This document presents an informative set of common, high-level security-related capabilities and additional considerations to be used across the life cycle of health software and health IT systems, for the information exchange between the health software manufacturers (including medical device manufacturers), healthcare delivery organizations (HDOs) and other stakeholders. It is applicable to health software running on any platform and in any environment such as cloud, on premise or hybrid.
Figure 1 provides a graphical representation of the health software which fully includes medical device software.
While important security topics, the following are outside the scope of this document:
-
the security policies of the HDO,
-
the product and services security policies of the manufacturer,
-
determinations of risk tolerance by the HDO or manufacturer, and
-
clinical studies where there is a need to secure personal data.
As security risks can be caused by any product on health IT systems and health IT Infrastructure, considerations in this document can be applied for other products that are not health software.
