Safeguarding Healthcare: A Comprehensive Threat Analysis of Clinical Decision Support Systems

Using digital data gathering and analytics in healthcare brings benefits and risks to patients and practitioners. Smart Health Information Systems, such as Clinical Decision Support Systems (CDSSs), consolidate data from various sources, utilizing artificial intelligence for decision support. However, machine learning models in CDSSs are vulnerable to various attacks, leading to incorrect predictions with severe consequences. This paper systematically investigates security and privacy threats related to CDSSs. First, we leverage the data flow and sequence diagrams to identify the critical use cases that might lead to security or privacy breaches. Second, we identify and classify threats imminent to the CDSSs using Security Cards and STRIDE. Lastly, the persona non-grata who pose a significant threat to the integrity of the CDSSs are identified. Implementing our method can assist teams in addressing security threats to CDSSs by considering their unique vulnerabilities. This research contributes to developing comprehensive security strategies for CDSSs.