Health informatics — Information security management for remote maintenance of medical devices and medical information systems — Part 1: Requirements and risk analysis

This specification focuses on remote maintenance services (RMSs) for information systems in healthcare facilities as provided by vendors of medical devices and health information systems. It specifies the risk assessment necessary to protect remote maintenance activities, taking into consideration the special characteristics of the healthcare field such as patient safety, regulations and privacy protections. The specification provides practical examples of risk analysis to protect both the healthcare facility and RMS provider information assets in a safe and efficient (that is, economical) manner. These assets are primarily the information system itself and personal health data held in the information system.

Main sections:

· Scope

· Normative references

· Terms and definitions

· An outline of RMS security of medical devices and medical information systems

· Risk analysis

· Annex A: Use case of RMSs

· Annex B: Example of risk analysis result of remote maintenance services

· Annex C: Example of risk analysis criteria