Medical Device Cybersecurity Research Articles

Regulatory Approaches Towards AI-Based Medical Device Cybersecurity: A Transatlantic Perspective

Abstract Cybersecurity of medical devices has become a concrete concern for regulators and policymakers in the European Union and United States. Following the COVID-19 pandemic, there has been an increase in cyber-attacks on critical healthcare infrastructures and their IT systems, which have suffered service disruptions and put patients’ health and safety at risk. The increase in cyberattacks on healthcare infrastructure, including medical devices, exacerbated by the growing digitalisation of healthcare services in the EU and the US, has led legislators and regulatory bodies to pay more attention to cybersecurity. Cybersecurity of AI-based medical devices requires the assessment of three areas subject to evolving regulatory approaches: medical devices, Artificial Intelligence (AI), and cybersecurity. Although they may appear distinguished in regulatory matters, the existence of AI-based medical devices and their possible cyber vulnerabilities makes clear that the three are intertwined and deserve closer attention from a regulatory point of view. Few scholars have devoted attention to AI and cybersecurity together. Even less, in our understanding, few comprehensive and EU/US comparative pieces of literature reflect on this specific issue. This paper aims to fill this gap and address the main implications of different regulatory approaches toward AI medical device cybersecurity in the EU and the US. The research stems from the assumption that regulation of medical devices in the EU has been historically inspired by regulatory trends in the US, although with the different cultural, societal, and legal traditions that made them adapt to the specificities of the territory. The paper observes that the US is a rule-based system reflecting a “command-and-control” approach, while the EU system is a principle-based one. While they share the main characteristic of being risk-regulation-based systems, their differences impact how AI-enhanced cybersecurity is regulated.

Healthcare Providers’ Readiness to Address Medical Device Cybersecurity within the Irish Healthcare System

Medical devices that can diagnose and treat critically ill patients have become sophisticated and complex. Device manufacturers have been developing these systems to meet market requirements as technology evolves. Combining medical devices and ICT into a distributed medical device IT system can be a solution to incorporating continuous monitoring from the patient bedside to interoperability with a clinical information system. These technology innovations aim to manage patient data and configure medical devices into networked systems that can provide functionality and safety. The implementation of a medical device network solution allows a healthcare provider to take advantage of managing the flow of information to improve clinical work practices and implement a system that can be interoperable with other clinical information systems. International Electrotechnical Commission (IEC) 80001-1 was developed to assist healthcare providers in identifying and managing the risks associated with medical devices sharing the same IT network with other systems and software. This standard defines roles, responsibilities, and activities in relation to the management of risk with medical devices on an IT network. This study aims to determine if the standard International Electrotechnical Commission (IEC) 80001-1 is being implemented and determine familiarity with regulations and appropriate standards and guidance for an effective medical device security risk-management program with Irish healthcare providers. A literature review highlighted the restrictions healthcare providers face in adopting and implementing IEC 80001-1 and the security threats and risks present when integrating medical devices and IT networks. The study research was conducted with clinical engineering members of the Biomedical and Clinical Engineering Association of Ireland (BEAI). This survey targeted BEAI members due to their wealth of experience, knowledge, and skill level in supporting complex medical device systems. An online anonymous survey was created to determine knowledge, awareness, and familiarity with IEC 80001-1 and other medical device security risk-management guidelines. The study research results revealed low knowledge, awareness, and familiarity among research participants with IEC 80001-1 and guidelines on medical device security risk management. These results were consistent with the literature review that a key to the success of standard adoption is collaboration between stakeholders and a multidisciplinary approach to compliance.

Activities of Manufacturers to Ensure Cyber Security of Medical Devices

Activities of Manufacturers to Ensure Cyber Security of Medical Devices

Japanese Regulations for Medical Device Cybersecurity

Japanese Regulations for Medical Device Cybersecurity

The Role of Cybersecurity in Medical Devices Regulation: Future Considerations and Solutions

The cybersecurity of medical devices is paramount in a world where everything is increasingly digitised. Attention to how this important defence against malicious actors is regulated must, therefore, also increase. This paper uncovers how the cybersecurity of medical devices is currently regulated and how it can be improved going forward. First, the paper compares the regulation of medical device cybersecurity in the European Union, the United States and the United Kingdom (UK)—differentiating between Great Britain and Northern Ireland as per the current state of the law in the UK. Second, the paper develops a model of how cybersecurity shapes three key areas in the ecosystem of medical devices. These areas are the medical device itself; the structure between the surrounding institutional systems (such as manufacturers and healthcare providers); and the security of the data, the surrounding institutional system and the medical device. Third, based on a comparative analysis and a view of the system from above, the paper puts forward four recommendations on what future regulation should contain to properly regulate the cybersecurity of medical devices: technology specificity, circumvention protection, genuine privacy and security by design. The paper recommends that these four principles be followed. Technology specificity because it guarantees legislation that understands the necessary technical aspects to promote security and safety. Circumvention protection because preventing manufacturers and others from circumventing these requirements decreases risks to the health and wellbeing of patients. Finally, genuine privacy and security by design should be followed to align cybersecurity and privacy with current and future technical capacities.

New Cybersecurity Requirements for Medical Devices in the EU: The Forthcoming European Health Data Space, Data Act, and Artificial Intelligence Act

The regulation of cybersecurity for medical devices keeps evolving in the European Union (EU). In the past few years, new pieces of legislation have been added to the initial framework for medical device cybersecurity, including the Medical Device Regulation, the General Data Protection Regulation and the Cybersecurity Act. The Artificial Intelligence Act, the European Health Data Space Regulation and the Data Act are forthcoming laws that contain cybersecurity-related requirements applicable to medical devices. This article examines the requirements stemming from each of these, as well as their role vis-a-vis the existing legal framework. We observe that despite being comprehensive and wide ranging in their changes, these new regulations may be inadequate for the task of ensuring the cybersecurity of medical devices. In our view, this approach by the EU legislature is inadequate because it fails to foresee cybersecurity requirements in a way that is truly linked with the already existing cybersecurity laws. To help address this problem, the article offers a set of workable recommendations that EU legislators would be well advised to take on board in respect of specific regulations, as well as in general, when establishing cybersecurity-related requirements.

Mapping Knowledge and Themes Trends in the Cybersecurity of Medical Devices: A Bibliometric Investigation

Mapping Knowledge and Themes Trends in the Cybersecurity of Medical Devices: A Bibliometric Investigation

Cybersecurity of medical devices: new challenges arising from the AI Act and NIS2 Directive proposals.

Cyberattacks on the IT infrastructure of hospitals, electronic health records or medical devices that have taken place during the COVID-19 pandemic reaffirmed how crucial it is to ensure cybersecurity in the healthcare sector. Medical devices are regulated in the European Union (EU) through vertical product-specific legislation, such as the Medical Device Regulation (MDR), among others. The MDR foresees safety requirements implying cybersecurity obligations for medical device manufacturers. In 2021, the EU legislator put forward the Network and Information Security System Directive reform (NIS 2) and the Artificial Intelligence Act (AIA) proposal, containing additional cybersecurity requirements applicable to medical devices. This article analyses how the new reforms interact with the existing legislation from a cybersecurity perspective. The research finds that parallel provision of analogous cybersecurity requirements (especially on notification requirements) could lead to regulatory overlapping, fragmentation, and uneven levels of protection of individuals in the EU internal market. In the “Recommendations and conclusions”, the article provides policy recommendations to the EU legislator to help mitigate these risks.

Medical Device Cybersecurity May Start at Concept, but Continues throughout the Product Life Cycle

Medical Device Cybersecurity May Start at Concept, but Continues throughout the Product Life Cycle

Selecting a Passive Network Monitoring Solution for Medical Device Cybersecurity Management

The number of cyberattacks and information system breaches in healthcare have grown exponentially, as well as escalated from accidental incidents to targeted and malicious attacks. With medical devices representing a substantial repository of all the assets in a healthcare system, network security and monitoring are critical to ensuring cyber hygiene of these medical devices. Because of the unique challenges of connected medical devices, a passive network monitoring (PNM) solution is preferred for its overall cybersecurity management. This article is intended to provide guidance on selecting PNM solutions while reinforcing the importance of program assessment, project management, and use of leading practices that facilitate the selection and further implementation of PNM solutions for medical devices. The article provides a detailed introduction to connected medical devices and its role in effective care delivery, an overview of network security types and PNM, an overview of the National Institute of Standards and Technology Cybersecurity Framework and its application for program assessment, essentials of project management for PNM solution selection and implementation, key performance indicators for measuring a solution's ability to meet critical cybersecurity needs for medical devices, and lessons learned from the author's professional experience, selective literature review, and leading practices. Rather than describing a complete list of guidelines for selecting PNM solutions, the current work is intended to provide guidance based on the author's experience and leading practices compiled from successful medical device cybersecurity programs.

Selecting a Passive Network Monitoring Solution for Medical Device Cybersecurity Management.

The number of cyberattacks and information system breaches in healthcare have grown exponentially, as well as escalated from accidental incidents to targeted and malicious attacks. With medical devices representing a substantial repository of all the assets in a healthcare system, network security and monitoring are critical to ensuring cyber hygiene of these medical devices. Because of the unique challenges of connected medical devices, a passive network monitoring (PNM) solution is preferred for its overall cybersecurity management. This article is intended to provide guidance on selecting PNM solutions while reinforcing the importance of program assessment, project management, and use of leading practices that facilitate the selection and further implementation of PNM solutions for medical devices. The article provides a detailed introduction to connected medical devices and its role in effective care delivery, an overview of network security types and PNM, an overview of the National Institute of Standards and Technology Cybersecurity Framework and its application for program assessment, essentials of project management for PNM solution selection and implementation, key performance indicators for measuring a solution's ability to meet critical cybersecurity needs for medical devices, and lessons learned from the author's professional experience, selective literature review, and leading practices. Rather than describing a complete list of guidelines for selecting PNM solutions, the current work is intended to provide guidance based on the author's experience and leading practices compiled from successful medical device cybersecurity programs.

The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel

The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel

The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel

The Case for Medical Device Cybersecurity Hygiene Practices for Frontline Personnel

Applying a Refined Approach to Cybersecurity Risk Assessments to the GE MAC VU360

An effective medical device cybersecurity management plan is built upon having an effective and thorough risk management process. Protecting medical devices and the information they store begins by understanding the potential risks that may affect the device and the impact those risks may have on patient safety, treatment care delivery, and the organization's business objectives. Risks to medical devices must be identified, analyzed, evaluated, controlled, and then monitored so that the devices are secure and reside in a protected environment. The first 3 of these risk management elements comprise what is known as a risk assessment. Here, available information is used to identify hazards and estimate their risk. These estimations are compared with documented risk criteria to evaluate the acceptability of each risk. The overarching goal of risk assessment is to gather all the information necessary to measure the applicable cybersecurity risks to a specific type or class of medical devices and then use a risk scoring matrix to prioritize risks with high severity and exploitability. Risks with a higher score are then addressed first to establish a risk mitigation plan to control the risk to an acceptable level.

Cybersecurity of Medical Devices: New Challenges Arising from the AI Act and NIS 2 Directive Proposals

Cybersecurity of Medical Devices: New Challenges Arising from the AI Act and NIS 2 Directive Proposals

Medical Device Regulation and Cybersecurity: Achieving ‘Secure by Design’ for Regulatory Compliance

The rapid evolution of information technology over the past 50 years is transforming our healthcare institutions from paper-based organizations into smart hospitals, a term now used by European Union Agency for Cybersecurity (ENISA). These changes are also associated with the systematic reliance on medical devices by both patients and healthcare providers. While these devices have the potential to advance personalized health solutions and improving the quality and efficacy of care, they nevertheless present significant security risks and challenges throughout the healthcare sector.

Proactive Role of Clinical Engineering in the Adoption of ISO/IEC 80001-1 within Healthcare Delivery Organization.

The integration of medical device systems and general hospital information technology (IT) infrastructure creates a medical device-IT network that requires patient-oriented cybersecurity risk management to ensure patient safety. This study discusses the roles of clinical engineering in taking initiatives in the implementation of the ISO/IEC 80001-1 risk management framework in a hospital environment. Further, we present lessons learned and clinical engineering opportunities in managing medical device cybersecurity, which include development of an integrated systems test lab.Clinical Relevance- This paper highlights Clinical Engineering's leadership role in implementing an effective risk management system for integrated medical device systems to reduce cybersecurity risks to enhance patient care and safety.

Cybersecurity of Medical Devices: Regulatory Challenges in the EU

This book chapter assesses the EU medical devices legal framework in light of the EU cybersecurity policy objectives and the complexity aspects inherently characterizing the healthcare sector. First, it outlines the core cybersecurity-related elements in the EU Medical Devices Regulation (MDR) and offers critical remarks on the Medical Device Coordination Group’s Guidance on medical device cybersecurity. Second, the chapter illustrates other relevant pieces of the EU legislation that become applicable in the context of medical devices’ cybersecurity, namely the NIS Directive, the Cybersecurity Act, the GDPR, the Radio Equipment Directive. Third, the chapter offers critical remarks concerning the possible regulatory challenges stemming from their interaction with the MDR. Here, the analysis finds that regulatory challenges persist due to regulatory specialization, possibly leading to regulatory overlapping, fragmentation risks, regulatory uncertainty and duplication. In its final section, the chapter provides recommendations for EU lawmakers dealing with the cybersecurity of medical devices in the EU.

Cybersecurity for Global Medical Device Supply Chain: The U.S. Fda's Role

Cybersecurity of medical devices is not only an issue of privacy, but a matter of life and death. The U.S. Food and Drug Administration (FDA) should increase its leadership role in managing emerging cybersecurity risks within the global medical device supply chain. As a result of the growing use of information and communication technology (ICT) within medical devices, cybersecurity within medical devices is becoming a serious global issue that can no longer be ignored. Cybersecurity risks leave patients’ lives vulnerable to cyber attack. Connection vulnerabilities could allow hackers to change the settings on a patient’s St. Jude pacemaker remotely. Malware in MRI machines and CT scans could add or remove cancerous nodules, causing a patient to be misdiagnosed and wrongly treated. Ransomware attacks on hospitals could leave doctors and staff without the critical data they need to save patients’ lives. Since medical devices rely on global supply chains and because cyber threats exist on an international level, it is crucial that the United States work with other countries to address medical device cybersecurity concerns.

International Activity of Medical Device Cybersecurity in JIRA

International Activity of Medical Device Cybersecurity in JIRA