JMIR Publications

ABSTRACT

Background:

The growing use of connected medical devices has significantly increased the cybersecurity exposure of healthcare systems, posing direct risks to patient safety. In response, a complex framework of regulations and standards has been developed to govern device security. However, this framework remains fragmented, leading to significant challenges in achieving consistent security implementation and effective regulatory oversight across the industry.

Objective:

This study conducted a systematic review of current cybersecurity standards applicable to connected medical devices, with a focus on those used in the European Union, to describe the state of knowledge, identify structural gaps and methodological fragmentation, and guide future harmonization efforts to improve healthcare system security.

Methods:

A systematic search was performed, following an adopted version of PRISMA 2020 guidelines, across seven major standards development organization databases. Included standards were thematically analyzed against 13 cybersecurity requirements derived from the European Union's MDCG 2019-16 guidance. One of these requirements, the security capabilities requirement, was further assessed across 18 individual cybersecurity capabilities. The analysis evaluated each requirement's consideration and level of specification coverage.

Results:

The search resulted in 22 relevant standards from an initial pool of 423. The analysis revealed high nominal coverage of procedural requirements, with the highest coverage for documentation (100%) and for the capability cybersecurity product upgrades (100%). However, a critical imbalance exists: 18 of the 22 included standards (81.8%) focus on auditable processes, while only 4 (18.2%) provide prescriptive, verifiable technical guidance.

Conclusions:

The findings reveal an inconsistency between high procedural conformity and uneven technical security implementation across the reviewed standards. This inconsistency reflects methodological differences in core areas such as risk assessment and the limited integration of cybersecurity and patient safety risk management. The current standards landscape is procedurally mature but technically limited. A transition from predominantly process-oriented guidance to a combination of process-oriented and technical guidance is required to support verifiable security assurance. Achieving this transition depends on developing prescriptive technical baselines and establishing a unified framework that integrates security, safety, and benefit-risk analysis.