‘data governance frameworks’, ‘data governance principles’, ‘data governance components’, ‘IoT data’ and ‘risks of IoT’. The initial search was narrowed down to focus on sources that were fully accessible in English and that had a strong academic foundation often originating from peer-reviewed sources. In the processing stage, the literature was refined down to develop an understanding of inter alia, ‘COBIT 2019’, ‘IoT risks in medicine’, ‘patient data’, ‘data governance for IoT’, ‘IoT architecture’, ‘electronic health records’, ‘corporate governance’ and ‘information technology governance’. This was achieved by selecting readings that contained similar themes with respect to the use of IoT in the medical field, sensitive patient data, risks of using IoT, data governance, IT governance and IoT architecture after examining titles, abstracts and keywords. In some cases, articles may claim to define IoT but do not explore its uses and consequences in detail. As a result, 293 articles were identified to be relevant. The focus of this research was to identify and outline the enabling technologies of IoT in order to understand the architecture behind it, as such readings that provided an in-depth technical study of the design, development or programming of IoT, and any enabling technologies associated with it were not considered. Furthermore, only readings that considered the risks associated with IoT data were considered for further analysis; readings that considered IoT solely without a link to IoT data were not considered. Thereafter, an in-depth review was conducted of articles, websites, introductions and conclusions. The purpose was to identify applicable information that enabled the authors to gain a clear understanding of IoT in the medical field, the types of data and data flow in relation to IoT devices, risks associated with the data life cycle of patient data and governance frameworks to mitigate these risks. This assisted in developing a clear understanding of the extent of each theme and of how much should be discussed about each theme. In this stage, readings pertaining to the above-stated criteria were restricted to those published from 2009 onwards as prior may have outdated information pertaining to the technology. This yielded 167 articles. These articles were synthesised into a logical structured argument known as the output stage that could provide a reader with the details of what the researcher researched during the input stage and what insights were gained from the processing stage.

The systematic literature review conducted in the abovementioned stages formed a solid theoretical knowledge base for the understanding of the medical industry, IoT data, IoT architecture, IoT devices, IoT data life cycle, IT governance, corporate governance and data governance.

The literature formed the basis of the initial findings of this research. Using this basis, the following structured steps used by Sahd (2015), Van Wyk and Rudman (2019) and Van Niekerk and Rudman (2019) were used to meet the following research objectives:

• Obtain a general understanding of the medical field and its relationship with IoT: The recorded concepts found in the previous processes were arranged by the researchers to establish an integrated set of information in an elaborative and supportive document that contains a general understanding of the health industry and the impact of technology, including the impact of IoT, by describing the technological evolution in this field, its benefits and consequences.
• Define IoT and its enabling technologies: This foundation of understanding is used to form a definition of IoT and its enabling technologies. This assisted in understanding the architectural layers of IoT devices, which included an understanding of the different types of IoT devices. The aim was to gain an understanding of the technology and its architecture and a general understanding of the types of devices available as described in generally accepted literature.
• Perform an analysis of data governance: An investigation was conducted into the different types of data collected by IoT devices in relation to the data life cycle within IoT architecture. Furthermore, the key data-related challenges faced by the healthcare industry in relation to the use of IoT devices were analysed and considered when developing an understanding of effective data governance and applicable laws and regulations relating to patient data in order to understand its importance in this field and assists users when managing patient data. This further led to the identification of a suitable framework that was applied as a basis when identifying risks in relation to IoT data (HIPAA).
• Perform an in-depth analysis of the COBIT 2019 governance framework and its processes and section 164 of HIPAA for data privacy and security: By taking the knowledge and insights gained regarding IoT and IoT data into account, the COBIT 2019 governance framework as detailed by the Information Systems Audit and Control Association (2019) and section 164 of HIPAA were evaluated in detail. Through this evaluation, the relevant processes that were necessary to govern IoT and IoT data were identified. The applicable processes and detailed mapping of risks are available from the authors on request.
• Identify risks associated with the use of IoT: The relevant processes presented in the COBIT 2019 framework and section 164 of HIPAA were used to identify risks with respect to each COBIT process, the privacy and security rules outlined in section 164 of HIPAA and IoT data including related IoT enabling technologies used in the medical field. A risk-technology matrix was prepared, associating the enabling technologies with their risks (Appendix 2).

Notably, through the review of the literature, some articles highlighted IoT risks but few addressed IoT data risks with respect to data security, privacy and confidentiality in a comprehensive manner. The biggest weakness in prior research was in the ad hoc nature in which risks were identified. In order to address this, COBIT 2019 and HIPAA’s section 164 were selected as an appropriate framework. These are widely accepted and internationally recognised by various organisations. It covers a wide range of IT processes that ensures easy alignment with other international frameworks and standards, thereby ensuring sound controls and regulatory compliance. COBIT 2019’s 37 processes and HIPAA’s legislative guidance regarding privacy and security were used as a benchmark to identify areas that need to be governed. Should these areas not be properly governed, it would give rise to risks in the medical field. Therefore, the understanding of the IoT technologies was mapped to these two frameworks to identify significant risks that relate to IoT and IoT data. A risk and technology matrix was developed, linking significant risks to its origin within IoT architecture. Once the risks were identified, a further review of the literature was performed in order to expand the detail of the risks. The methodology employed is same as that employed by Van Wyk and Rudman (2019).

Literature review

The global healthcare industry has experienced significant growth in the level and quality of healthcare delivery because of technological advancements (Hajizada, 2023). Modern medical equipment such as magnetic resonance imaging (MRI) scanners, ultrasound machines and computed tomography (CT) scanners have enhanced patient care allowing for better healthcare plans resulting in better patients’ care and faster diagnosis and treatment. Furthermore, the transition from paper-based documentation into electronic health records has streamlined patient care management and resources management across hospital departments as these records are available in real time and can be shared and accessed at any point in time (Rezaeibagha et al., 2015). Because of the evolution of healthcare, the medical industry has sought to use technologies that can assist it to further its goals and provide better medical care to all (O’Reilly et al., n.d.). Of these technologies, IoT is at the forefront. While the healthcare industry is quick to implement and encourage the use of IoT devices, it is often unaware of the exact nature of the risks these devices pose, and it often lacks the skills to identify these risks. The gap between IT and its implementation in business goes hand in hand, one not being able to succeed without the other.

Having said this, there is often a difference in understanding and assessing the needs of business and the needs from an IT perspective, thus giving rise to a skewed view of the role each plays in the success of a business, which can lead to challenges when determining technological solutions. A skewed view is considered to be one of the key challenges when assessing new technology to solve business issues that hinder proper corporate and IT governance. This brings to light the need for proper research guidance that can assist stakeholders in managing a new technology deployed to solve business problems and comply with best practices to ensure sound data and IT governance and by extension corporate governance allowing businesses to remain successful. This should in turn promote sustainability when using IoT in this field and contribute towards better business management.

Evolution of Internet of Things and the medical field

Technological advancement in health-care such as IoT are essential in addressing challenges such as rising cost of care, resource constraints and staff shortage that cause disparity in patient care (Pradhan et al., 2021).

In 1999, Kevin Ashton, initially defined ‘IoT’ as the idea of connecting radio frequency identification (RFID) technology with the Internet, for autonomous data collection (Ashton, 2009). Internet of Things has evolved into integrated enabling technologies forming a community of heterogeneous devices, including sensors and software components, that effortlessly work together and interact with users to provide specific state-of-the-art cyber-physical services (Birkel & Hartmann, 2019; Fortino et al., 2022). Internet of Things in medicine facilitates real-time monitoring of patients through wearable or implantable devices ranging from non-invasive wearable glucose monitors to implantable smart pacemaker for electrocardiogram (ECG) monitoring (Pradhan et al., 2021, Verma et al., 2022). A significant amount of available existing research has focussed on assessing the level of security of IoT devices used (Ahlmeyer & Chircu, 2016). Hajizada (2023) further identified safety and privacy concerns when using IoT devices in the medical field and investigated current safety safeguards and identified some risks pertaining to safety and privacy but does not consider confidentiality of patient data while focussing on establishing safeguards focussed only on the transmission of data through IoT, leaving out other architectural layers where risks might lie. Furthermore, apart from providing an overview of IoT architecture, Bandyopadhyay and Sen (2011) pointed out that IoT has challenges around interoperability as different devices use different operating systems and communicate using different languages that may pose as a risk to overall IoT security. Several studies have showed that security risks are often overlooked especially in healthcare as legacy healthcare systems lack security features (Birkel & Hartmann, 2019; Lee, 2020; Radoglou-Grammatikis et al., 2022; Raghuvanshi et al., 2022; Sivaparthipan et al., 2023). Furthermore, security vulnerabilities such as transmission layer weaknesses expose devices to privacy and confidentiality breaches and attacks such as eavesdropping and denial-of-service (DoS) attacks (Birkel & Hartmann, 2019; Sivaparthipan et al., 2023). In addition, privacy and confidentiality of IoT medical data is another challenge (Sivaparthipan et al., 2023).

While some research suggests that there needs to be a wider focus on data because of the emergence of big data and machine learning techniques that can assist in offering insights for the improved patient care (Subrahmanya et al., 2022), the importance of sound data governance within the IoT environment is frequently overlooked and should be addressed. Currently a lack of comprehensive frameworks for risk identification and governance arising from the use of IoT results in a general lack of confidence with regard to privacy, confidentiality and security of data that hampers implementation of IoT (Morar et al., 2021).

Definition of Internet of Things within the medical field

Internet of Things devices in healthcare are sensory devices that are connected to the Internet with the capability to record data about their surroundings, including capturing data streams regarding physical environments and biological environments of its host and exchanging data with other devices (Mishu, 2018; Trautman et al., 2020). Sensors can monitor bodily functions and biometric data, such as heart rate or glucose levels, by making use of vital sign patches (Kelly et al., 2020). Embedded sensors, known as wearable devices, gather data about its environment and its host and exchange it with others such as medical professionals (Dasgupta et al., 2019; Pradhan et al., 2021; Van Niekerk & Rudman, 2019). Another type of IoT device is implantable devices, which can be inserted into a patient’s body or ingested and are often used for smart medication monitoring (Kelly et al., 2020). In addition, according to Thamilarasu et al. (2020), IoT in a medical context consists of a biome of connected devices and sensors that can enable healthcare applications such as elderly care, remote health monitoring and chronic disease management. The smartness of ‘things’ within IoT allows for these devices to have the ability to gather and communicate data across different stakeholder levels – for instance, data can be shared with patients, doctors and clinicians, thus shifting the focus onto the patient (Li & Carayon, 2021).

This process is displayed graphically in Figure 1.

FIGURE 1: Visual representation of Internet of Things devices in healthcare.

Considering the preceding discussion, IoT is a worldwide communication network that contains various sensors embedded in virtual and physical objects that can be worn or implanted with the ability to be uniquely identifiable. These devices gather data in real time from its host (patient) and the host’s surrounding environment that can be further integrated and analysed for better informed medical decisions.

Internet of Things architecture

Internet of Things architecture must be able to support the constant monitoring of patients’ health through the collection, usage, storage, management and exchange of data. To do this, a six-layer IoT architecture is proposed starting with a basic three-layered architecture described by Calihman (2019) and Kelly et al. (2020), expanding on to include an additional three layers adapted by the author after consideration of research conducted by Rahman and Hussain (2019) and Van Niekerk and Rudman (2019) as displayed in Figure 2.

FIGURE 2: A six-layer Internet of Things architecture.

The six-layer architecture with enabling technologies of IoT are described as:

• Coding layer: At this layer, devices are uniquely identifiable by means of number RFID tags enabling tracking of preventing unauthorised access to an organisation’s network (Van Niekerk & Rudman, 2019).
• Perception layer: At this layer, data is collected by sensors that detect changes within their environment such as location, temperature, weather patterns or even changes in heart rate (Calihman, 2019; Kelly et al., 2020).
• Network layer: The virtual network layer facilitates communication through wireless technologies such as Wi-Fi, Bluetooth, 4G, LoRa and radio frequency, employing communication protocols to transmit data of which there are three categories. The main protocols used can be split into the following categories (Van Niekerk & Rudman, 2019):
  • Application protocols (e.g. data distribution service [DDS]) for real-time machine-to-machine communication to transfer data accurately.
  • Search and resource discovery protocols such as domain name system protocol (DNS) for device identification via an internet protocol (IP) address.
  • Infrastructure protocols that assist in identifying IoT devices within the network for example Internet Protocol version 4 (IPv4) and routing protocols for efficient data packet delivery.
• Middle layer: This layer uses technology to consolidate and standardise IoT data while providing screening, processing, an element of security management, resource location and error resolution (Abbasi et al., 2017, Fan & Chen, 2010). All of this is made possible by the deployment of fog computing and cloud computing (Morar et al., 2021):
  • Cloud computing is centralised data processing, filtering and modelling of data in a cloud server (Rahman & Hussain, 2019).
  • Fog computing: Supports heterogeneity, interoperability and mobility of data by offering computational, network and storage services between the cloud server and IoT devices made possible by the use of fog nodes that manage resources and services independently (Saqlain et al., 2019). Fog computing acts as a supplement to cloud computing, together they make up the middle layer.
• Application layer: This layer analyses and interprets results of the data collected by the device to make business decisions by integrating emerging technologies such as AI for prediction and imagery diagnosis for assisting with disease diagnosis (Kelly et al., 2020).
• Business layer: This layer manages IoT systems to ensure alignment between the IoT systems implemented and the entity’s business goals (Van Niekerk & Rudman, 2019).

A six-layer IoT architecture provides an outline of how IoT and its enabling technologies function. To put this into perspective, an understanding of the manner in which medical IoT data are processed within an IoT environment should be explored in order to understand its data life cycle.

Data life cycle of Internet of Things data in the healthcare environment and data governance

A data life cycle consists of a series of phases over the useful life of the data. The data lifecycle of IoT data in healthcare consists of the data generation phase through to data disposal and storage (Wing, 2019). Saqlain et al. (2019) fittingly divided the life cycle of IoT data into two domains: the real-world domain and the virtual domain. In the real-world domain, data are generated and collected by wearable or implantable devices whereby device identification using unique identifiers is made possible, representing the coding layer (Pradhan et al., 2021). The perception layer collects different types of data in different formats from the real world such as facial expressions, blood glucose level, heart rate, temperature, weather conditions and location (Alarcón-Paredes et al., 2019; Kelly et al., 2020; Pradhan et al., 2021) and is transmitted via wireless network connections and communication protocols found in the network layer (e.g. Wi-Fi). Transmitted data undergoes data cleaning and indexing, among others, allowing for interoperability within the middle layer that is located in the virtual domain.

From the middle layer, the data can be sent to the application layer for further analysis and processing where data can also be visually presented and used to gain further insights for decision-making or for further medical research (Subrahmanya et al., 2022; Trautman et al., 2020). Otherwise, data are kept in cloud storage situated within the middle layer and remains in cloud storage until disposal. Figure 3 provides a visual representation of the data life cycle within an IoT environment.

FIGURE 3: The data life cycle within an Internet of Things environment.

Data gathered by IoT devices can be structured (e.g. patient details, heart and pulse rate) and unstructured (e.g. X-ray images, genomic and biometric data) (Dimitrov, 2016; Hendawi et al., 2019; Manogaran et al., 2018; Pradhan et al., 2021; Subrahmanya et al., 2022). Both categories of data have different characteristics that all need to be adequately safeguarded throughout the data lifecycle. Furthermore, sensitive health data pose a risk for the hospital and the patient involved if not properly secured and protected. As many IoT devices are not designed with security in mind, they are vulnerable to security breaches and data tampering (Trautman et al., 2020; Van Niekerk & Rudman, 2019). This can jeopardise patient privacy and confidentiality violating regulations such as HIPAA (Henriques et al., 2020; United States, 1996). In light of the foregoing and considering the sensitive nature of patient data governance within healthcare in respect of IoT is essential in addressing data security, privacy and confidentiality and is a crucial element when using IoT devices within this field to ensure regulatory compliance and compliance with corporate governance policies and practices.

Data governance

Internet of Things devices come with their own standards and protocols and handle sensitive personal and medical data, highlighting the need for robust data governance to ensure the privacy, confidentiality and security of the data (Islam et al., 2015; Karunarathne et al., 2021; Kelly et al., 2020; Morar et al., 2021; Van Niekerk & Rudman, 2019). Governance is seen as the bridge between technology and data that take shape in the form of decision rights and accountabilities built into a framework that encourages desirable behaviour to foster high-quality data for effective decision-making (Gao et al., 2022; Panian, 2010). While IT governance manages IT assets, data governance focusses on data as the asset to be governed (Dasgupta et al., 2019). As such, data governance can be seen as a component of IT governance. Both IT governance and data governance are components of corporate governance (IODSA, 2016) and need to be considered to adequately and comprehensively identify risks in this field, contributing to the establishment of sound corporate governance practices. Given the complexities of IoT and its susceptibility to privacy and security risks, a specific framework for governance is needed (Morar et al., 2021).

Instilling sound data governance in healthcare requires addressing IoT data architecture from the perspective of data management (Zakaria et al., 2019). Data governance is high-level planning that complements data management and includes a level of control over data management. This encompasses planning, control and security of data throughout its lifecycle (Al-Ruithe et al., 2018; Marco, n.d.; Zakaria et al., 2019). Control over data management ensures data quality, achievable through adequate reference and master data management and the establishment of the appropriate data architecture while further addressing data security requirements to protect data throughout its life cycle. Data governance within IoT must provide security measures to protect data throughout the architectural layers, from application to network layer and within the device itself (Henriques et al., 2020). Therefore, it is essential to consider data governance when using IoT devices and IT governance over the devices to ensure that data will be safeguarded and should occur throughout each layer of the IoT architecture for a comprehensive risk assessment as risks pertaining to IoT may present themselves differently at different layers within the architecture.

Ethical considerations

Ethical approval to conduct this study was obtained from the Stellenbosch University Research Ethics Committee: Social, Behavioural and Education Research (REC: SBE) (No. ACC-2023-27501).

Results and discussions

Data risks associated with Internet of Things in the healthcare industry

Internet of Things has many benefits in the healthcare industry but can pose some challenges particularly in respect of data security, privacy and confidentiality (Chang et al., 2009; De Muylder et al., 2019; Van Niekerk & Rudman, 2019; Zakaria et al., 2019). This could be attributed to a lack of security in design and a lack of organisational knowledge to fully understand the depth and types of risks and challenges before implementation (Trautman et al., 2020; Van Niekerk & Rudman, 2019). After consideration of available research, it was noted that the most relevant challenges surrounding IoT are with respect to physical device vulnerability, insecure communication channels, an increased vulnerability surface area and limited computing power of devices (Ko et al., 2018; Van Niekerk & Rudman, 2019). These challenges are specific to IoT and highlight significant challenges within the healthcare sector and must be addressed to ensure sound data governance; and in doing so, it will contribute towards sound corporate governance. Many of the risks identified already exist in the Internet but when combined with enabling technologies in an IoT environment, new risks emerge. These risks are discussed in the following subsections.

Data security

Health Insurance Portability and Accountability Act defines data security as the protection against unauthorised use, disclosure, access, alteration, disruption and destruction of data, information and information systems using administrative, technical and physical controls (United States, 1996). Data security is thus implemented to provide privacy, confidentiality and availability of data and information (Kahn & Sheshadri, 2008). Threats to data security are discussed as follows:

Authenticity

Authenticity ensures the validity of data being transferred and presented by IoT devices to ensure that it is a true presentation of an actual live event and ensures that the data are collected in real time (Matin & Islam, 2012). The authenticity of IoT devices and the data they collect are exposed to impersonation, which are techniques used to gain access to an IoT device, a network and IoT data by fabricating authenticated identities. These types of attacks are highly effective in an IoT environment and can result in insecure data transmissions and unauthorised access which can compromise data security (Wan et al., 2021). Appendix 1 provides detailed examples of various impersonation attacks perpetrated within an IoT environment.

Furthermore, architectural deficiencies within IoT that impact authenticity are a lack of policies and user guidelines. Inadequate policies and guidelines available for the use of IoT devices to ensure protection and security over data can lead to unauthorised access to devices (Brous et al., 2020). Moreover, weak authentication can lead to IoT devices that often lack the ability to support password concealment, user authentication systems and logical access controls (including least-privileged principles) leaving devices unprotected against unauthorised access to sensitive data (Boeckl et al., 2019). The abovementioned threats not only compromise authentication but also pose a threat to access controls, further emphasising the need for authentication mechanisms within IoT environments in healthcare.

Unauthorised access

Unauthorised access refers to the viewing of and accessibility to data, information and resources by those who do not have permission from the owner to view or access the data and information. According to Rezaeibagha et al. (2015), the most common weaknesses are in relation to network connectivity, authentication methods and access controls. These weaknesses are concentrated around the device, device software and the network layer, middle layer and application layer within IoT architecture. Some threats such as data loss occur throughout the architectural layers.

Threats that impact the device such as user compromise occur because of the theft of cryptographic keys or passwords resulting in unauthorised access to the device or network leading to data transmission interruptions and alterations (Blanke & McGrady, 2016; Islam et al., 2015). Internet of Things devices may fail to shut down after unsuccessful login attempts resulting in unauthorised access (Boeckl et al., 2019), while reverse engineering can exploit device vulnerabilities to gain unauthorised access (Liang & Kim, 2021). In addition, attackers may target device software; for example during a user to root (U2R) attack, access is gained to the system as a normal account and allows for data manipulation, spying and system disruptions impacting data transmissions (Abdullahi et al., 2022). Moreover, illegal packets sent to the system to exploit system privileges to gain access can be perpetrated through remote to local user (R2L) attacks including worm attacks (Abdullahi et al., 2022). Lastly, exploitation of medical imaging techniques by injection or removal of false data and medical imagery known as a computed tomography-generative adversarial network (CT-GAN) technique may lead to incorrect diagnostics (Affia et al., 2023).

Threats situated within the network layer of IoT architecture range from exploitation of weaknesses within IoT, node collusion and cloning, traffic classification errors and various malicious injections into the database known as SPARQL Protocol and RDF Query Language (SPARQL) and code and database injections including account hacking threats and message tampering that may lead to unauthorised access. These risks are explained in detail in Appendix 1.

Threats within the middle layer of the IoT architecture (including both fog and cloud computing) occur through incorrect bootstrapping when nodes are incorrectly authenticated, leaving the network open to unauthorised access via these nodes (Nebbione & Calzarossa, 2020). And more commonly, cloud server breaches that usually occur when cloud service providers do not hold security in as high a regard as the medical organisation making use of their services resulting in a gap in security that can result in data breaches (Abraham et al., 2019a; Vilakazi & Adebesin, 2023).

Another risk is a poorly skilled service provider. Cloud service providers may hire insufficiently skilled employees who lack the required knowledge regarding the identification and mitigation of risks associated with IoT (Ashktorab & Taghizadeh, 2012). Lastly, an untrusted cloud server may result in insecurity and privacy risks that can occur as data may not be stored correctly in the cloud server and can be deleted or altered (Sang et al., 2023).

Within the application layer, threats such as insecure Application Programming Interfaces (APIs) occur creating an opportunity for unauthorised access to sensitive data resulting in data destruction or unauthorised modification as APIs are used for users to interact with cloud services (e.g. data retrieval) (Ashktorab & Taghizadeh, 2012).

Furthermore, Wi-Fi-based attacks can occur when a ciphering stream is compromised, allowing for the recovery of keys to gain access to data (Khan et al., 2023). Another risk at this layer is a cross-site scripting (XSS) attacks that occur when malicious scripts are injected into the Web whereby malicious code is stored into the resource managed by a web application on a permanent basis or where attack scripts are immediately reflected back to the user without permanent storage. This can result in data alteration and unauthorised access (Ashktorab & Taghizadeh, 2012). Finally, at this layer, a web attack can also take place when intruders use generally trusted websites and web applications infused with malicious content to gain access to sensitive information, for example brute force attack (Manimurugan et al., 2020; Wheelus & Zhu, 2020).

On the other hand, data loss occurs that can occur at any layer of the IoT architecture when data are altered, deleted or destroyed (thus making it unrecoverable) before a back-up copy can be made posing as a risk to data and by extension data privacy and confidentiality (Ashktorab & Taghizadeh, 2012). Examples of these types of risk that arise from data loss are discussed in detail in Appendix 1.

Network availability

According to HIPAA, availability refers to data and information being accessible and usable on demand by authorised individuals (United States, 1996). Network availability is under threat from attacks that aim to compromise or disable the network leading to unauthorised access that can result in alteration, destruction and unauthorised disclosure of sensitive information. Several attacks that impact network availability are discussed in more detail as follows:

• Jamming attacks: Occurs when there is interference with the frequency that the sensor nodes use and can disrupt the entire network or parts thereof leading to incomplete data transmissions (Van Niekerk & Rudman, 2019; Vilakazi & Adebesin, 2023; Wang & Wyglinski, 2011).
• Selective forwarding: Using malicious nodes placed in the network that selectively only forward and drop certain data, compromising security of data (Thamilarasu et al., 2020; Van Niekerk & Rudman, 2019; Vilakazi & Adebesin, 2023).
• Probe attack: Data are obtained based on target external network sources (e.g. IPsweep or Portsweep), facilitating attacks within a peer network (Abdullahi et al., 2022).
• Network properties attack: This is conducted through a standard protocol compromise where the attacker deviates from standard network or application protocols behaving maliciously or via a network protocol attack where the attacker exploits vulnerabilities in protocol stack layers committing malicious acts (Islam et al., 2015).
• Flooding: A reactive approach where a node that received data or control packets sends data to all other nodes in the network, replicating packets, causing network overload for example, Hello flood attack (Matin & Islam, 2012; Vilakazi & Adebesin, 2023).
• Routing loop attack: This results in false error messages that are generated when the attacker modifies and replays routing information, attracting and repelling network traffic and increasing node latency (Matin & Islam, 2012).
• Botnet attacks: By the use of malware, embedded sensors are overtaken by an external botnet master that takes control of the device, posing a threat to network security (Ko et al., 2018; Liang & Kim, 2021; Vilakazi & Adebesin, 2023; Yin et al., 2019).
• Remote code execution: Using injections, malicious input is designed to look like a command in the form of an arbitrary code, creating a pathway for unauthorised access to internal networks, thereby accessing data while the device is in operation (Agarwal et al., 2019).
• Portscan attack: IoT device data (e.g. the type of operating system and the services running) are collected by forwarding packets that have different destination points that can lead to device exploitation (Manimurugan et al., 2020).
• Relay attack: A connection is established between a legitimate reader and the target’s legitimate tag making communication look like the legitimate tag and reader are in close proximity when in reality they are communicating through a wireless communication channel created by the attacker (Rotter, 2008).
• Interference within the network can impact data communication between IoT layers and affect network availability. In many instances, this interference is used to gain unauthorised access to the network where several attacks can be launched that pose as a risk to data security and will result in weaknesses in internal controls. Types of threats that create interference in the network are discussed in Appendix 1.

Data security planning

Data security planning is essential for safeguarding medical IoT data and involves identifying threats and creating, maintaining and supporting an active security culture (Abraham et al., 2019a). A lack of sufficient data security planning results in a lack of organisational security strategy when there is no well-thought-out security strategy, resulting in unmaintained operating systems leading to unauthorised access. Added to this, medical organisations often do not develop adequate policies and regulations resulting in no policies and guidelines to direct protection of healthcare data extending from data collection to destruction (Brous et al., 2020). This includes inadequate policies and guidelines for decommissioned IoT devices leaving old devices with sensitive data vulnerable to exploitation (Yousefnezhad et al., 2020).

In addition, deficiencies in organisational security management strategy result in a lack of risk assessment in IoT device design leading to security vulnerabilities that can be exploited (Chacko & Hayajneh, 2018). Lastly, there seems to be a lack of an appointed security official required by HIPAA resulting in non-compliance with HIPAA and results in control weaknesses as there is not an individual designated to oversee data security (United States, 1996).

Architecturally, IoT may lack certain features and functions for the implementation of data security planning. Key missing features and functions are a lack of security audit ability within devices resulting in the inability to record all security events of the organisations (Boeckl et al., 2019; Kamal et al., 2023). Internet of Things devices often have a black box effect where little or no information regarding the device’s hardware or software can be established making device management challenging and hinder data protection capabilities (Boeckl et al., 2019). Moreover, devices often have limited upgradability because IoT device manufacturers may not release any upgrades for the IoT devices making it harder for an organisation to implement device security to protect patient data (Boeckl et al., 2019). Lastly, incompatibility with existing vulnerability scan systems used to monitor and identify malicious incidents resulting in unidentified malicious activity (Boeckl et al., 2019).

When unauthorised parties gain access to data because of, for example, a lack of data security, it can bring about attacks such as man-in-the-middle attacks. As discussed earlier, unauthorised access also impacts authenticity negatively; all of which can be seen as a symptom of a lack in data security planning. Furthermore, a lack in data security can result in unwanted attacks that can compromise data privacy and confidentiality; thus data security is a fundamental aspect in achieving data privacy and confidentiality.

Data privacy and confidentiality

Privacy can be considered to be the limitation of access to the personal information of the individual to whom the information pertains (United States, 1996). Privacy limits access to personal information, whereas confidentiality ensures data remain unaltered and inaccessible to unauthorised parties (United States, 1996; Liu et al., 2012). Unauthorised access can be gained through monitoring data over the network and monitoring network performance that can compromise the privacy and confidentiality of medical data. This can be a hinderance to data governance and by extension corporate governance that may leave the entity exposed to risk. Unauthorised access can be facilitated through eavesdropping that allows for the monitoring of network data with no signal emission (Islam et al., 2015; Selvan & Singh, 2022; Thamilarasu et al., 2020; Van Niekerk & Rudman, 2019). And data sniffing that allows for the capturing and interpretation of data transmissions using flaws in network security protocols (Liang & Kim, 2021; Sicari et al., 2018; Van Niekerk & Rudman, 2019). Furthermore, the IoT architecture may lack certain features that promote privacy and confidentiality. These several features are briefly discussed in Appendix 1.

Threats such as internal attacks, social engineering, phishing, man-in-the-middle attacks, data alteration, U2R attacks, RFID cloning and sleep deprivation attacks can occur including threats pertaining to authentication, unauthorised access and network availability such as the lack of policies and user guidelines for IoT, collusion attacks, incorrect bootstrapping, crypt analysis attack, cloud server breaches, untrusted cloud servers and remote code execution that impact data security will also pose a threat to data privacy and confidentiality.

Conclusion

Using IoT in the healthcare environment presents challenges because of its continuous connectivity requirements and multiple entry points. Limited security awareness and knowledge of emerging technologies within healthcare increases these challenges (Ngqondi & Pottas, 2009; Samy et al., 2009). While general IoT-related risks have been identified in existing research, there was a weakness in studies that link risks relating to IoT and IoT data to an IT and data governance framework tailored for the healthcare sector. Organisations often follow a disjointed approach to the governance and management of the technology and data, by extension resulting in a haphazard attempt at corporate governance. The use of a framework to identify the risks ensures a comprehensive risk identification framework is developed to address data and IT governance concerns while also addressing corporate governance concerns in the process.

This research aimed to develop a risk-technology-based matrix using COBIT 2019 and Section 164 of HIPAA to identify IoT-related risks with respect to medical IoT devices. The risk-technology matrix produced in this research, represented in Appendix 2, can assist enterprises in implementing detailed controls that focus on their unique risk exposure and could also be used as a starting point to mitigate these risks to an acceptable level. The framework was developed to identify risk areas relating to risks to data security that consisted of risks that affected authenticity, secure access, network availability and security planning related to IoT data, which were compromised by threats involving fabricated identification of devices perpetrated by Sybil attacks, spoofing, data combination, cookie poisoning, global positioning system (GPS) deception and poisoning mainly aiming at compromising the network or gaining unauthorised access to the network or data by various means A lack of policies and user guidelines pertaining to IoT including a lack of authentication mechanisms within IoT leading to architectural deficiencies also created a further platform for the above risks to exist within this technology.

The risk of unauthorised access gained through a barrage of attacks throughout the architectural layers ranging from crypt analysis attacks to man-in-the-middle attacks, data alteration, U2R and R2L, among others, further contributed to areas of weakness when considering IoT in this field while network availability was compromised by threats withing the network layer of the architecture such as jamming, network properties attack, desynchronisation, probe attacks, storage attacks, on-off attack, flooding, routing loop attack, sleep deprivation, botnet attacks, remote code execution, portscan, radio frequency interference, relay attack and RFID tag limitations. Lastly, data security planning was impacted by a lack of organisational security strategy, risk assessment and sufficient user policies that contributed towards creating a space for the abovementioned threats to take hold, which hinders data and IT governance. These risks to data security created a platform for further risks towards data privacy and confidentiality.

Privacy and confidentiality breaches occurred because of unauthorised access gained by way of eavesdropping and data sniffing attacks while the IoT architecture lacked several features contributing to risks to privacy and confidentiality such as physical device tampering, a lack of privacy mechanisms and a lack of digital footprint privacy, a lack of encryption, a lack of device verification, data ownership ambiguity amplified by cross-border data transfers. Many of these risks result in deficiencies in technical design of IoT while others are because of the changing landscape of data transmission on account of the Fourth Industrial Revolution. Furthermore, other risks affecting data security also created a risk for privacy and confidentiality such as remote code executions, untrusted cloud server, incorrect bootstrapping, U2R, data combination, wireless probing, internal attacks and other attacks such as social engineering and phishing, which extend across the architectural layers of IoT.

Governance stakeholders (including IT specialists) must understand IoT architecture and access paths including the IoT data life cycle to timeously identify and mitigate risks. As healthcare is still in its early stages, a proactive approach to risk management is essential for successful deployment and may contribute towards promoting sustainability when implementing IoT and lead to successful business management within medical organisations.

While this research did not discuss the technical study of the design, development or programming of IoT, it would be beneficial to conduct further studies looking into the technicalities of IoT development, design and programming to assess whether any governance elements are considered upon the design of the technology. Future research could focus on developing controls to mitigate identified risks and address the ownership and control over IoT data.

Acknowledgements

The authors declare that they have no financial or personal relationships that may have inappropriately influenced them in writing this article.

N.K. and R.J.R. equally contributed to the research and writing of this article.

This research received no specific grant from any funding agency in the public, commercial or not-for-profit sectors.

The data that support the findings of this study are available from the corresponding author, N.K. upon reasonable request.

The views and opinions expressed in this article are those of the authors and are the product of professional research. The article does not necessarily reflect the official policy or position of any affiliated institution, funder, agency or that of the publisher. The authors are responsible for this article’s results, findings and content.

References

Appendix 1

Appendix 2