BT12 Practical cybersecurity considerations for dermatology professionals

Abstract Cybersecurity is a global industry that, according to Fortune Business Insights, was worth USD 633 billion in 2024; 17% of this was made up of healthcare cybersecurity. Healthcare has a unique set of cybersecurity risks, with telehealth and teledermatology among the highest-risk areas. Extensive resources are already freely available aiming to combat this issue but their scope is far too small. They primarily look to reduce a hacker’s ability to exploit system vulnerabilities but overlook the potential risk that clinical photography poses to cybersecurity. A literature review of the current guidance was conducted on the use of telehealth and teledermatology. This was carried out using PubMed, Cochrane, Google Scholar and reviews of guidelines from bodies such as the National Health Service and the National Cyber Security Centre (NCSC). Following analysis, a concept map was created, from which an evidence-based cybersecurity framework on the use of telehealth was created. Clinical imaging is frequently used in teledermatology. In particular, the National Health Service is now approving the use of apps such as Pando, which clinicians can install on their personal devices. In addition to this, the use of biometrics as security measures is becoming increasingly common, with the use of fingerprint, retinal and facial recognition being the most widespread. This provides a unique set of cybersecurity issues, as these body parts are regularly photographed and recorded on healthcare systems alongside other identifying personal information. This creates the potential risk that they could be used to reconstruct a person’s features, bypassing biometric security procedures. The World Health Organization–International Telecommunication Union and NCSC have detailed guidelines and advice on improving public sector healthcare cybersecurity. In particular they have very detailed guidance on the use of encryption and programs such as Datagram Transport Data Layer security to reinforce the levels of data security. However, both appear to have very limited guidance on reducing the risk of biometric data being misused from sources such as clinical photography, which is very prevalent in teledermatology. Much of this risk could be eliminated by carefully considering how much of the face, hands or eyes are captured in an image and minimizing unnecessary detail, while including sufficient detail for proper diagnosis. Therefore, more guidance needs to be developed, providing healthcare professionals with advice on reducing the biometric data risk. This requires not only technical security measures, but also the removal of nonclinically relevant details from images being stored.