Cybersecurity Medical IT Risk Assessor

At Bon Secours Mercy Health, we are dedicated to continually improving health care quality, safety and cost effectiveness. Our hospitals, care sites and clinicians are recognized for clinical and operational excellence.Summary of Primary Function/General Purpose of Position

• Plans and executes the Medical Device Risk Management Process and Risk Assessment process when incorporating medical devices onto the Medical IT-Network.
• Contributes to the execution of the Medical Device Risk Management Process and Risk Assessment process when incorporating medical devices and supporting applications onto the Medical IT Network
• Informs key Medical Device stakeholders (e.g., Clinical Engineering, Supply Chain, medical device manufacturers, risk management personnel, other suppliers of IT software, services, or infrastructure, facilities management, clinical users, and technical support.)
• Coordinates with the Clinical Engineering team and Information Services team to track and remediate medical device information security risk, updates to the Computerized Maintenance Management System (CMMS) and identify medical devices that require risk assessments.
• Ensures that software and hardware risk control measures within medical devices are successfully implemented.
• Maintains documentation obtained from Medical Device Manufacturers (e.g., MDS2 forms, technical documentation, configuration documentation, etc.), providers of other information technology, and other risk management related documentation (e.g., Security Assessment Results, Security Risk Acceptance Decisions, etc.) in the Medical IT-Network Risk Management File.
• Stays up to date with relevant federal (FDA), international (ISO-80001), national, and state regulations and industry guidance around medical IT-networks and medical devices
• Uses cybersecurity risk evaluation tools to help reduce organizational cyber risk with medical devices
• Participates in Cybersecurity Risk Governance process to provide medical device security risks, mitigations and input on other technical risks.
• Drafts and provides input into the Cybersecurity Risk Management Framework process activities and related documentation pertaining to Medical Device and Biomedical/Clinical Engineering.
• Identifies opportunities to improve processes and procedures to document the execution of the analysis and assessments of Medical Devices.
• Supports the development of key performance indicators and reporting key metrics to leadership in a timely manner.
• Contributes to other Cybersecurity Risk and Assurance programs and functions as needed.
• Conducts Assessments and monitoring to identify and analyze risk exposure to include those relevant to medical IT laws, regulations, and industry cybersecurity standards.
• Assists with the development, recommendation, and implementation of action plans and strategies for addressing medical device IT liability, operational and medical device risks.
• Analyzes and tracks follow up communications to ensure risks are remediated appropriately.
• Prepares timely management reports and metrics for presentation to leadership.