Service

Healthcare Technology Cybersecurity

UL Solutions’ full suite of cybersecurity services is designed to help healthcare organizations manage their cybersecurity risks and validate their cybersecurity capabilities to the marketplace.
Medical technology concept. Med tech. Electronic medical record.

Cybersecurity in healthcare technology (healthtech)

The integration of advanced information technologies in medical devices has transformed the healthcare industry, resulting in dramatic improvements in the efficiency and effectiveness of healthcare and related services.

But this integration has fostered the emergence of a new set of challenges for patients, healthcare providers and device developers and manufacturers. Today, the healthcare industry is a significant target for hackers and cybercriminals, potentially compromising private and confidential healthcare data and placing the safety and health of patients at risk.

UL Solutions offers guidance to manufacturers of medical devices and health and wellness products to help them navigate complex regulatory environments and meet critical patient needs. This is especially important for medical device cybersecurity because rapid innovation and regulatory changes are happening simultaneously. UL Solutions’ suite of cybersecurity services is designed to help healthcare organizations manage their cybersecurity risks and validate their cybersecurity capabilities in the marketplace.

Overview of Medical Device and Health IT Joint Security Plan

The Healthcare and Public Health Sector Coordinating Council (HSCC) cybersecurity working group, with the U.S. Food and Drug Administration (FDA) participation, developed the Medical Device and Health IT Joint Security Plan (JSP – Medical Device and Health IT Joint Security Plan version 2 (JSP2) – Health Sector Council), a total product life cycle reference guide.

The JSP2 is developed with the active participation of stakeholders from across the healthcare ecosystem. This includes representatives from both the public and private sectors, such as medical device manufacturers, healthcare IT vendors, healthcare providers and federal agencies. Contributors include regulators and industry groups, like the FDA, and other medical device manufacturers.

The principles outlined in the JSP2 are reflected in UL Solutions’ Medical Cybersecurity Assurance Program (CAP), which includes:

  • Lifecycle approach: The JSP2 and CAP both emphasize the importance of managing cybersecurity throughout the entire product lifecycle, maintaining continuous security from development to deployment.
  • Security integration: The JSP2 and CAP both advocate for integrating security into the design and development processes, promoting secure-by-design principles to demonstrate robust protection from the outset.
  • Collaboration and communication: The JSP2's focus on stakeholder collaboration aligns with CAP's approach of involving various parties in the cybersecurity assurance process, fostering transparent communication and cooperative efforts.
  • Key cybersecurity concepts:
    a. Total product lifecycle: Developing, deploying, and supporting cyber-secure technology solutions within the healthcare environment.
    b. Design control: Building medical technology with adherence to cybersecurity standards and rigorous testing protocols.
    c. Risk management: Continuously assessing and responding to cybersecurity issues and events throughout the life cycle of medical technology.

These principles and concepts align the JSP2, an industry best practices document, with the requirements of ANSI/UL 2900-2-1, the Standard for Software Cybersecurity for Network-Connectable Products, Part 2-1: Particular Requirements for Network Connectable Components of Healthcare and Wellness Systems. This standard is an FDA-recognized consensus standard and has been adopted as a referenced consensus standard under several global regulatory schemes.

Aligning cybersecurity principles to key life cycle phases

The JSP2 integrates "secure-by-design" and "secure-by-default" principles throughout the total product life cycle of medical devices. By aligning these cybersecurity principles with key life cycle phases (as listed below), manufacturers can confirm that security is embedded at every stage.

  • Security risk evaluation: This is a preliminary evaluation to identify any security threats and risks that might affect the device.
  • Regulatory/Standard compliance: This establishes a product’s security requirements in accordance with standards and regulations.
  • Elicit design input requirements for security: Confirm that the product architecture considers secure design principles when making decisions.
  • Threat modeling: Perform threat modeling to understand and identify the device’s attack surface and design vulnerabilities.
  • Software requirements/secure coding standards: Define robust software requirements in accordance with secure coding standards to safeguard patient data and device functionality from vulnerabilities and other cyber risks.
  • Security verification: Conduct rigorous testing to verify that security controls are implemented correctly and effectively.
  • Penetration testing: Perform penetration testing to identify exploitable vulnerabilities.
  • Secure configuration: Confirm the device is configured securely by default, with minimal attack surfaces.
  • Security testing and validation: Implement security testing, including static source code analysis, to validate the product's security features.
  • Software evaluation: Exploring all avenues of software vulnerabilities is an advanced penetration testing technique for fully evaluating the device's cybersecurity.
  • Secure deployment: Implement secure deployment practices, such as access controls, to protect devices in clinical environments.
  • Incident response: Develop and implement an incident response plan to address and mitigate security breaches promptly.
  • Vulnerability management: Regularly update and patch devices to address known vulnerabilities and improve security posture.
  • Patch management: Stay informed about emerging threats and vulnerabilities to update security measures proactively.
  • End-of-support/end-of-life/decommissioning: Implement procedures for securely decommissioning and disposing of devices at the end of their life cycle to prevent data breaches and unauthorized access.
  • Continuous improvement: Establish a feedback mechanism to collect insights from users and all other stakeholders and continuously improve security practices.

Get connected with our team

Thanks for your interest in our products and services. Let's collect some information so we can connect you with the right person.
Thank you!

One of our team members will respond to your request as soon as possible.

Medical device cybersecurity with UL Solutions

Healthtech cybersecurity breaches are on the rise. Hackers and cybercriminals compromise confidential data and infiltrate medical devices. UL Solutions offers a full suite of services for medical device cybersecurity.

IMS23CS1055059 Device Security Healthcare Video r2c - subtitles
Watch Video IMS23CS1055059 Device Security Healthcare Video r2c - subtitles
Duration

UL Solutions healthtech cybersecurity services at a glance

We will help you address your cybersecurity, data privacy and interoperability risks. Our services include:

Laboratory services

Security testing

  • Custom testing
  • Generation of software bill of materials (SBOM)
  • Known malware testing
  • Malformed input testing
  • Structured penetration testing
  • Vulnerability scanning (including SBOM)

Gap assessment

Certification

  • UL 2900-2-1
  • IEC 81001-5-1
  • Data Acceptance Test Lab (DATL)
  • Firm registration (organizational process certifications to ISO 13485, ISO 14971 and IEC 62304/UL 2900-2-1)

Surveillance support

  • UL 2900
  • IEC 81001-5-1
  • Performance management
  • Security capability maturity assessment and continuous improvement planning
  • Vulnerability management support

Knowledge and guidance support

Guidance on standards, frameworks and requirements

Tailored cybersecurity knowledge support for addressing security through QMS, risk management (RM) and SDLC processes (knowledge contracts)

Personnel competency training

  • UL 2900 series of standards
  • IEC 81001-5-1
  • Custom medical cybersecurity training
  • Global cybersecurity regulatory landscape
  • Medical device cybersecurity
  • Medical device interoperability (AAMI UL 2800)
  • Medical device security testing

Market access/regulatory support

  • Cybersecurity strategic planning
  • Medical cybersecurity regulatory research
  • Medical interoperability

Testing to healthtech cybersecurity standards for a variety of connectable devices

Our testing and certification services apply to, but are not limited to, the following types of connectable devices:

  • Medical devices and accessories
  • Medical device data systems
  • In vitro diagnostic (IVD) medical devices and accessories
  • Health IT devices
  • Wellness devices
  • Software as a medical device (SaMD), such as mobile applications, web applications, cloud solutions, etc.

Why UL Solutions for cybersecurity services in the healthcare industry?

UL Solutions has extensive expertise in cybersecurity, with a global network of IoT and operational technology (OT) security laboratories, and security experts and advisors with specialized expertise in global security standards, frameworks and best practices for the healthcare ecosystem. We help healthcare organizations to:

  • Define where they are in their cybersecurity maturity
  • Understand what they will need to do to develop more secure devices
  • Manage digital identity of people and products
  • Improve internal cybersecurity capabilities and processes
  • Validate security built into their products throughout their life cycle
  • Communicate security features to differentiate products in the marketplace

Cybersecurity offerings for healthtech

Penetration Testing

Medical Device Penetration Testing Services

Software vulnerability assessments for medical devices.
Young attractive nurse working on a tablet computer. Nice shallow depth of field with lots of copy space.Please click on an

Medical Cybersecurity Assurance Program (CAP)

Medical CAP offers a comprehensive suite of advisory, testing and certification services to help companies manage cybersecurity risks and demonstrate a strong security posture to the marketplace.
male gp sits at his desk looking at his digital tablet reading through patient notes, emails and looking through patients x-ray's. He is wearing blue scrubs and has his stethoscope around his neck.

Interoperability of Connected Medical Devices

Connecting medical devices with integrated systems to improve patient care.

Related services

Medical Devices and Products

Medical Device Performance and Safety Testing

UL Solutions provides medical device testing for safety and performance, as well as certification and regulatory compliance support for medical product manufacturers and healthcare companies.
Doctor hands hold and show digital tablet pc to patient.

SaMD and Health Software Certification

Testing, evaluation and certification services for health and medical software to key industry standards: IEC 82304-1, IEC 60601-1 part 14 and IEC 62304.
Product iQ displayed on cellphone

Product Sourcing and Certifications Database

Quickly access UL certification information with the powerful search engine Product iQ®.
myUL on a computer screen with two people reviewing it

myUL® Client Portal

Register for our client portal today to access all your information in one convenient place.

Related resources

Medical Device Penetration Testing Goes Beyond Cyber

Medical device penetration testing is used for more than cybersecurity now. It can address software quality, interoperability and artificial intelligence (AI) risks.

Navigating FDA Cyber Rules for Medical Devices

Amendment 524B of the FD&C Act sets new U.S. FDA cybersecurity rules for medical devices. UL Solutions provides expert support to help manufacturers meet these requirements.

Medical Device Cybersecurity Q&A

Read UL Solutions experts’ responses to medical device manufacturers’ top questions about cybersecurity shared during our two-part webinar series, “Advancing Cybersecure Medical Devices.”

What’s So Special About Medical AI, Anyway?

Learn how medical artificial intelligence (AI) differs from traditional software, including its safety‑critical complexity and regulatory challenges.

What Is a Medical Cyber Device?

How do we define a “medical cyber device,” and how to confirm medical cyber devices are safe, secure and resilient?

Unprotected Firmware Puts IoT Devices at Greater Risk

Firmware security plays a crucial role in overall cybersecurity of connected Internet of Things (IoT) devices.

Medical Cybersecurity: An Ecosystem Approach on-demand webinar

The webinar discusses how stakeholders in the healthcare industry can address today’s top cybersecurity threats.

Advancing Cybersecure Medical Devices - Part 1 of 2

This on-demand webinar discusses the importance of the total product lifecycle in managing cybersecurity of medical devices, including post-market issues like their end-of-life, end-of-support, decommissioning, and disposal.

Understanding Cyber Devices in Healthcare - Part 2 of 2

This on-demand webinar talks about what it means for a medical device to be a cyber device from the perspective of software risks.

Medical Device Cybersecurity

Explore the FDA-recognized requirements for medical cybersecurity and how implementing these requirements can help improve your device’s cybersecurity in the smart healthcare ecosystem.

Cybersecurity in an Era of Smart Pump Interoperability

Learn how you can keep patients safe and prevent the exposure of sensitive patient data with the Cybersecurity Assurance Program (CAP) certification and white hat vulnerability exposure testing.

Download our resources

Testing medical connectable devices to cybersecurity standards

UL Solutions medical device cybersecurity ervices are highly customizable depending on your specific cybersecurity and organizational needs.
Download PDF