Cybersecurity is essential for medical devices. As more and more devices offer electronic data exchange, remote access and control, efficiency in healthcare increases – but so do cybersecurity challenges. To ensure safe and effective use, China has introduced a set of regulations and standards.
1. Regulations and standards
- Guideline for the Registration Review of Medical Device Cybersecurity (2022 revision)
- YY/T 1843-2022 – Basic requirements for network security of medical electrical equipment
- YY/T 0664-2020 – Medical device software – Software life cycle processes
- GB 9706.1-2020 – Medical electrical equipment – Part 1: General requirements for basic safety and essential performance
2. Scope
The requirements apply to registration applications for class II and class III standalone software and devices containing software (including in vitro diagnostic devices) that have one or more of the following functions: electronic data exchange, remote access and control, or user access – covering both in-house developed and off-the-shelf software.
3. Content of the registration submission
Basic information
- Product identification: device name, model, specifications, registration certificate number, etc.
- Background: background and purpose of the study.
- Scope of the study: device types, functions and network environments covered – for example, specific wireless or wired connections and methods of electronic data exchange.
Analysis of cybersecurity properties
- Confidentiality: encryption technologies and access control strategies used.
- Integrity: how the product ensures that data are not changed in an unauthorised way during creation, transmission, storage and display, including data verification and tamper protection.
- Availability: fault tolerance, backup and recovery strategies.
Description of device-related data
- Data processing flow: the full data lifecycle – generation, collection, storage, transmission, use and deletion – with an analysis of potential cybersecurity risks at each step.
- Data security measures: measures such as encryption, anonymisation and access control, and their effectiveness and limitations.
Analysis of electronic interfaces
- Network interfaces: technical characteristics – network form and type, interface form, data interfaces, remote access and control methods, performance indicators – together with potential threats and countermeasures.
- Electronic data exchange interfaces: non-network interfaces or storage media – interface type, data storage format, data compression, performance indicators – with an assessment of the security risks during data transfer and storage.
Assessment of cybersecurity capabilities
- Automatic logoff: the ability to prevent unauthorised access and use when the device is unattended, including logoff time settings and trigger conditions.
- Audit: the ability to audit user activity, including the content, retention period and query and analysis functions of audit logs.
- Authorisation: the mechanism for determining whether a user has access and usage rights, including authorisation management, permission assignment and authentication technologies.
Risk assessment and management
- Risk identification: identify all cybersecurity risks – malicious attacks, data breaches, system failures – and analyse their causes and potential impact.
- Risk evaluation: assess the identified risks with suitable methods, such as risk matrices or fault tree analysis, to determine their level and priority.
- Risk control: define control measures for each risk level – stronger technical protection, better security management, staff awareness – and describe their effectiveness and the residual risks.
Conclusion
Summarise the overall cybersecurity status of the device and conclude whether it meets the cybersecurity requirements.
How EVERBIZ can help
EVERBIZ supports manufacturers in preparing the cybersecurity documentation for NMPA registration. Contact us.
This article is for general information only and does not constitute legal advice. The current NMPA guideline is authoritative.