Privacy and security of consumer IoT devices for the pervasive monitoring of vulnerable people

The Internet of Things (IoT) promises highly innovative solutions to a wide range of activities. However, simply being a technology company does not exempt an IoT company from needing to comply with the legislation applicable to their operating region that safeguards personal information. This will result in security and privacy requirements for healthcare solutions. There are several mature frameworks that address these issues, but they have been developed within the context of organised hospitals and care providers, where there is the expertise, processing power, communications and electrical power to support highly robust security. However, for IoT solutions aimed at vulnerable people, either at home or within their local environment, there are significant additional constraints that must be overcome. These include technical (low processing capability, power constrained, intermittent communications) organisational (how to enrol and revoke users and devices, distribution of cryptographic keys) and user constraints (how does a patient with physical and/or mental challenges configure and update their devices). This paper considers at the legal frameworks and the security and privacy requirements for healthcare solutions. An overview of some of the primary frameworks is then provided followed by an assessment of how this is constrained within an IoT system.