The Global Digital Health Partnership (GDHP) Cyber Security Work Stream, in collaboration with Synapxe, the national HealthTech agency of Singapore, has announced the global launch of the GDHP Guidance for Medical Device Cybersecurity (GMDC) in a significant move to bolster cybersecurity in healthcare worldwide. GMDC was released on the GDHP web portal on 16 October 2024 in conjunction with Singapore’s GovWare Healthcare Forum 2024.
GMDC is a comprehensive framework targeted at Medical Device Manufacturers (MDM) and Healthcare Delivery Organizations (HDO) internationally. Adapted from the four levels of security assurance outlined in the Cybersecurity Labelling Scheme for Medical Devices [CLS(MD)] in Singapore, it recommends a standardized framework that MDMs can use to identify the necessary cybersecurity features to build into their medical devices, as well as guide HDOs in the selection of medical devices for deployment and use.
GMDC applies to medical devices that handle personal identifiable information (PII) and clinical data with the ability to collect, store, process, or transfer such information. It also applies to those connecting to other devices, systems, and services through wired and/or wireless communication protocols via a network of connections.
Providing a strong cybersecurity framework globally
Medical devices, including patient monitors and imaging systems, are a growing target for cyberattacks as attackers exploit vulnerabilities to access sensitive patient data and disrupt critical healthcare services. In addressing this urgent global threat, GDHP Cyber Security Work Stream collaborated with Singapore agency, Synapxe to develop GMDC. Leveraging the foundational work of Singapore’s cybersecurity framework, as well as international regulatory requirements and standards, GMDC is designed to be both robust and forward-looking. GMDC extends beyond Singapore borders, with the goal of building resilient healthcare ecosystems worldwide to safeguard medical devices on a global scale.
Guiding medical device manufacturers to build in cybersecurity features to manufacture secure-by-design products
GMDC comprises 4 medical device cybersecurity levels, with each higher level being more comprehensive in the assessment. Through recommending cybersecurity requirements for medical devices tiered into these four levels, GMDC serves to guide MDMs on developing “secure-by-design” products.
Assisting healthcare delivery organizations with the selection of secure-by-design devices for deployment and use
In addition, GMDC equips HDOs to identify the most pertinent cybersecurity features that they should consider and assess when deploying and using medical devices in the clinical setting. HDOs can also use it as a declaration of conformity by manufacturers to perform risk assessments as part of their procurement efforts.
“Through the launch of GMDC, we aim to equip Medical Device Manufacturers and Healthcare Delivery Organizations with the tools needed to navigate an increasingly complex cybersecurity landscape. We are grateful for the partnership with Synapxe, and we will continue to identify opportunities to strengthen the cybersecurity posture of healthcare systems worldwide. We see strong potential for GMDC and encourage GDHP member countries to incorporate GMDC as part of their manufacturing and into their procurement specifications” said Ms. Lisa Lewis Person, Deputy Assistant Secretary for Technology Policy, and Co-Chair of GDHP Cyber Security Work Stream.
“Synapxe is committed to delivering world-class HealthTech solutions. Launching GMDC together with GDHP is another strong demonstration of active collaboration among the world’s digital health community. We are heartened that our pioneering work in Singapore served to guide the formulation of the GMDC, which can potentially enable healthcare institutions around the world to stay ahead of evolving cybersecurity threats that’s challenging our digital health services today.” said Ms Ngiam Siew Ying, CEO of Synapxe.
To find out more about GMDC, visit https://gdhp.health/work-streams/cybersecurity/
