In more detail
Background
Earlier this year, the CSA launched the Cybersecurity Labelling Scheme ("CLS") for consumer smart devices to improve Internet of Things security and raise overall cyber hygiene levels. Smart devices, ranging from Wi-Fi routers to smart printers, are rated according to their levels of cybersecurity provisions. There are four progressive rating levels under the CLS, with Level 4 being the most secure and resistant against common cyber-attacks.
It is recognised that medical devices are increasingly connected to networks, which translates into higher cybersecurity risks. To better safeguard patients' personal information and clinical data, the CLS is now extended to medical devices.
Cybersecurity Labelling Scheme for Medical Devices
The CLS (MD) applies to medical devices that handle health-related data or can connect to other devices, systems and services.
It incentives manufacturers of medical devices to adopt a security-by-design approach when developing their products, and allow consumers and healthcare providers to make informed purchases.
There are four levels of rating under the CLS (MD), with Level 4 being the highest rating. To progress to the next level, the medical device has to undergo an additional level of testing and assessment.
|
Level
|
Requirements
|
|
Level 1
|
Current registration requirements for medical devices by HSA
|
|
Level 2
|
Meets enhanced cybersecurity requirements such as device and data requirements; may be required to pass independent third-party tests.
|
|
Level 3
|
|
Level 4
|
The baseline regulatory requirements in Level 1 mirror the current HSA registration requirements for medical devices. Therefore, all HSA-registered medical devices are deemed compliant with Level 1 of CLS (MD).
More details regarding the higher levels will be released following the industry consultation to be held in the upcoming month.
* * * * *
© 2022 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
