Launch of the Guidance for Medical Device Cybersecurity
Medical devices, including patient monitors and imaging systems, are a growing target for cyberattacks. Attackers exploit vulnerabilities to access sensitive patient data and disrupt critical healthcare services. In addressing this urgent global threat, GDHP collaborated with Singapore agency Synapxe to develop the GDHP Guidance for Medical Device Cybersecurity (GMDC).
Based on international regulatory requirements and standards, and leveraging Singapore’s existing cybersecurity framework, the Guidance for Medical Device Cybersecurity is designed to be both robust and forward-thinking.
This Guidance is an openly available, sound practice resource for medical device developers and manufacturers and healthcare purchasers to uplift cybersecurity practices through secure deployment and usage of medical devices.
The Guidance is a product of the collaboration under the GDHP Cyber Security Work Stream, which focuses on strategies that can strengthen the processes and practices designed to protect healthcare related devices, systems, and networks, as well as the data within them, from security risks and cyberattacks.
The GMDC comprises four medical device cybersecurity levels, with each higher level being more comprehensive in the assessment. These requirements are titrated from regulatory requirements from International Medical Device Regulatory Forum (IMDRF), NEMA Manufacturer Disclosure Statement for Medical Device Security (MDS2), NIST framework and ISO/IEC and TR67 standards. The 4 levels are adapted from Cybersecurity Labelling Scheme for Medical Device [CLS(MD)] framework that is progressively tiered from Level 1 to provide increasing security assurance as they attain compliance to higher levels.
The Guidance Note was announced at Singapore GovWare Healthcare Forum on 16 October 2024 at the following panel discussion:
Elevating Medical Device Security: Release of Guidance for Medical Device Cybersecurity (GMDC) by Global Digital Health Partnership (GDHP), a critical resource for securing healthcare devices and systems from cyberattacks.
- Moderator: Leon Chang, Assistant Chief Executive, Cyber Defence Group & Chief Risk Officer, Synapxe
- Panellists:
- Tiffany Butler, Senior Advisor for Cybersecurity Policy & Compliance, U.S. Department of Health and Human Services (HHS)/ Office of the National Coordinator for Health Information
- Lisa Lewis Person, Deputy Assistant Secretary for Technology Policy; Deputy National Coordinator for Operations Chief Operating Officer, U.S. Department of Health and Human Services (HHS)/ Office of the National Coordinator for Health Information, Co-Chair of the GDHP Cybersecurity Work Stream
- Fuller Yu, Chief of IT Operations, Hospital Authority Hong Kong, Co-Chair of the GDHP Cybersecurity Work Stream
- Tiffany Butler, Senior Advisor for Cybersecurity Policy & Compliance, U.S. Department of Health and Human Services (HHS)/ Office of the National Coordinator for Health Information
The launch of the GDMC was featured by various media outlets:
- Synapxe and the GDHP Cyber Security Workstream to bolster global medical device cybersecurity (biospectrumasia.com)
- Nieuwe gids moet zorg helpen bij cybersecurity | ICT&health (icthealth.nl)
- Synapxe collaborates with global health coalition to develop cybersecurity guidelines for medical devices (govinsider.asia)
- GDHP Cyber Security Work Stream, Synapxe enhance medical device protection | Frontier Enterprise (frontier-enterprise.com)