Difference between revisions of "User:Shawndouglas/sandbox/sublevel1"

From LIMSWiki
Jump to navigationJump to search
Line 1: Line 1:
'''Base features'''
From law firms<ref name="SobowaleLaw17">{{cite web |url=http://www.abajournal.com/magazine/article/managing_cybersecurity_risk/ |title=Law firms must manage cybersecurity risks |author=Sobowale, J. |work=ABA Journal |publisher=American Bar Association |date=01 March 2017 |accessdate=18 November 2021}}</ref> to automotive manufacturers<ref name="WatneyAddress17">{{cite web |url=https://www.rstreet.org/wp-content/uploads/2018/04/118-1.pdf |format=PDF |title=Addressing new challenges in automotive cybersecurity |author=Watney, C.; Draffin, C. |work=R Street Policy Study No. 118 |publisher=R Street Institute |date=November 2017 |accessdate=18 November 2021}}</ref>, the need to address cybersecurity is increasingly apparent. In 2018, the Center for Strategic & International Studies estimated that cybercrime causes close to $600 billion in damages to the global economy every year<ref name="LewisEcon18">{{cite web |url=https://www.csis.org/analysis/economic-impact-cybercrime |title=Economic Impact of Cybercrime |author=Lewis, J.A. |publisher=Center for Strategic & International Studies |date=21 February 2018 |accessdate=18 November 2021}}</ref>, though due to underreporting of crimes, that number may be much higher. That number also likely doesn't take into account lost business, fines, litigation, and intangible losses<ref name="SBDCC_BlogCost17">{{cite web |url=https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/ |archiveurl=https://web.archive.org/web/20200705061737/https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/ |title=BLOG: Cost of Cyber Crime to Small Businesses |work=Virginia SBDC Blog |publisher=Virginia SBDC |date=30 May 2017 |archivedate=05 July 2020 |accessdate=18 November 2021}}</ref> In the end, businesses of all sizes average about $200,000 in losses due to a cybersecurity incident<ref name="HiscoxHiscox19&quot;">{{cite web |url=https://www.hiscox.com/documents/2019-Hiscox-Cyber-Readiness-Report.pdf |format=PDF |title=Hiscox Cyber Readiness Report 2019 |publisher=Hiscox Ltd |date=April 2019 |accessdate=18 November 2021}}</ref>, and nearly 60 percent of small and midsize businesses go bankrupt within six months because of it.<ref name="Galvin60_18">{{cite web |url=https://www.inc.com/joe-galvin/60-percent-of-small-businesses-fold-within-6-months-of-a-cyber-attack-heres-how-to-protect-yourself.html |title=60 Percent of Small Businesses Fold Within 6 Months of a Cyber Attack. Here's How to Protect Yourself |author=Galvin, J. |work=Inc.com |date=07 May 2018 |accessdate=18 November 2021}}</ref>


A LIS or LIMS can have an extravagant list of features, or it may have minimal functionality. Software developers with competent and experienced personnel usually do well with a collection of the required base features, plus any industry-specific features a laboratory may need. But not all developers get it right.
Medical diagnostic and research laboratories are no exception, regardless of business size. Even tiny labs whose primary digital footprint is a WordPress website advertising their lab are at risk, as hackers could still spread malware, steal user data, add the website to a bot network, hack the site for the learning experience, or even hack it just for fun.<ref name="GrimaTop19">{{cite web |url=https://www.wpwhitesecurity.com/why-malicious-hacker-target-wordpress/ |title=Top reasons why WordPress websites get hacked (and how you can stop it) |author=Grima, M. |publisher=WP White Security |date=14 November 2019 |accessdate=18 November 2021}}</ref><ref name="MoenWhatHack16">{{cite web |url=https://www.wordfence.com/blog/2016/04/hackers-compromised-wordpress-sites/ |title=What Hackers Do With Compromised WordPress Sites |author=Moen, D. |work=Wordfence Blog |publisher=Defiant, Inc |date=19 April 2016 |accessdate=18 November 2021}}</ref><ref name="TalalevWebsite19">{{cite web |url=https://patchstack.com/website-hacking-statistics/ |title=Website Hacking Statistics You Should Know in 2021 |author=Talaleve, A. |publisher=Patchstack |date=22 February 2021 |accessdate=18 November 2021}}</ref> Even more importantly are those labs performing digital data management tasks that handle sensitive patient and proprietary data, requiring additional cybersecurity considerations.


What follows is a list of system functionality that is considered by a variety of experts to be vital to almost any medical diagnostic or research laboratory.<ref name="APHLLab19">{{cite web |url=https://www.aphl.org/aboutAPHL/publications/Documents/GH-2019May-LIS-Guidebook-web.pdf |format=PDF |title=Laboratory Information Systems Project Management: A Guidebook for International Implementations |author=Association of Public Health Laboratories |publisher=APHL |date=May 2019 |accessdate=18 November 2021}}</ref><ref name="KyobeSelecting17">{{cite journal |title=Selecting a Laboratory Information Management System for Biorepositories in Low- and Middle-Income Countries: The H3Africa Experience and Lessons Learned |journal=Biopreservation and Biobanking |author=Kyobe, S.; Musinguzi, H.; Lwanga, N. et al. |volume=15 |issue=2 |pages=111–15 |year=2017 |doi=10.1089/bio.2017.0006 |pmc=PMC5397240}}</ref><ref name="ListEffic14">{{cite journal |title=Efficient sample tracking with OpenLabFramework |journal=Scientific Reports |author=List, M.; Schmidt, S.; Trojnar, J. et al. |volume=4 |pages=4278 |year=2014 |doi=10.1038/srep04278 |pmid=24589879 |pmc=PMC3940979}}</ref><ref name="APILISTool13">{{cite web |url=https://www.pathologyinformatics.org/toolkit.php |title=LIS Functionality Assessment Toolkit |author=Splitz, A.R.; Balis, U.J.; Friedman, B.A. et al. |publisher=Association for Pathology Informatics |date=20 September 2013 |accessdate=18 November 2021}}</ref> Without this functionality, end users may at best grumble about additional workloads or more complicated procedures, and at worse be setting themselves up for major liability issues by not complying with regulations. Arguably, a few items such as mobile device support, voice recognition, and multilingual support may be negotiable, but if the system you are evaluating doesn't contain most of the below bullet-pointed functionality, you may want to look elsewhere.
A laboratory can integrate cybersecurity thinking into its laboratory informatics product selection in several ways. First, the lab should have a cybersecurity plan in place, or if not, it should be on the radar. This is a good resource to tap into in regards to deciding what cybersecurity considerations should be made for the software. Can the software help your lab meet your cybersecurity goals? What regulatory requirements for your lab are or are not covered by the software?<ref name="DouglasComp20">{{cite web |title=[[LII:Comprehensive Guide to Developing and Implementing a Cybersecurity Plan|''Comprehensive Guide to Developing and Implementing a Cybersecurity Plan'']] |author=Douglas, S.E. |work=LIMSwiki |date=July 2020 |accessdate=18 November 2021}}</ref> Another tool to consider—which may have been used in any prior cybersecurity planning efforts—is a cybersecurity framework. Many, but not all, cybersecurity frameworks include a catalog of security controls. Each control is "a safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information and to meet a set of defined security requirements."<ref name="NISTSecurity19">{{cite web |url=https://csrc.nist.gov/glossary/term/security_control |title=security control |work=Computer Security Resource Center |publisher=National Institute of Standards and Technology |date=2019 |accessdate=18 November 2021}}</ref> These controls give the implementing organization a concrete set of configurable goals to apply to their overall cybersecurity strategy. Other frameworks may be less oriented to security controls and more program-based or risk-based. Choosing the best frameworks will likely depend on multiple factors, including the organization's industry type, the amount of technical expertise within the organization, the budget, the organizational goals, the amount of buy-in from key organizational stakeholders, and those stakeholders' preferred approach.<ref name="DouglasComp20" />
 
 
'''''Test, experiment, and patient management'''''
 
*specimen log-in and management, with support for unique IDs
*batching support
*barcode and RFID support
*specimen tracking
*clinical decision support, including test ordering tools and duplicate test checks
*custom test management
*event and instrument scheduling
*templates, forms, and data fields that are configurable
*analytical tools, including data visualization, trend analysis, and data mining features
*data import and export
*robust query tools
*document and image management
*project and experiment management
*workflow management
*patient management
*case management
*physician and supplier management
 
 
'''''Quality, security, and compliance'''''
 
*quality assurance / quality control mechanisms, including tracking of nonconformance
*data normalization and validation
*results review and approval
*version control
*user qualification, performance, and training management
*audit trails and chain of custody support
*configurable and granular role-based security
*configurable system access and use (log-in requirements, account usage rules, account locking, etc.)
*electronic signature support
*configurable alarms and alerts
*data encryption and secure communication protocols
*data archiving and retention support
*configurable data backups
*environmental monitoring and control
 
 
'''''Operations management and reporting'''''
 
*customizable rich-text reporting, with multiple supported output formats
*synoptic reporting
*industry-compliant labeling
*email integration
*internal messaging system
*revenue management
*instrument interfacing and data management
*instrument calibration and maintenance tracking
*inventory and reagent management
*third-party software and database interfacing
*mobile device support
*voice recognition capability
*results portal for external parties
*integrated (or online) system help
*configurable language
 
 
'''Specialty-specific functionality'''
 
In the following subsections, the subcategories of labs we looked at in the prior chapter are reviewed, specifically for functionality critical to their specialty. This functionality is supported by four to five citations from vendors and other academic sources.
 
 
'''''Anatomical and clinical pathology lab'''''<ref name="LabWareAnatomic20">{{cite web |url=https://www.labware.com/industries/healthcare#anatomic |title=Anatomic Pathology |publisher=LabWare, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="SunquestCoPath20">{{cite web |url=https://www.sunquestinfo.com/software-and-services/copathplus/ |title=Sunquest CoPathPlus |publisher=Sunquest Information Systems, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="NovoPathHome20">{{cite web |url=https://www.novopath.com/ |title=NovoPath: Redefining Laboratory Information Systems |publisher=NovoPath, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="TDMS_TDHistoCyto20">{{cite web |url=https://www.technidata-web.com/en-gb/solutions-services/solutions/histopathology |title=TD HistoCyto |publisher=Technidata SAS |date=2021 |accessdate=18 November 2021}}</ref>:
 
*configure the system using templates for histology and cytology case types
*add, view, and link pre-generated organ maps and other diagrams
*add, view, and link custom annotated pathology imaging
*track abnormal results and provide trending reports for monitoring disease populations
*support blocks and slides as specimens, with predefined descriptions
*document grossing examinations
*print slides and cassettes
*provide case management, reporting, and test requisition
*provide specialty workflow for autopsy
*provide specialty workflow for gynecological cytology, including HPV + Pap co-testing for cervical cancer
*provide stain panels and histology worksheets
*support shared management of tissue samples among departments
*support EHR integration
*support polymerase chain reaction (PCR) workflow and reporting
*support pathology-specific reflex testing
*provide option to combine same-day anatomical and clinical pathology results and reporting
*flag unusual cases for conference or committee reporting
 
 
[[File:Harsh Vardhan at the inaugural ceremony of the new campus of Centre for DNA Fingerprinting and Diagnostics (CDFD), in Hyderabad.JPG|right|350px]]'''Forensic pathology lab'''<ref name="AbbotStarlimsForensic20">{{cite web |url=https://www.starlims.com/us/en/industries/forensics |title=Starlims Forensic LIMS |publisher=Abbot |date=2021 |accessdate=18 November 2021}}</ref><ref name="LabLynxForensics20">{{cite web |url=https://www.lablynx.com/forensics/ |title=Forensics & Medical Examiner |publisher=LabLynx, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="ThermoFisherLIMSForens20">{{cite web |url=https://www.thermofisher.com/order/catalog/product/INF-12000-FORENSIC#/INF-12000-FORENSIC |archiveurl=https://web.archive.org/web/20171212065803/https://www.thermofisher.com/order/catalog/product/INF-12000-FORENSIC |title=LIMS Solution for Forensics |publisher=Thermo Fisher Scientific |date=2017 |archivedate=12 December 2017 |accessdate=18 November 2021}}</ref><ref name="PorterLeeLab20">{{cite web |url=http://www.porterlee.com/lims.html |title=Laboratory Information Management System |publisher=Porter Lee Corporation |date=2021 |accessdate=18 November 2021}}</ref>:
 
*support pre-logging of evidence
*allow full documentation of a crime scene
*track storage, movement, and disposal of evidence and property using an ASTM-compliant log
*manage chain-of-custody transfers of evidence and samples
*provide quarantine protocol for samples and evidence
*provide forensic case management, including case status and court testimony
*manage agency interactions and information
*add, view, and link forensic imaging into case files
*manage field scheduling for fingerprinting, homicide casing, and lab work
*provide custom reporting for toxicology and controlled substance analyses
*provide support for DNA profile management
*provide support for convicted offender and other database integration
*support the use of personal identity verification and other forms of hardware-based (i.e., public key infrastructure or PKI) token authentication
 
 
'''''Physician office lab''''':
 
The [[physician office laboratory]] (POL) is arguably a simpler version of the medical diagnostics lab, often depending on CLIA-waived and CLIA-certified point-of-care instruments for making diagnoses. As such, the data management requirements for a POL are typically not as significant as those of a large-scale diagnostic laboratory. That said, a POL employing laboratory informatics will still need much of the same base functionality mentioned prior, and the system will still need to comply with data management and sharing regulations such as those found with HIPAA and CLIA.
 
Any POL performing sufficient volumes of testing to benefit from using a laboratory informatics solution may also want to consider the costs and drawbacks, if any, of interfacing to their EHR system, if they have one. In a case where the POL is in a position to consider both an LIS and an EHR at the same time, they should examine the features and potential integration of those products, and they should be sure to consider any future potential of integrating their systems with other external data management systems, including another reference laboratory.
 
In some cases, an EHR with some laboratory management functionality may make a solid alternative. If considering an EHR that includes some LIS functionality, be sure to clearly identify the functional requirements and demo the system thoroughly to ensure test and reporting workflows make sense. Finally, in cases where POL test volumes are low—coming from only one or a few instruments—and an LIS is not required, POL operators may want to simply consider a [[middleware]] option that smoothly facilitates the flow of instrument data to the EHR.
 
 
'''''Integrative medicine lab''''':
 
If an integrative medicine laboratory is using a laboratory informatics solution, their requirements will be nearly identical to a standard medical diagnostic laboratory, meaning the base functionality mentioned prior will likely be suitable. If there is a major difference or required piece of additional functionality, it will have to do with a more extensive list of available tests and billing codes for them. This usually consists of expansions into nutritional, metabolic, and toxicity test types, as well as support for diagnostic imaging.<ref name="BralleyBasic">{{cite book |url=https://books.google.com/books?id=CpXVAwgOv7sC&pg=PT11 |chapter=Chapter 1: Basic Concepts |title=Laboratory Evaluations for Integrative and Functional Medicine |author=Bralley, J.A.; Lord, R.S. |publisher=MetaMetrix Institute |edition=2nd |pages=1–16 |year=2008 |isbn=0967394945}}</ref>
 
 
'''''Public health lab'''''<ref name="APHLLab19" /><ref name="LabWarePublic20">{{cite web |url=https://www.labware.com/industries/healthcare#publichealth |title=Public Health |publisher=LabWare, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="OrchardPublic20">{{cite web |url=https://www.orchardsoft.com/solutions/public-health-labs/ |title=Public Health Laboratories |publisher=Orchard Software Corporation |date=2021 |accessdate=18 November 2021}}</ref><ref name="CommonCentsApollo20">{{cite web |url=https://www.apollolims.com/lab-expertise/public-health/ |title=ApolloLIMS for Public Health Labs |publisher=Common Cents Systems, Inc |date=2021 |accessdate=18 November 2021}}</ref>:
 
*provide specialty workflow for newborn screening
*provide surge capacity for high-priority analyses
*provide workflow and tools for managing microorganisms and toxins of elevated risk
*support most medical test protocols and specimen types
*support ELISA, DNA extraction, sequencing, and other molecular workflows
*support for a robust set of decision support rules for reflex testing
*support the Centers for Disease Control and Prevention's PHIN Messaging System
*support other electronic data exchange standards for critical community partners
 
 
'''''Toxicology lab'''''<ref name="APEasyFeatures20">{{cite web |url=https://easytoxicology.com/features/ |archiveurl=https://web.archive.org/web/20201028074209/https://easytoxicology.com/features/ |title=Easytox: Features |publisher=AP Easy Software Solutions |date=2020 |archivedate=28 October 2020 |accessdate=18 November 2021}}</ref><ref name="DataUnlimitedLIMSSol20">{{cite web |url=http://www.duii.com/products/starfruit-toxicology/ |title=Starfruit Toxicology |publisher=Data Unlimited International, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="LabLynxToxicology20">{{cite web |url=https://lablynx.com/toxicology/ |title=Toxicology LIMS |publisher=LabLynx, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="DTPMOnlineData20">{{cite web |url=https://www.dtpm.com/online-data-management/ |title=Online Data Management |publisher=DTPM, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="OrchardPain20">{{cite web |url=https://www.orchardsoft.com/solutions/pain-management-toxicology-labs/ |title=Pain Management & Toxicology Labs |publisher=Orchard Software Corporation |date=2021 |accessdate=18 November 2021}}</ref>:
 
*support customizable drug panels and tests
*support reference lab activities
*track prescribed medicines and associated history
*provide management for compounds and compound grouping
*provide medication-based compliance monitoring and interpretive reporting on it
*provide decision-support rules for pain management and toxicology
*provide toxicology-specific reporting formats
*manage drug court cases associated with testing
 
 
'''''Blood bank and transfusion lab'''''<ref name="SunquestBloodBank20">{{cite web |url=https://www.sunquestinfo.com/software-and-services/blood-bank-management/ |title=Sunquest Blood Bank |publisher=Sunquest Information Systems, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="SCCBlood20">{{cite web |url=https://www.softcomputer.com/products-services/blood-services/ |title=SCC's Blood Services Information Systems Suite |publisher=SCC Soft Computer |date=2021 |accessdate=18 November 2021}}</ref><ref name="HemasoftHome20">{{cite web |url=http://www.hemasoft.com/ |title=Hemasoft |publisher=Hemasoft Software SL |date=2021 |accessdate=18 November 2021}}</ref><ref name="TDMS_TDBloodBank20">{{cite web |url=https://www.technidata-web.com/en-gb/solutions-services/solutions/blood-banking |title=TD BloodBank |publisher=Technidata SAS |date=2021 |accessdate=18 November 2021}}</ref>:
 
*manage inventory across multiple facilities
*manage donor and harvested tissues
*support positive patient identification (PPID)
*support the ISBT 128 standard for medical products of human origin
*support for both autologous and directed medical product management
*allow for emergency release of inventory
*allow for electronic crossmatch of human-based medical products
*manage medical product recall and documentation
*manage donor demographics, notification, scheduling, and history
*manage donation drives and other campaigns
*track bag and supply lot numbers
*track quality control testing
*monitor access to and environmental conditions of supply fridges
*provide workflow management for non-standard patients
*support antibody screening processes
 
 
[[File:Medical Examination of a Clinical Trial Volunteer (45116548811).jpg|right|350px]]'''Central and contract research lab'''<ref name="EurofinsSupport20">{{cite web |url=https://www.eurofins.com/biopharma-services/central-lab-old/support-services/data-management/ |title=Supporting Services - Data management |publisher=Eurofins Scientific |date=2021 |accessdate=18 November 2021}}</ref><ref name="AbbotStarlimsClin20">{{cite web |url=https://www.starlims.com/us/en/industries/clinical-research |title=Starlims Clinical Research LIMS |publisher=Abbot |date=2021 |accessdate=18 November 2021}}</ref><ref name="LabWareClinical20">{{cite web |url=https://www.labware.com/industries/biobanking-clinical#clinical |title=Clinical Research |publisher=LabWare, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="MedpaceClinTrak20">{{cite web |url=https://www.medpace.com/capabilities/technology/laboratory-information-management/ |title=ClinTrak Lab |publisher=Medpace, Inc |date=2021 |accessdate=18 November 2021}}</ref>:
 
*manage and track clinical trial kits
*manage multi-site logistics of specimens
*provide a reservation function for specimens
*manage clinical trials and their various functions, including recruitment, study protocols, treatment groups, metadata, multi-site master scheduling, consent checks, and other required reporting
*provide special access privileges to sponsors, monitors, and investigators
*support a wide variety of data transfer formats, including CDISC, ASCII, SAS, and XML
*provide patient management, including demographics, consent forms, clinical notation, and test results
*provide highly configurable "blinding" features for reports and the user interface
*track contracts, budgets, and other financials
*develop exclusion rules and monitor exclusions
*support testing for a wide variety of disciplines
*provide study-specific monitoring and alerts
*provide granular cumulative reporting
*provide study-specific project portals that allow review of documents, data visualizations, training material, and other study information
 
 
'''''Genetic diagnostics and cytogenetics labs'''''<ref name="SunquestMitogen20">{{cite web |url=https://www.sunquestinfo.com/software-and-services/lims/ |title=Sunquest Mitogen LIMS |publisher=Sunquest Information Systems, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="XifinMolec20">{{cite web |url=https://www.xifin.com/industry-solutions/laboratory/molecular-diagnostics |title=Molecular Diagnostics |publisher=XIFIN, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="PsycheNucleoLIS20">{{cite web |url=https://psychesystems.com/enterprise-laboratory-information-software/nucleolis-molecular-lab-testing-software/ |title=NucleoLIS - Flexible & Modern LIS |publisher=Psyche Systems |date=2021 |accessdate=18 November 2021}}</ref><ref name="MyersLab18">{{cite journal |title=Laboratory Information Systems and Instrument Software Lack Basic Functionality for Molecular Laboratories |journal=Journal of Molecular Diagnostics |author=Myers, C.; Swadley, M.; Carter, A.B. |volume=20 |issue=5 |pages=591–99 |year=2018 |doi=10.1016/j.jmoldx.2018.05.011}}</ref>:
 
*manage sample collection kits
*manage informed consent documentation
*provide customized workflows for molecular and [[DNA sequencing#High-throughput methods|next-generation sequencing]] (NGS) testing
*track specimen and aliquot lineage for cell lines, tissues, slides, etc.
*track nucleic acid quantity and quality of specimens
*support a wide array of molecular testing and associated data fields, including biochemical and molecular genetics, carrier screening, immunology, molecular profiling, prenatal and newborn testing, and pharmacogenetics
*provide custom workflows for FISH, PCR, gel electrophoresis, cytogenetics, DNA sequencing, and more
*support specialty testing reimbursement and other revenue management unique to this lab type
*support single sign-on with imaging platforms
*provide color coding for turn-around time and other testing statuses
*provide cleanly formatted rich-text reports customized for molecular diagnostics
 
 
'''''Medical cannabis testing lab'''''<ref name="LabLynxCanna20">{{cite web |url=https://www.lablynx.com/cannabis/ |title=Cannabis LIMS for QA and Medical Research |publisher=LabLynx, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="KhemiaCanna20">{{cite web |url=https://khemia.com/industries/cannabis-testing/ |title=Cannabis Testing |publisher=Khemia Software, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="LabWareCanna20">{{cite web |url=https://www.labware.com/lims/saas/grow |title=LabWare GROW |publisher=LabWare, Inc |date=2021 |accessdate=18 November 2021}}</ref><ref name="QBenchLIMS20">{{cite web |url=https://qbench.net/qbench-lims-cannabis-testing-labs/ |title=LIMS for Cannabis & Hemp Analysis Labs |publisher=Junction Concepts |date=2021 |accessdate=18 November 2021}}</ref><ref name="PaszkoSelecting20">{{cite web |url=https://www.labcompare.com/10-Featured-Articles/354722-Selecting-a-LIMS-for-the-Cannabis-Industry/ |title=Selecting a LIMS for the Cannabis Industry |work=LabCompare |publisher=CompareNetworks, Inc |date=27 November 2018 |accessdate=21 November 2021}}</ref>:
 
*add, view, and link custom annotated images
*interface with a wide array of chromatography and spectroscopy instruments
*optimize sample login and management for the industry, including clear differentiation between medical and recreational cannabis
*provide compliant test protocols, workflows, labels, and reporting for medical cannabis testing
*provide ability to interface with state-required compliance reporting systems
*support inventory reconciliation
*support disease testing, sexing, and genetic tracking of cannabis
*support stability testing


Finally, having a cybersecurity plan that incorporates one or more cybersecurity frameworks gives the laboratory ample opportunity to apply stated goals and chosen security controls to the evaluation and selection process. In particular, a user requirements specification (URS) that incorporates cybersecurity considerations will certainly help a laboratory with meeting regulatory requirements while also protecting its data systems. A USR that is pre-built with cybersecurity controls in mind—such as [[Book:LIMSpec 2019 R1|LIMSpec]], discussed later—makes the evaluation process even easier.


==References==
==References==
{{Reflist|colwidth=30em}}
{{Reflist|colwidth=30em}}

Revision as of 23:46, 21 January 2022

From law firms[1] to automotive manufacturers[2], the need to address cybersecurity is increasingly apparent. In 2018, the Center for Strategic & International Studies estimated that cybercrime causes close to $600 billion in damages to the global economy every year[3], though due to underreporting of crimes, that number may be much higher. That number also likely doesn't take into account lost business, fines, litigation, and intangible losses[4] In the end, businesses of all sizes average about $200,000 in losses due to a cybersecurity incident[5], and nearly 60 percent of small and midsize businesses go bankrupt within six months because of it.[6]

Medical diagnostic and research laboratories are no exception, regardless of business size. Even tiny labs whose primary digital footprint is a WordPress website advertising their lab are at risk, as hackers could still spread malware, steal user data, add the website to a bot network, hack the site for the learning experience, or even hack it just for fun.[7][8][9] Even more importantly are those labs performing digital data management tasks that handle sensitive patient and proprietary data, requiring additional cybersecurity considerations.

A laboratory can integrate cybersecurity thinking into its laboratory informatics product selection in several ways. First, the lab should have a cybersecurity plan in place, or if not, it should be on the radar. This is a good resource to tap into in regards to deciding what cybersecurity considerations should be made for the software. Can the software help your lab meet your cybersecurity goals? What regulatory requirements for your lab are or are not covered by the software?[10] Another tool to consider—which may have been used in any prior cybersecurity planning efforts—is a cybersecurity framework. Many, but not all, cybersecurity frameworks include a catalog of security controls. Each control is "a safeguard or countermeasure prescribed for an information system or an organization designed to protect the confidentiality, integrity, and availability of its information and to meet a set of defined security requirements."[11] These controls give the implementing organization a concrete set of configurable goals to apply to their overall cybersecurity strategy. Other frameworks may be less oriented to security controls and more program-based or risk-based. Choosing the best frameworks will likely depend on multiple factors, including the organization's industry type, the amount of technical expertise within the organization, the budget, the organizational goals, the amount of buy-in from key organizational stakeholders, and those stakeholders' preferred approach.[10]

Finally, having a cybersecurity plan that incorporates one or more cybersecurity frameworks gives the laboratory ample opportunity to apply stated goals and chosen security controls to the evaluation and selection process. In particular, a user requirements specification (URS) that incorporates cybersecurity considerations will certainly help a laboratory with meeting regulatory requirements while also protecting its data systems. A USR that is pre-built with cybersecurity controls in mind—such as LIMSpec, discussed later—makes the evaluation process even easier.

References

  1. Sobowale, J. (1 March 2017). "Law firms must manage cybersecurity risks". ABA Journal. American Bar Association. http://www.abajournal.com/magazine/article/managing_cybersecurity_risk/. Retrieved 18 November 2021. 
  2. Watney, C.; Draffin, C. (November 2017). "Addressing new challenges in automotive cybersecurity" (PDF). R Street Policy Study No. 118. R Street Institute. https://www.rstreet.org/wp-content/uploads/2018/04/118-1.pdf. Retrieved 18 November 2021. 
  3. Lewis, J.A. (21 February 2018). "Economic Impact of Cybercrime". Center for Strategic & International Studies. https://www.csis.org/analysis/economic-impact-cybercrime. Retrieved 18 November 2021. 
  4. "BLOG: Cost of Cyber Crime to Small Businesses". Virginia SBDC Blog. Virginia SBDC. 30 May 2017. Archived from the original on 05 July 2020. https://web.archive.org/web/20200705061737/https://www.virginiasbdc.org/blog-cost-of-cyber-crime-to-small-businesses/. Retrieved 18 November 2021. 
  5. "Hiscox Cyber Readiness Report 2019" (PDF). Hiscox Ltd. April 2019. https://www.hiscox.com/documents/2019-Hiscox-Cyber-Readiness-Report.pdf. Retrieved 18 November 2021. 
  6. Galvin, J. (7 May 2018). "60 Percent of Small Businesses Fold Within 6 Months of a Cyber Attack. Here's How to Protect Yourself". Inc.com. https://www.inc.com/joe-galvin/60-percent-of-small-businesses-fold-within-6-months-of-a-cyber-attack-heres-how-to-protect-yourself.html. Retrieved 18 November 2021. 
  7. Grima, M. (14 November 2019). "Top reasons why WordPress websites get hacked (and how you can stop it)". WP White Security. https://www.wpwhitesecurity.com/why-malicious-hacker-target-wordpress/. Retrieved 18 November 2021. 
  8. Moen, D. (19 April 2016). "What Hackers Do With Compromised WordPress Sites". Wordfence Blog. Defiant, Inc. https://www.wordfence.com/blog/2016/04/hackers-compromised-wordpress-sites/. Retrieved 18 November 2021. 
  9. Talaleve, A. (22 February 2021). "Website Hacking Statistics You Should Know in 2021". Patchstack. https://patchstack.com/website-hacking-statistics/. Retrieved 18 November 2021. 
  10. 10.0 10.1 Douglas, S.E. (July 2020). "Comprehensive Guide to Developing and Implementing a Cybersecurity Plan". LIMSwiki. 
  11. "security control". Computer Security Resource Center. National Institute of Standards and Technology. 2019. https://csrc.nist.gov/glossary/term/security_control. Retrieved 18 November 2021.