T/ZMDS 20003-2019 Medical device network security risk control and information on medical device network security capability

Scope

Scope: This standard applies to the following medical device products: 1) Medical device products with network connection capabilities for electronic data exchange or remote control; 2) Medical device products that use storage media for electronic data exchange. This standard applies to the following two types of roles: 1) Medical service providers Medical service providers bear the ultimate responsibility for providing effective network security management. Medical service providers should adopt management measures in administrative, physical, and technical dimensions to effectively protect medical information security and comply with relevant laws and regulations. Medical service providers can request information related to network security capabilities described in this standard from medical device manufacturers and refer to this information to implement network security risk management. 2) Medical device manufacturers The impact of medical device manufacturers on the network security capabilities of medical devices is to add network security functions or measures to assist medical service providers in effective network security risk management. Manufacturers should fully assess the needs from medical service providers, the intended use of medical devices, usage scenarios, and core functions, and consider the requirements related to network security capabilities described in this standard during the R&D, production, installation, and maintenance of medical device products. Main technical content: This standard defines the network security capabilities involved in the control of network security risks in medical devices. It stipulates the information that medical device manufacturers should disclose when communicating with parties responsible for the network security of medical devices. There are a total of 20 network security capabilities, which are: automatic logout capability, audit control capability, ability to determine user authorization, ability to configu

Development Information

Related Standards