Cyber Practices

The Medical Product Manufacturer Cyber Incident Response Playbook (MPM CIRP) is a comprehensive guide that provides information, step-by-step recommendations, and processes for medical product manufacturers to use in responding to manufacturing cyber incidents.

The JSP2 offers important updates and a major refresh of the original JSP published in 2019. JSP is a total product lifecycle reference guide to developing, deploying and supporting cyber secure technology solutions in the health care environment. The JSP utilizes “secure-by-design” and “secure-by-default” principles throughout the product lifecycle of medical devices and health IT solutions. JSP 2.0 additionally addresses Goals #6 and #7 of HSCC’s five-year Health Industry Cybersecurity Strategic Plan (HIC-SP).

MVCT is a toolkit written to provide specific tools to medical device manufacturers and software developers for creating cybersecurity vulnerability communications related to their products or services. This toolkit focuses on vulnerability communications directed to non-security professionals, including clinicians, patients, users and other readers not familiar with cybersecurity and connected technologies. It is intended to help medical device manufacturers formulate and communicate vulnerability disclosures that all affected audiences, including nontechnical stakeholders, can understand.

A comprehensive guide to address the management of cyber risk caused by legacy technologies used in healthcare environments. It recommends cybersecurity strategies that both manufacturers and health providers can implement for legacy medical technology as a shared responsibility in the clinical environment and provides insights for designing future devices that are more secure. A brief summary is found here and click here for a Quick Reference Guide. Also, HealthCareInfoSecurity Webinar on HSCC Guide for “Managing Legacy Technology Security“.

MC2 offers a reference for shared cooperation and coordination between Healthcare Delivery Organizations (HDOs) and Medical Device Manufacturers (MDMs) regarding the security, compliance, management, operation, services, and security of MDM-managed medical devices, solutions, and connections. It is strongly encouraged that all medical device manufacturers, health delivery organizations, and group purchasing organizations closely review this contract language and adopt as much as is appropriate for your organization. The more uniformity and predictability we can achieve in cross enterprise cybersecurity management expectations the greater strides we’ll make toward patient safety and a more secure and resilient healthcare system.