Security Standards Overview AAMI Medical Device Security Standards Overview MDISS Fall 2017 Meeting © 2017 Association for the Advancement of Medical Instrumentation www.aami.org © 2011 Association for the Advancement of Medical Instrumentation

AAMI’s role Leader in healthcare tech-oriented consensus-based problem solving Sectoral preference for private consensus-based standards to support regulatory needs Long track record of working with all stakeholders to develop national and international consensus standards * © 2014 Association for the Advancement of Medical Instrumentation www.aami.org © 2011 Association for the Advancement of Medical Instrumentation

AAMI Standards – The Three Pillars of Better Patient Outcomes Access Effectiveness Safety Security is integral to all three pillars! © 2017 Association for the Advancement of Medical Instrumentation www.aami.org

AAMI Standards Philosophy Standards only where there is a need Preference for global solutions--“One standard, one test, worldwide” Systems approach—Address safety and efficacy across full product lifecycle © 2017 Association for the Advancement of Medical Instrumentation www.aami.org

AAMI Standards Program Accredited by American National Standards Institute (ANSI) Administers technical committees of the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC) Administers U.S. Technical Advisory Groups (TAGs) to ISO and IEC Committees Develops American National Standards and technical reports © 2017 Association for the Advancement of Medical Instrumentation www.aami.org © 2011 Association for the Advancement of Medical Instrumentation

Evolution of AAMI Standards Program Accredited by ANSI to develop American National Standards 1977 First standard published 1971 Electromedical devices AAMI establishes ISO/TC 198 (sterilization) 1990 Assumes 1st ISO Secretariat 1987 AAMI establishes ISO/TC 210 (QMS, RM, etc.) 1993 Founded 1967 1960 Key standards initiatives Now administers 12 ISO or IEC technical committee Secretariats 2013 Assumes 1st IEC Secretariat 1989 AAMI turns 50 2020 ECG devices Sterilization General medical devices Dialysis technology Biocompatibility and clinical evaluation Industrial process control Management system standards (QMS, RM, Human factors, etc.) Combinations products Medical device software Anesthesia and respiratory equipment Medical Device and medical network security

Domestic Standard Development AAMI Medical Device Security WG Technical Information Report 57 Principles for medical device security—Risk management Applies ANSI/AAMI/ISO 14971 approach Revision underway as a full American National Standard (AAMI SW96) Also developing a Technical Information Report TIR97, Principles for medical device security – Post-market security management for device manufacturers Work will likely be taken international in the future © 2017 Association for the Advancement of Medical Instrumentation www.aami.org © 2011 Association for the Advancement of Medical Instrumentation

International Device Security Standards Development ISO/TC 210, Quality management and corresponding general aspects for medical devices ISO/TC 215, Health informatics (Joint working group 7) IEC/SC 62A, Common aspects of electrical equipment used in medical practice © 2017 Association for the Advancement of Medical Instrumentation www.aami.org

Key international standards ISO/IEC 80001-series (Risk management of networks incorporating medical devices) Multiple parts--several parts of this series address security Aimed at health care providers Aligned with NEMA NH-1, Manufacturer Disclosure Statement for Medical Device Security (MDS2 forms) Planned future revision will (likely align with ISO 31000 risk management revision and ISO 90001 (high level management structure) © 2017 Association for the Advancement of Medical Instrumentation www.aami.org © 2011 Association for the Advancement of Medical Instrumentation

ISO 14971 (medical device risk management) Security management is part of risk management (current state) Undergoing revision Controversy over whether to delete “physical” from scope of harm (physical harm) Controversy as to whether “security management” should be separate from “risk management” © 2017 Association for the Advancement of Medical Instrumentation www.aami.org

AAMI Horizons © 2017 Association for the Advancement of Medical Instrumentation www.aami.org

For more information AAMI Joe Lewelling VP, Emerging Technology and Health IT jlewelling@aami.org 703-253-8281 AAMI www.aami.org Phone: 703-525-4890 Address: 4301 North Fairfax Drive, Ste. 301, Arlington VA 2223 © 2017 Association for the Advancement of Medical Instrumentation www.aami.org