Integral Security Pillars for Medical Devices: A Comprehensive Analysis

Abstract

Cybersecurity is an essential component for preserving the integrity of healthcare systems, particularly in the face of the increasing adoption of interconnected medical devices, which significantly expands cyber risk exposure. A critical issue in this context is the fragmentation of knowledge regarding the security of these devices. The absence of a unified framework hampers the systematic identification of vulnerabilities and the effective implementation of protective measures. This study highlights such fragmentation by requiring the integration of seven ISO standards, nine NIST controls, one HIPAA regulation, one ENISA directive, one GDPR regulation, and one HITRUST framework, along with the review of 47 scientific articles and analysis of 27 documented vulnerabilities (CVEs). The need to consult this broad range of sources reflects both the complexity of the regulatory landscape and the lack of standardization in medical device security. Based on this review, key pillars were defined to support an integral and adaptable security model. This model provides a practical tool to strengthen digital healthcare infrastructures, facilitate continuous audits, and mitigate emerging threats, all while aligning with international standards. Furthermore, it promotes the consolidation of fragmented knowledge, helping to close security gaps and enhance the resilience of healthcare systems in a globalized environment.

1. Introduction

In the current context of the digital revolution, cybersecurity has become a fundamental pillar for ensuring the security, integrity, and reliability of healthcare systems globally [1]. The widespread adoption of advanced technologies, such as interconnected medical devices, has brought numerous benefits, but it has also increased the exposure of healthcare institutions to a broader range of cyber risks and vulnerabilities. The integration of these devices into interconnected networks presents significant opportunities to improve patient care but also poses critical challenges in terms of protecting information and the underlying technological infrastructure [2].

One of the main issues facing the healthcare community is the fragmentation of information related to the security of medical devices. Relevant data sources are scattered, making it difficult to build a coherent framework that can systematically identify and address the vulnerabilities of these devices. In this context, it is necessary to have an integrated security model that not only consolidates existing knowledge but also integrates and applies effective protection measures based on international security standards [3].

The goal of this study is to establish a clear set of fundamental pillars for the security of medical devices. Through an exhaustive analysis, the main threats and most common vulnerabilities are identified, and the security approaches used in different environments and healthcare systems are compared [4,5]. This analysis is complemented by a comprehensive review of the existing literature, covering the latest studies and international regulations, allowing for the identification of security gaps and the proposal of effective solutions.

The primary purpose of this research is to develop a practical support tool for implementing security strategies in medical devices. The study aims to provide a model that not only strengthens the security infrastructure of healthcare environments but also serves as a foundation for continuous and adaptive audits in response to emerging threats. This model is based on the principles of systematic auditing and designed to integrate effectively with Information Security Management Systems (ISMS) and align with international standards, such as the HITRUST Framework [6,7].

Finally, this work aims not only to address the current security gaps in medical devices but also to offer a broader perspective that enables its implementation in various international contexts, adapting to the specificities of each healthcare system. In this way, it is expected that this model will act as a global benchmark in risk management and cybersecurity within healthcare, contributing to the strengthening of trust and reliability in interconnected healthcare systems.

Building upon this context, the present study introduces a comprehensive methodology that integrates the analysis of international regulatory frameworks, a systematic review of the scientific literature, and a comparative evaluation of security standards applicable to medical devices. The results present an integral model grounded in conceptual pillars, designed to systematically structure the critical components of protection and to enable a coherent assessment of the most significant vulnerabilities. The discussion section further examines the distinctions between this holistic approach and conventional models focused primarily on device connectivity (IoMT), underscoring the necessity of a broader perspective that addresses the entire life cycle of medical devices and their seamless integration within healthcare systems. Finally, the conclusions emphasize the practical relevance of the proposed model as a foundational tool to support the implementation of cybersecurity strategies in clinical environments, while also highlighting its potential to inform future research aimed at the standardization and continuous enhancement of security across interconnected healthcare infrastructures.

2. Materials and Methods

The literature review method employed in this research is comprehensive, with an integrated and structured approach aimed at developing a robust theoretical model for information security in medical devices. This approach allows for a thorough and detailed analysis of the most relevant aspects related to cybersecurity in medical environments, adapted to the current needs of the healthcare sector. The research is organized into four essential phases, each focused on addressing different components of the problem, from understanding the context to developing concrete solutions. These phases are designed to facilitate a systematic and coherent process, as illustrated in Figure 1.

Figure 1. Phases of the comprehensive review.

Details of the Research Phases:

• Phase 1: Problem Statement

This initial phase focuses on conducting an in-depth analysis of the general context of medical device security, identifying current issues and relevant historical backgrounds. Previous developments in the field of cybersecurity are reviewed, as well as the challenges faced by the medical sector due to the increasing digitization and interconnection of its devices. This analysis establishes the necessary framework to effectively address emerging threats.

• Phase 2: Review of Regulations, Cybersecurity Studies, and Common Vulnerabilities

In this phase, a thorough review of the existing regulations and previous studies related to cybersecurity in medical devices is conducted. Applicable regulations and regulatory frameworks are addressed, as well as the best practices adopted to protect medical infrastructure. Additionally, the most common vulnerabilities affecting these devices are identified in order to better understand the risks and weak points in current protection systems.

• Phase 3: Presentation and Analysis of Research Results

In the third phase, the results obtained throughout the research process are presented. The proposed solutions are analyzed, evaluating their feasibility and effectiveness in practice. Additionally, key findings from the research are highlighted, including the implications of applying the security pillars model in various healthcare settings. This phase also includes the overall conclusions of the study and recommendations for future research in the field of cybersecurity for medical devices.

This comprehensive approach, divided into these four interrelated phases, enables the development of an effective and flexible security model that is capable of adapting to the changing dynamics of cybersecurity in the healthcare sector. Through this process, the goal is to provide a solid foundation for improving the protection of medical devices and, consequently, ensuring the security of sensitive data and patient privacy.

• Phase 4: Development of the Security Pillars Model

The final phase is crucial, as creative and critical thinking methods are used to develop a security pillars model specifically designed for medical devices. This model is adapted to the specifics of medical environments and aims to provide new perspectives and innovative approaches to information security management. The development of this model is based on the knowledge gained in the previous phases, incorporating effective measures to mitigate risks and enhance protection against cyber threats.

3. Results

The following section presents the results derived from the application of the comprehensive review methodology, structured in four phases. Each stage allowed for the systematic organization and analysis of the information, contributing to a clear and well-founded understanding of the topic under investigation.

3.1. Problem Statement

In the current healthcare context, one of the main challenges that hinders the effective implementation and management of cybersecurity is the fragmentation of information related to the risks and vulnerabilities associated with medical devices. Critical information is scattered across various sources, such as international regulations, incident databases, technical studies, and recommendations from regulatory bodies and does not have a structure that facilitates its proper integration, analysis, and practical application.

The direct consequence of this fragmentation is that efforts to protect medical devices become increasingly complex, as there is no common language or structured framework to organize all relevant information. This affects the different actors within the system, from those who design and manufacture the devices to those who use and oversee them in healthcare settings, resulting in decision-making processes that are often isolated. This not only weakens the ability to respond to potential threats but also increases the margins for error and widens existing security gaps.

Although internationally recognized regulatory frameworks and technical standards do exist, including ISO/IEC, NIST, and HITRUST, their implementation in practice tends to be heterogeneous and, in many cases, partial. This situation creates a significant gap between the available technical knowledge and its effective application, thereby increasing the risk of exposure to incidents that could compromise the integrity of the healthcare system.

Considering this scenario, it becomes evident that there is a need to develop an integrated security model capable of bringing together, organizing, and interpreting the currently fragmented information, thereby facilitating its strategic use in decision-making processes. A model of this nature should be aligned with international standards, adaptable to diverse organizational contexts, and capable of guiding both the assessment and implementation of effective and sustainable protection measures.

3.2. Review of Regulations, Cybersecurity Studies, and Common Vulnerabilities

The tables detailed below provide information on regulations (Table 1, Table 2, Table 3, Table 4, Table 5 and Table 6) and vulnerabilities (Table 8), and the review of scientific literature (Table 7) enables an analysis of this information.

3.2.1. Regulations

• ISO

There are various ISO standards that focus on information security and are relevant to medical devices. Below is a list of some of the most important ISO standards applicable in the auditing of medical device infrastructures [6].

Table 1. Main ISO standards that can be applied for auditing medical device infrastructure.

Normative	Year	Name	Description
ISO 27701 [8]	2019	Extension to ISO/IEC 27001 [9] and ISO/IEC 27002 [10] for information privacy management.	This document provides requirements and guidelines for establishing, implementing, maintaining, and improving a privacy information management system (PIMS), which is crucial for protecting personal data on medical devices.
ISO/IEC 27799 [11]	2016	Managing health information security using ISO/IEC 27002	Provides guidelines to support the interpretation and implementation of ISO/IEC 27002 in the healthcare sector, ensuring the protection of personal health information (PII) in health information systems.
ISO 13485 [12]	2016	Quality management systems for medical devices	Although this standard focuses primarily on quality management systems, it includes requirements for risk management and security of software and computer systems used in medical devices.
ISO/IEC 27001 [9]	2013	Information Security Management Systems (ISMSs)	It establishes the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This standard can be applied to any organization handling sensitive information, including manufacturers and suppliers of medical devices.
ISO/IEC 82304-1 [13]	2016	Health informatics—health software	General requirements for health software products: Defines quality and safety requirements for health software products, including those used in medical devices, and ensures that the software meets information security standards.
ISO/IEC 27002 [14]	2013	Code of practice for information security controls	Provides guidelines for implementing information security controls based on industry best practices, applicable to medical devices to protect the confidentiality, integrity, and availability of information.
ISO/IEC 80001-1 [15]	2010	Application of risk management for IT networks incorporating medical devices	Provides a framework for risk management related to integrating medical devices into information technology networks, ensuring that risks associated with information security and interoperability are addressed.

Table 1. Main ISO standards that can be applied for auditing medical device infrastructure.

Normative	Year	Name	Description
ISO 27701 [8]	2019	Extension to ISO/IEC 27001 [9] and ISO/IEC 27002 [10] for information privacy management.	This document provides requirements and guidelines for establishing, implementing, maintaining, and improving a privacy information management system (PIMS), which is crucial for protecting personal data on medical devices.
ISO/IEC 27799 [11]	2016	Managing health information security using ISO/IEC 27002	Provides guidelines to support the interpretation and implementation of ISO/IEC 27002 in the healthcare sector, ensuring the protection of personal health information (PII) in health information systems.
ISO 13485 [12]	2016	Quality management systems for medical devices	Although this standard focuses primarily on quality management systems, it includes requirements for risk management and security of software and computer systems used in medical devices.
ISO/IEC 27001 [9]	2013	Information Security Management Systems (ISMSs)	It establishes the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). This standard can be applied to any organization handling sensitive information, including manufacturers and suppliers of medical devices.
ISO/IEC 82304-1 [13]	2016	Health informatics—health software	General requirements for health software products: Defines quality and safety requirements for health software products, including those used in medical devices, and ensures that the software meets information security standards.
ISO/IEC 27002 [14]	2013	Code of practice for information security controls	Provides guidelines for implementing information security controls based on industry best practices, applicable to medical devices to protect the confidentiality, integrity, and availability of information.
ISO/IEC 80001-1 [15]	2010	Application of risk management for IT networks incorporating medical devices	Provides a framework for risk management related to integrating medical devices into information technology networks, ensuring that risks associated with information security and interoperability are addressed.

• NIST

The National Institute of Standards and Technology (NIST) of the United States has developed multiple standards, guidelines, and publications that, although not specifically aimed at medical devices, are highly relevant to information security in this field [16].

Table 2. NIST standards that can be applied for auditing medical device infrastructure.

Normative	Year	Name	Description
NIST Cybersecurity Framework (CSF) [17]	2024	-	A flexible, risk-based framework for improving cybersecurity in critical infrastructure, including the healthcare sector. Medical device manufacturers and users can use this framework to develop and improve cybersecurity programs.
NIST SP 800-63-3 [18]	2023	Digital Identity Guidelines:	Guides digital identity management; relevant for medical devices that require authentication and access control.
NIST Special Publication (SP) 800-53 Rev. 5 [19]	2020	Security and Privacy Controls for Information Systems and Organizations	Provides a catalog of security and privacy controls to protect information and information systems, including those used in medical devices.
NIST SP 800-37 Rev. 2 [20]	2018	Risk Management Framework for Information Systems and Organizations	A “System Life Cycle Approach for Security and Privacy" describes the NIST risk management framework, which can be applied to manage security and privacy risks in medical devices throughout their life cycle.
NIST SP 1800-1 [21]	2018	Securing Electronic Health Records on Mobile Devices	Provides practical examples and reference architectures for protecting electronic health records on mobile devices, applicable to mobile and wearable medical devices.
NIST SP 800-82 Rev. 2 [22]	2015	Guide to Industrial Control Systems (ICSs) Security:	This document provides guidance on the security of industrial control systems, which may apply to certain medical devices operating in industrial or manufacturing environments.
NIST SP 800-88 Rev. 1 [23]	2014	Guidelines for Media Sanitization	Provides guidelines for the secure disposal of data on storage media, applicable to medical devices that store sensitive information.
NIST SP 800-30 Rev. 1 [24]	2012	Guide for Conducting Risk Assessments	Guides performing risk assessments are essential for identifying and mitigating security risks in medical devices.
NIST SP 800-66 Rev. 1 [25]	2008	An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule:	This document provides guidance on how to comply with the HIPAA Security Rule, which is relevant to medical devices that handle protected health data.

Table 2. NIST standards that can be applied for auditing medical device infrastructure.

Normative	Year	Name	Description
NIST Cybersecurity Framework (CSF) [17]	2024	-	A flexible, risk-based framework for improving cybersecurity in critical infrastructure, including the healthcare sector. Medical device manufacturers and users can use this framework to develop and improve cybersecurity programs.
NIST SP 800-63-3 [18]	2023	Digital Identity Guidelines:	Guides digital identity management; relevant for medical devices that require authentication and access control.
NIST Special Publication (SP) 800-53 Rev. 5 [19]	2020	Security and Privacy Controls for Information Systems and Organizations	Provides a catalog of security and privacy controls to protect information and information systems, including those used in medical devices.
NIST SP 800-37 Rev. 2 [20]	2018	Risk Management Framework for Information Systems and Organizations	A “System Life Cycle Approach for Security and Privacy" describes the NIST risk management framework, which can be applied to manage security and privacy risks in medical devices throughout their life cycle.
NIST SP 1800-1 [21]	2018	Securing Electronic Health Records on Mobile Devices	Provides practical examples and reference architectures for protecting electronic health records on mobile devices, applicable to mobile and wearable medical devices.
NIST SP 800-82 Rev. 2 [22]	2015	Guide to Industrial Control Systems (ICSs) Security:	This document provides guidance on the security of industrial control systems, which may apply to certain medical devices operating in industrial or manufacturing environments.
NIST SP 800-88 Rev. 1 [23]	2014	Guidelines for Media Sanitization	Provides guidelines for the secure disposal of data on storage media, applicable to medical devices that store sensitive information.
NIST SP 800-30 Rev. 1 [24]	2012	Guide for Conducting Risk Assessments	Guides performing risk assessments are essential for identifying and mitigating security risks in medical devices.
NIST SP 800-66 Rev. 1 [25]	2008	An Introductory Resource Guide for Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule:	This document provides guidance on how to comply with the HIPAA Security Rule, which is relevant to medical devices that handle protected health data.

• HIPAA

HIPAA, which stands for the Health Insurance Portability and Accountability Act, is US legislation enacted in 1996. Its primary objective is to protect the privacy and security of patients’ medical information and ensure the continuity of health insurance coverage [26].

Table 3. HIPAA and its supporting regulations (Privacy, Security, National Identifiers, Transactions and Codes, and Breach Notification).

Normative	Year	Name	Description
HIPAA	1996	Original HIPAA law published	The original law was enacted to enhance health insurance portability, reduce fraud and the abuse in healthcare, and establish standards for the security and privacy of health information.
	2000	Publication of the Privacy Rule	It establishes national standards for protecting Protected Health Information (PHI), limiting its use and disclosure and granting a patient rights regarding their information.
	2003	Publication of the Security Rule	It requires the implementation of administrative, physical, and technical security measures to protect electronic Protected Health Information (PHI) and ensure its confidentiality, integrity, and availability.
	2004	Publication of the National Identifier Rule	It requires the implementation of administrative, physical, and technical security measures to protect electronic Protected Health Information (PHI) and ensure its confidentiality, integrity, and availability.
	2000	Publication of the Transactions and Codes Rule	It establishes standards for electronic healthcare transactions and codes, promoting standardization and simplifying administrative processes.
	2009	Publication of the Breach Notification Rule	It requires covered entities and their business associates to notify affected individuals, the Department of Health and Human Services (HHS), and, in some cases, the media in the event of an unsecured Protected Health Information (PHI) breach.

Table 3. HIPAA and its supporting regulations (Privacy, Security, National Identifiers, Transactions and Codes, and Breach Notification).

Normative	Year	Name	Description
HIPAA	1996	Original HIPAA law published	The original law was enacted to enhance health insurance portability, reduce fraud and the abuse in healthcare, and establish standards for the security and privacy of health information.
	2000	Publication of the Privacy Rule	It establishes national standards for protecting Protected Health Information (PHI), limiting its use and disclosure and granting a patient rights regarding their information.
	2003	Publication of the Security Rule	It requires the implementation of administrative, physical, and technical security measures to protect electronic Protected Health Information (PHI) and ensure its confidentiality, integrity, and availability.
	2004	Publication of the National Identifier Rule	It requires the implementation of administrative, physical, and technical security measures to protect electronic Protected Health Information (PHI) and ensure its confidentiality, integrity, and availability.
	2000	Publication of the Transactions and Codes Rule	It establishes standards for electronic healthcare transactions and codes, promoting standardization and simplifying administrative processes.
	2009	Publication of the Breach Notification Rule	It requires covered entities and their business associates to notify affected individuals, the Department of Health and Human Services (HHS), and, in some cases, the media in the event of an unsecured Protected Health Information (PHI) breach.

• ENISA

ENISA (European Union Agency for Cybersecurity) is not a legal regulation like HIPAA, but rather an agency that provides guidelines, recommendations, and best practices in cybersecurity. Its main objective is to promote cybersecurity across Europe [27].

Table 4. ENISA good practices for the security of healthcare services.

Normative	Year	Name	Description
ENISA Good practices for the security of healthcare services [28]	2017	Professional services	It includes consulting, audits, and technical support. Good practices encompass cybersecurity training, restricted access policies, and continuous risk management.
		Remote care systems	It includes telemedicine systems and remote patient monitoring. It is recommended to use secure connections, robust authentication, and personal and health data protection.
		Building management systems	They manage the physical infrastructure of healthcare buildings (HVAC, lighting, security). Practices include network segmentation, continuous monitoring, and regular software updates.
		Clinical information systems	They handle clinical information, such as electronic health records (EHR/EMR). Implementing role-based access controls, data encryption, and audits of access and modifications is crucial.
		Cloud services	Cloud services for storing and processing health data. Best practices include vendor security assessment, encryption, and disaster recovery plans.
		Identification systems	Verify the identity of users and devices. Multi-factor authentication, identity management, and monitoring of authentication activities are recommended.
		Industrial control systems	They control industrial processes in healthcare facilities. Practices include network segmentation, real-time monitoring, and regular system updates.
		Medical devices	It connected medical devices that manage patient data. Security by design, data encryption, and threat monitoring are essential.
		Mobile client devices	Healthcare professionals and patients use mobile devices. Secure applications, mobile device management policies, and malware protection are recommended.
		Network equipment	Network equipment that supports healthcare IT infrastructure. Best practices include implementing firewalls, network segmentation, and updating network firmware and software.

Table 4. ENISA good practices for the security of healthcare services.

Normative	Year	Name	Description
ENISA Good practices for the security of healthcare services [28]	2017	Professional services	It includes consulting, audits, and technical support. Good practices encompass cybersecurity training, restricted access policies, and continuous risk management.
		Remote care systems	It includes telemedicine systems and remote patient monitoring. It is recommended to use secure connections, robust authentication, and personal and health data protection.
		Building management systems	They manage the physical infrastructure of healthcare buildings (HVAC, lighting, security). Practices include network segmentation, continuous monitoring, and regular software updates.
		Clinical information systems	They handle clinical information, such as electronic health records (EHR/EMR). Implementing role-based access controls, data encryption, and audits of access and modifications is crucial.
		Cloud services	Cloud services for storing and processing health data. Best practices include vendor security assessment, encryption, and disaster recovery plans.
		Identification systems	Verify the identity of users and devices. Multi-factor authentication, identity management, and monitoring of authentication activities are recommended.
		Industrial control systems	They control industrial processes in healthcare facilities. Practices include network segmentation, real-time monitoring, and regular system updates.
		Medical devices	It connected medical devices that manage patient data. Security by design, data encryption, and threat monitoring are essential.
		Mobile client devices	Healthcare professionals and patients use mobile devices. Secure applications, mobile device management policies, and malware protection are recommended.
		Network equipment	Network equipment that supports healthcare IT infrastructure. Best practices include implementing firewalls, network segmentation, and updating network firmware and software.

• GDPR

The General Data Protection Regulation (GDPR) establishes principles and requirements for the protection of personal data within the European Union. Although there are no specific GDPR controls exclusively for medical devices, its general principles apply to any processing of personal data, including that performed by these devices [29].

Table 5. Details of the GDPR rules and principles.

Normative	Year	Name	Description
GDRP	2016	Fundamental Principles	Since its adoption in 2016 and enforcement in 2018, the GDPR has established principles for processing personal data, ensuring that it is lawful, fair, transparent, and limited to specific purposes.
		Informed Consent	It requires that users expressly, informally, and freely consent to the processing of personal data, especially in the sensitive context of medical data.
	2018	Rights of Interested Parties	Since 2018, it has ensured rights such as access, rectification, erasure, and data portability, allowing individuals to control their personal information.
		Data Security	It requires the implementation of appropriate technical and organizational measures to protect personal data against loss or unauthorized access, which is essential for medical devices handling sensitive data.
		Data Protection Impact Assessments (DPIA)	It establishes the need to conduct impact assessments when data processing involves high risks to individuals’ rights and freedoms, including situations that may arise with medical devices.
		Responsibility and Compliance	Manufacturers and suppliers must demonstrate compliance with GDPR requirements, maintain records of processing activities, and cooperate with data protection authorities from the date of enforcement.

Table 5. Details of the GDPR rules and principles.

Normative	Year	Name	Description
GDRP	2016	Fundamental Principles	Since its adoption in 2016 and enforcement in 2018, the GDPR has established principles for processing personal data, ensuring that it is lawful, fair, transparent, and limited to specific purposes.
		Informed Consent	It requires that users expressly, informally, and freely consent to the processing of personal data, especially in the sensitive context of medical data.
	2018	Rights of Interested Parties	Since 2018, it has ensured rights such as access, rectification, erasure, and data portability, allowing individuals to control their personal information.
		Data Security	It requires the implementation of appropriate technical and organizational measures to protect personal data against loss or unauthorized access, which is essential for medical devices handling sensitive data.
		Data Protection Impact Assessments (DPIA)	It establishes the need to conduct impact assessments when data processing involves high risks to individuals’ rights and freedoms, including situations that may arise with medical devices.
		Responsibility and Compliance	Manufacturers and suppliers must demonstrate compliance with GDPR requirements, maintain records of processing activities, and cooperate with data protection authorities from the date of enforcement.

• HITRUST

HITRUST (Health Information Trust Alliance) is a non-profit organization that develops and maintains the HITRUST Information Security Framework (HITRUST CSF). This set of controls and best practices is specifically designed to manage information security risks in the healthcare sector and related industries [7].

Table 6. Description and features of the framework HITRUST.

Normative	Year	Name	Description
HITRUST	2007	Integral Approach	It provides a comprehensive approach to information security risk management, integrating and harmonizing multiple standards and regulations, such as HIPAA, NIST, ISO, and COBIT. This makes it easier for organizations to comply with multiple regulatory requirements using a single framework.
		Adaptability	It is adaptable to different sizes of organizations and types of entities, from small clinics to large health systems and health-related service providers. This allows organizations to customize the implementation of controls based on their specific needs and operating environment.
		Control-Based Structure	The HITRUST CSF is structured around a set of information security controls organized into domains covering critical areas such as access control, asset management, data protection, and incident response. This facilitates the assessment and continuous improvement of an organization’s security posture.
		Assessment and Certification	HITRUST offers a formal assessment and certification process where organizations can independently review their compliance with the HITRUST CSF. This provides external validation that the recommended security controls and practices have been adequately implemented.
		Risk Management Orientation	The HITRUST CSF framework focuses on risk management, not just the adoption of security controls. This involves ongoing risk assessment, implementing controls proportionate to those risks, and responding effectively to security incidents.
		Multi-sectoral Application	Although initially developed for the healthcare sector, the HITRUST CSF also applies to other sectors that handle sensitive and critical information, such as the financial, government, and service sectors.

Table 6. Description and features of the framework HITRUST.

Normative	Year	Name	Description
HITRUST	2007	Integral Approach	It provides a comprehensive approach to information security risk management, integrating and harmonizing multiple standards and regulations, such as HIPAA, NIST, ISO, and COBIT. This makes it easier for organizations to comply with multiple regulatory requirements using a single framework.
		Adaptability	It is adaptable to different sizes of organizations and types of entities, from small clinics to large health systems and health-related service providers. This allows organizations to customize the implementation of controls based on their specific needs and operating environment.
		Control-Based Structure	The HITRUST CSF is structured around a set of information security controls organized into domains covering critical areas such as access control, asset management, data protection, and incident response. This facilitates the assessment and continuous improvement of an organization’s security posture.
		Assessment and Certification	HITRUST offers a formal assessment and certification process where organizations can independently review their compliance with the HITRUST CSF. This provides external validation that the recommended security controls and practices have been adequately implemented.
		Risk Management Orientation	The HITRUST CSF framework focuses on risk management, not just the adoption of security controls. This involves ongoing risk assessment, implementing controls proportionate to those risks, and responding effectively to security incidents.
		Multi-sectoral Application	Although initially developed for the healthcare sector, the HITRUST CSF also applies to other sectors that handle sensitive and critical information, such as the financial, government, and service sectors.

• WHO

The World Health Organization (WHO) does not issue specific regulations on cybersecurity for medical devices. Its main focus is on promoting public health, coordinating international efforts, and providing guidelines on global health policies. However, other international organizations and specialized standards provide guidelines and recommendations related to cybersecurity applied to medical devices [28].

3.2.2. Literature Review

In the last decade, cybersecurity and information protection have emerged as critical research areas, driven by the rise of cyber threats and the growing need to safeguard sensitive data [30]. This literature review examines key scientific studies in these fields, aiming to identify emerging trends, current challenges, and significant technological advancements. Through an in-depth analysis of recent publications, the review seeks to provide a detailed overview of the current research landscape, highlighting the approaches and solutions proposed in the most relevant studies. As a result of this analysis, valuable information was extracted to develop an integral security pillars model focused on medical devices based on the scientific articles and data collected on the most common vulnerabilities identified by manufacturers.

• Review of Scientific Articles

The following compilation of information presents scientific articles that address relevant topics for the creation of the integral security pillars model, such as cybersecurity, associated technologies, and studies on cyberattacks, as shown in Table 7.

Table 7. Compilation of scientific articles from 2017 to 2025.

Year	Title	Variable
2025	Cybersecurity Risk Assessment Frameworks For Engineering Databases: A Systematic Literature Review [31]	Data Security, Cybersecurity Threats, Healthcare Technology, GDPR, Attacks, IoMT Devices, Framework, Threat Detection Rate, Incident Response Time, System Uptime, Cost Efficiency.
2025	Intelligent two-phase dual authentication framework for Internet of Medical Things [32]	Internet of Medical Things (IoMT), Authentication Framework, Dual Authentication, Elliptic Curve Diffie–Hellman (ECDH), Security, Efficiency, Computational Cost, Latency, Packet Delivery Ratio, Cyber Threats.
2025	A comprehensive and systematic literature review on intrusion detection systems in the internet of medical things: current status, challenges, and opportunities [33]	Internet of Medical Things (IoMT), Intrusion Detection System (IDS), Cybersecurity, Artificial Intelligence (AI), Machine Learning (ML) and Deep Learning (DL), Datasets, Security Requirements, Intrusion Detection Process, Evaluation Metrics
2025	A New Model to Evaluate Signature and Anomaly Based Intrusion Detection in Medical IoT System Using Ensemble Approach [34]	Internet of Medical Things (IoMT), Intrusion Detection System (IDS), Ensemble Learning, Machine Learning (ML), Data Traffic, Signatures and Anomalies, Cyberattacks, Signatures and Anomalies
2025	A risk and conformity assessment framework to ensure security and resilience of healthcare systems and medical supply chain [35]	Healthcare Sector, Digital Transformation, Internet of Medical Things (IoMT), Connected Medical Devices, Healthcare Information Infrastructure (HCII), Cybersecurity Challenges, Risk and Conformity Assessment (RCA) Framework, (ISMS), Artificial Intelligence (AI), Risk Management, Security Controls, Regulatory Compliance, Cyberattacks, Medical Devices
2025	Maximizing healthcare security outcomes through AI/ML multi-label classification approach on IoHT devices [36]	Cybersecurity, Internet of Health Things (IoHT), AI/ML, Multi-Label Classification, Anomaly Detection, ECU Ioht Dataset, ARP Spoofing, DoS, Nmap Port Scan, Smurf Attack, Attacks
2025	Next-Gen fortified health monitoring for cyber physical systems in internet of things using logistic maps based encryption [37]	Health Monitoring Systems, Internet of Things (IoT), Cyber-Physical Systems (CPS), Encryption, Chaotic Mapping, ASCON Algorithm, Data Integrity, Randomization, Computational Overhead, Lightweight Cryptography (LWC), Health Data
2025	An advanced data analytics approach to a cognitive cyber-physical system for the identi-fication and mitigation of cyber threats in the medical internet of things (MIoT) [38]	Medical Internet of Things (MIoT), Cognitive Cyber-Physical System (CCPS), Cyber Threats, Anomaly Detection, Gated Recurrent Units (GRUs), Dense Neural Network (DNN), Whale Optimization Algorithm (WOA), Datasets
2025	Stacking Ensemble Deep Learning for Real-Time Intrusion Detection in IoMT Environ-ments [39]	Internet of Medical Things (IoMT), Cyber Threats, Intrusion Detection System (IDS), Machine Learning (ML), Deep Learning (DL), Stacking Ensemble Method, Kappa Architecture, ARP Spoofing, DoS, Smurf, Port Scan, Binary Classification, Multi-Class Classification
2025	Digital Health: The Cybersecurity for AI-based healthcare communication [40]	AI-Based Healthcare, Cybersecurity, Digital Health, Proactive System, Ransomware Attacks, AI Algorithms, Healthcare, Communication, Digital Inclusion, AI-Based Healthcare, Evolving Threats, Scalability of Networks, Authorization Methods
2025	Efficient lightweight cryptographic solutions for enhancing data security in healthcare systems based on IoT [41]	Internet of Things (IoT), Health Monitoring Systems, CPS, Cryptographic Techniques, Lightweight Cryptography (LWC), Authenticated Encryption, Permutation and Substitution Techniques Chaotic Maps, Hyper-Chaotic Systems, Fibonacci Q-Matrix, Cryptanalysis
2024	Cybersecurity and use of ICT in the health sector [42]	Cybersecurity, Risks, Threats, Health Sector, Digital Medical Records, Bioethical Implications, Vulnerabilities in Connected Medical Devices, Telemedicine.
2024	Machine learning cryptography methods for IoT in healthcare [43]	Machine Learning Cryptography Methods, IoT (Internet of Things), Healthcare
2024	Cybersecurity policy framework requirements for the establishment of highly interoperable and interconnected health data spaces [44]	Cybersecurity Policy, Interoperability of Health Data, Interconnectedness of Health Data Spaces.
2024	The need for cybersecurity self-evaluation in healthcare [45]	Cybersecurity Self-Evaluation, Healthcare.
2024	Managing cybersecurity risk in healthcare settings [46]	Managing Cybersecurity Risk, Healthcare Settings, Cybersecurity Threats, Environment.
2024	A Review on the Application of Internet of Medical Things in Wearable Personal Health Monitoring: A Cloud-Edge Artificial Intelligence Approach [47]	Internet of Medical Things (IoMT), Wearable Personal Health Monitoring, Cloud-Edge Artificial Intelligence Approach, Healthcare, IoMT System.
2024	Developing a Novel Ontology for Cybersecurity in Internet of Medical Things-Enabled Remote Patient Monitoring [48]	Cybersecurity, Internet of Medical Things (IoMT), Remote Patient Monitoring, Novel Ontology.
2024	Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review [49]	Vulnerability, Cyberattacks, Sociotechnical Solutions, Health Care Systems, Healthcare.
2024	Cyberattacks on health care-a growing threat [50]	Ransomware Attack, WannaCry, Healthcare Cyberattack, Phishing Scams, Health Care, Growing Threat.
2024	QUMA: Quantum Unified Medical Architecture Using Blockchain [51]	QUMA Architecture, Blockchain, Medical Sector, Security, Transparency.
2023	New cybersecurity requirements for medical devices in the eu: the forthcoming european health data space, data act, and artificial intelligence act [52]	Cybersecurity Requirements, Medical Devices, Health Data Space, Data Act, Artificial Intelligence, European Health.
2023	Insights into security and privacy issues in smart healthcare systems based on medical images [53]	Security Issues, Privacy Issues, Smart Healthcare Systems, Medical Images, Confidentiality, Unauthorized Access, Threats.
2023	Cybersecurity in Internet of Medical Vehicles: State-of-the-Art Analysis, Research Challenges and Future Perspectives [54]	Cybersecurity, Internet of Medical Vehicles (IoMV), State-of-the-Art Analysis, Research Challenges, Future Perspectives.
2023	Attack Detection for Medical Cyber-Physical Systems–A Systematic Literature Review [55]	Attack Detection, Medical Cyber-Physical Systems (Mcps), Systematic Literature Review, Synthesize.
2023	Framework for a Secure and Sustainable Internet of Medical Things, Requirements, Design Challenges, and Future Trends [56]	Patient Health Data, IoMT System, IoMT System Design and Implementation, Architecture, Security Measures, Healthcare Systems, System Performance and Effectiveness, User Interaction and Acceptance, Response Time, Sensitivity, Specificity, Accuracy, and Error Rates.
2022	A cybersecurity culture survey targeting healthcare critical infrastructures [57]	Cybersecurity Culture Survey, Healthcare Critical Infrastructures, Awareness of Cyber Threats, Security Behaviors, Compliance With Security Policies.
2022	Cyber security in health: Standard protocols for IoT and supervisory control systems [58]	IoT Devices, Data Breaches, Cybersecurity Budgets, Medical Equipment, Artificial Organs, Biosensors, Information, Medical Records, Networks.
2022	A review on healthcare data privacy and security [59]	Cloud Computing and Healthcare, Viruses and Worms, Botnets, Ransomware, Phishing, Cloud, Cyberattacks, Identify Theft, Security, Blockchain, Legal Aspect, Remote Patient Monitoring.
2021	Influence of human factors on cyber security within healthcare organisations: A systematic review [60]	Systematic Review, Human Factors, Cyber Security, Healthcare, Data Extraction, Risk of Bias, Cyber Risk, Economic Impact of Data Breaches, ICT Infrastructure, Cybercrime, Cyberattacks, Cybersecurity, Governance Strategies.
2021	A survey on security and privacy issues in modern healthcare systems: Attacks and defenses [61]	Protect Healthcare Systems, Privacy Issues, Phishing Attack, Brute Force Attack, Keylogger Attack, Man-in-the-Middle Attack, Eavesdropping Attack, Pharming Attack, Denial of Service (DoS) Attack, Healthcare Systems, Types of Attacks, Cybersecurity Countermeasures, Cybersecurity Vulnerabilities.
2020	Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review [62]	Endpoint Complexity, Human Factors, Phishing, Ransomware, Distributed Denial of Service (DDoS), Malware, Published Vulnerabilities, Innumerable Wireless Connected Devices, Reliance on Perimeter Defense, Remote Working Security Assurance, VPN, RDP, Integration of New Endpoint Devices with Legacy Systems.
2020	Artificial intelligence in healthcare: An essential guide for health leaders [63]	Artificial Intelligence (AI), Machine Learning (ML), Natural Language Processing (NLP), AI Voice Technology and Assistants, Medical Robotics, Electronic Health Records (EHRs), Clinical Decision Support, Patient Self-Management, Drug Research, Medical Imaging, Genomics, Telehealth, Big Data, Remote Healthcare.
2020	Integration of cyber security in healthcare equipment [64]	Operational Technologies (OTs), Information Technologies (ITs), Cyber Security Risks, Operational Risks, Healthcare Equipment, Vulnerabilities, Cyberattacks, Safety, Security Controls and Mitigation.
2020	Cybersecurity in PACS and Medical Imaging: An Overview [65]	PACS, Medical Imaging, Cybersecurity, Healthcare IT, Physical Mitigation Measures, Technical Mitigation Measures, Organizational Mitigation Measures, Image De-Identification, Transport Security, DICOM, Digital Signatures, Watermarking Techniques, Authenticity, Integrity, Healthcare.
2020	Medical device safety management using cybersecurity risk analysis [66]	MEMPs, Medical Devices, ICT, Security Threats, Cybersecurity, Risk Management, Internet of Things (IoT), Implantable Medical Devices (IMDs), Attack Occurrence Probability (AOP), Attack Success Probability (ASP), Fennigkoh Model, Smith Model, Analytic Hierarchy Process (AHP).
2020	An exhaustive survey on security and privacy issues in Healthcare 4.0 [67]	Healthcare 1.0 To 4.0, Electronic Healthcare Records (EHRs), Cloud Computing (CC), Fog Computing (FC), Internet of Things (IoT), Telehealthcare, Security, Privacy, Blockchain, Wearable Devices (WDs), Biometric, Network Traffic, Machine Learning (ML).
2019	Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions [68]	Cybersecurity, Phishing, Phishing Simulation, Health Care Delivery, Health Care Data and Systems, Email Click Rate, Employee Awareness and Training, Phishing Attacks.
2019	Health care and cybersecurity: bibliometric analysis of the literature [69]	Cybersecurity, Healthcare Delivery, Healthcare Information Systems, Cyberattacks, Data Breaches, Ransomware, Phishing, Security Incidents, Mitigation Measures, Vulnerabilities, Weaknesses, Exploit, Confidentiality, Integrity, Availability.
2019	Security Vulnerabilities, Attacks, Countermeasures, and Regulations of Networked Medical Devices—A Review [70]	Networked Medical Devices, Medical Telemetry, Security Vulnerabilities, Cyberattacks, Countermeasures, Regulations, FDA, HIPAA, GDPR.
2019	Medical device vulnerability mitigation effort gap analysis taxonomy [71]	Medical Devices, Vulnerabilities, Mitigation, Cybersecurity, Associated Parties, Effort, Risk Assessment, Data Breaches, Healthcare, Standards Organizations, Academia, Device Manufacturers, Including Authorities, Sensitive Data.
2019	Integrated security, safety, and privacy risk assessment framework for medical devices [72]	Medical Devices, Security, Safety, Privacy, Risk Assessment, FDA (Food and Drug Administration), EU (European Union), MDR (Medical Device Regulation), CVSS (Common Vulnerability Scoring System), CWE (Common Weaknesses Enumeration), Cyber Threats, Healthcare.
2018	Cybersecurity in healthcare: A narrative review of trends, threats and ways forward [73]	Cybersecurity, Healthcare, Medical Devices, Electronic Health Records (EHRs), Hacking, Malware, Ransomware, Insider Threats, Vulnerabilities to Exploit, WannaCry Attack, General Data Protection Regulation (GDPR), Internet of Things (IoT).
2018	Cybersecurity in Hospitals: A Systematic, Organizational Perspective [74]	HITECH, HIPAA, National Institute of Standards and Technology (NIST), Internal Politics, Technology Saturated Environment, Cybersecurity, FDA, Cybercriminal, Hospital Systems, Cyberattacks.
2018	Cyber Attacks Classification in IoT-Based-Healthcare Infrastructure [75]	Cyberattacks in IoT-Based Healthcare Infrastructure, Independent Variables, Attack Vectors/Types, Malicious Action, Infrastructure Layers, Specific Attack Classifications, Session Medjacking, Ransomware, Denial Of Service, RFID-Related Attacks, Malware Injection Attacks, Vulnerabilities, Threats, Risks, Weaknesses in IoT Systems.
2018	Cybersecurity of healthcare IoT-based systems: Regulation and case-oriented assessment [76]	Cybersecurity of IoT-Based Healthcare Systems, Cybersecurity, International Regulations and Standards, ISO, IEC, HIPAA, IoT Architecture, IoT Healthcare Architecture Layers, Cybersecurity Assessment, Protected Health Information (PHI), Threats and Vulnerabilities, Sensing, Network, Service, Application Interfaces.
2017	Cybersecurity in healthcare: A systematic review of modern threats and trends [77]	Cybersecurity Threats, Healthcare Technology, Data Breaches, Security Measures, Government Regulations and Policies, ACA, HITECH, Security, Medical Information, HIPAA, Ransomware.

Table 7. Compilation of scientific articles from 2017 to 2025.

Year	Title	Variable
2025	Cybersecurity Risk Assessment Frameworks For Engineering Databases: A Systematic Literature Review [31]	Data Security, Cybersecurity Threats, Healthcare Technology, GDPR, Attacks, IoMT Devices, Framework, Threat Detection Rate, Incident Response Time, System Uptime, Cost Efficiency.
2025	Intelligent two-phase dual authentication framework for Internet of Medical Things [32]	Internet of Medical Things (IoMT), Authentication Framework, Dual Authentication, Elliptic Curve Diffie–Hellman (ECDH), Security, Efficiency, Computational Cost, Latency, Packet Delivery Ratio, Cyber Threats.
2025	A comprehensive and systematic literature review on intrusion detection systems in the internet of medical things: current status, challenges, and opportunities [33]	Internet of Medical Things (IoMT), Intrusion Detection System (IDS), Cybersecurity, Artificial Intelligence (AI), Machine Learning (ML) and Deep Learning (DL), Datasets, Security Requirements, Intrusion Detection Process, Evaluation Metrics
2025	A New Model to Evaluate Signature and Anomaly Based Intrusion Detection in Medical IoT System Using Ensemble Approach [34]	Internet of Medical Things (IoMT), Intrusion Detection System (IDS), Ensemble Learning, Machine Learning (ML), Data Traffic, Signatures and Anomalies, Cyberattacks, Signatures and Anomalies
2025	A risk and conformity assessment framework to ensure security and resilience of healthcare systems and medical supply chain [35]	Healthcare Sector, Digital Transformation, Internet of Medical Things (IoMT), Connected Medical Devices, Healthcare Information Infrastructure (HCII), Cybersecurity Challenges, Risk and Conformity Assessment (RCA) Framework, (ISMS), Artificial Intelligence (AI), Risk Management, Security Controls, Regulatory Compliance, Cyberattacks, Medical Devices
2025	Maximizing healthcare security outcomes through AI/ML multi-label classification approach on IoHT devices [36]	Cybersecurity, Internet of Health Things (IoHT), AI/ML, Multi-Label Classification, Anomaly Detection, ECU Ioht Dataset, ARP Spoofing, DoS, Nmap Port Scan, Smurf Attack, Attacks
2025	Next-Gen fortified health monitoring for cyber physical systems in internet of things using logistic maps based encryption [37]	Health Monitoring Systems, Internet of Things (IoT), Cyber-Physical Systems (CPS), Encryption, Chaotic Mapping, ASCON Algorithm, Data Integrity, Randomization, Computational Overhead, Lightweight Cryptography (LWC), Health Data
2025	An advanced data analytics approach to a cognitive cyber-physical system for the identi-fication and mitigation of cyber threats in the medical internet of things (MIoT) [38]	Medical Internet of Things (MIoT), Cognitive Cyber-Physical System (CCPS), Cyber Threats, Anomaly Detection, Gated Recurrent Units (GRUs), Dense Neural Network (DNN), Whale Optimization Algorithm (WOA), Datasets
2025	Stacking Ensemble Deep Learning for Real-Time Intrusion Detection in IoMT Environ-ments [39]	Internet of Medical Things (IoMT), Cyber Threats, Intrusion Detection System (IDS), Machine Learning (ML), Deep Learning (DL), Stacking Ensemble Method, Kappa Architecture, ARP Spoofing, DoS, Smurf, Port Scan, Binary Classification, Multi-Class Classification
2025	Digital Health: The Cybersecurity for AI-based healthcare communication [40]	AI-Based Healthcare, Cybersecurity, Digital Health, Proactive System, Ransomware Attacks, AI Algorithms, Healthcare, Communication, Digital Inclusion, AI-Based Healthcare, Evolving Threats, Scalability of Networks, Authorization Methods
2025	Efficient lightweight cryptographic solutions for enhancing data security in healthcare systems based on IoT [41]	Internet of Things (IoT), Health Monitoring Systems, CPS, Cryptographic Techniques, Lightweight Cryptography (LWC), Authenticated Encryption, Permutation and Substitution Techniques Chaotic Maps, Hyper-Chaotic Systems, Fibonacci Q-Matrix, Cryptanalysis
2024	Cybersecurity and use of ICT in the health sector [42]	Cybersecurity, Risks, Threats, Health Sector, Digital Medical Records, Bioethical Implications, Vulnerabilities in Connected Medical Devices, Telemedicine.
2024	Machine learning cryptography methods for IoT in healthcare [43]	Machine Learning Cryptography Methods, IoT (Internet of Things), Healthcare
2024	Cybersecurity policy framework requirements for the establishment of highly interoperable and interconnected health data spaces [44]	Cybersecurity Policy, Interoperability of Health Data, Interconnectedness of Health Data Spaces.
2024	The need for cybersecurity self-evaluation in healthcare [45]	Cybersecurity Self-Evaluation, Healthcare.
2024	Managing cybersecurity risk in healthcare settings [46]	Managing Cybersecurity Risk, Healthcare Settings, Cybersecurity Threats, Environment.
2024	A Review on the Application of Internet of Medical Things in Wearable Personal Health Monitoring: A Cloud-Edge Artificial Intelligence Approach [47]	Internet of Medical Things (IoMT), Wearable Personal Health Monitoring, Cloud-Edge Artificial Intelligence Approach, Healthcare, IoMT System.
2024	Developing a Novel Ontology for Cybersecurity in Internet of Medical Things-Enabled Remote Patient Monitoring [48]	Cybersecurity, Internet of Medical Things (IoMT), Remote Patient Monitoring, Novel Ontology.
2024	Vulnerability to Cyberattacks and Sociotechnical Solutions for Health Care Systems: Systematic Review [49]	Vulnerability, Cyberattacks, Sociotechnical Solutions, Health Care Systems, Healthcare.
2024	Cyberattacks on health care-a growing threat [50]	Ransomware Attack, WannaCry, Healthcare Cyberattack, Phishing Scams, Health Care, Growing Threat.
2024	QUMA: Quantum Unified Medical Architecture Using Blockchain [51]	QUMA Architecture, Blockchain, Medical Sector, Security, Transparency.
2023	New cybersecurity requirements for medical devices in the eu: the forthcoming european health data space, data act, and artificial intelligence act [52]	Cybersecurity Requirements, Medical Devices, Health Data Space, Data Act, Artificial Intelligence, European Health.
2023	Insights into security and privacy issues in smart healthcare systems based on medical images [53]	Security Issues, Privacy Issues, Smart Healthcare Systems, Medical Images, Confidentiality, Unauthorized Access, Threats.
2023	Cybersecurity in Internet of Medical Vehicles: State-of-the-Art Analysis, Research Challenges and Future Perspectives [54]	Cybersecurity, Internet of Medical Vehicles (IoMV), State-of-the-Art Analysis, Research Challenges, Future Perspectives.
2023	Attack Detection for Medical Cyber-Physical Systems–A Systematic Literature Review [55]	Attack Detection, Medical Cyber-Physical Systems (Mcps), Systematic Literature Review, Synthesize.
2023	Framework for a Secure and Sustainable Internet of Medical Things, Requirements, Design Challenges, and Future Trends [56]	Patient Health Data, IoMT System, IoMT System Design and Implementation, Architecture, Security Measures, Healthcare Systems, System Performance and Effectiveness, User Interaction and Acceptance, Response Time, Sensitivity, Specificity, Accuracy, and Error Rates.
2022	A cybersecurity culture survey targeting healthcare critical infrastructures [57]	Cybersecurity Culture Survey, Healthcare Critical Infrastructures, Awareness of Cyber Threats, Security Behaviors, Compliance With Security Policies.
2022	Cyber security in health: Standard protocols for IoT and supervisory control systems [58]	IoT Devices, Data Breaches, Cybersecurity Budgets, Medical Equipment, Artificial Organs, Biosensors, Information, Medical Records, Networks.
2022	A review on healthcare data privacy and security [59]	Cloud Computing and Healthcare, Viruses and Worms, Botnets, Ransomware, Phishing, Cloud, Cyberattacks, Identify Theft, Security, Blockchain, Legal Aspect, Remote Patient Monitoring.
2021	Influence of human factors on cyber security within healthcare organisations: A systematic review [60]	Systematic Review, Human Factors, Cyber Security, Healthcare, Data Extraction, Risk of Bias, Cyber Risk, Economic Impact of Data Breaches, ICT Infrastructure, Cybercrime, Cyberattacks, Cybersecurity, Governance Strategies.
2021	A survey on security and privacy issues in modern healthcare systems: Attacks and defenses [61]	Protect Healthcare Systems, Privacy Issues, Phishing Attack, Brute Force Attack, Keylogger Attack, Man-in-the-Middle Attack, Eavesdropping Attack, Pharming Attack, Denial of Service (DoS) Attack, Healthcare Systems, Types of Attacks, Cybersecurity Countermeasures, Cybersecurity Vulnerabilities.
2020	Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review [62]	Endpoint Complexity, Human Factors, Phishing, Ransomware, Distributed Denial of Service (DDoS), Malware, Published Vulnerabilities, Innumerable Wireless Connected Devices, Reliance on Perimeter Defense, Remote Working Security Assurance, VPN, RDP, Integration of New Endpoint Devices with Legacy Systems.
2020	Artificial intelligence in healthcare: An essential guide for health leaders [63]	Artificial Intelligence (AI), Machine Learning (ML), Natural Language Processing (NLP), AI Voice Technology and Assistants, Medical Robotics, Electronic Health Records (EHRs), Clinical Decision Support, Patient Self-Management, Drug Research, Medical Imaging, Genomics, Telehealth, Big Data, Remote Healthcare.
2020	Integration of cyber security in healthcare equipment [64]	Operational Technologies (OTs), Information Technologies (ITs), Cyber Security Risks, Operational Risks, Healthcare Equipment, Vulnerabilities, Cyberattacks, Safety, Security Controls and Mitigation.
2020	Cybersecurity in PACS and Medical Imaging: An Overview [65]	PACS, Medical Imaging, Cybersecurity, Healthcare IT, Physical Mitigation Measures, Technical Mitigation Measures, Organizational Mitigation Measures, Image De-Identification, Transport Security, DICOM, Digital Signatures, Watermarking Techniques, Authenticity, Integrity, Healthcare.
2020	Medical device safety management using cybersecurity risk analysis [66]	MEMPs, Medical Devices, ICT, Security Threats, Cybersecurity, Risk Management, Internet of Things (IoT), Implantable Medical Devices (IMDs), Attack Occurrence Probability (AOP), Attack Success Probability (ASP), Fennigkoh Model, Smith Model, Analytic Hierarchy Process (AHP).
2020	An exhaustive survey on security and privacy issues in Healthcare 4.0 [67]	Healthcare 1.0 To 4.0, Electronic Healthcare Records (EHRs), Cloud Computing (CC), Fog Computing (FC), Internet of Things (IoT), Telehealthcare, Security, Privacy, Blockchain, Wearable Devices (WDs), Biometric, Network Traffic, Machine Learning (ML).
2019	Assessment of Employee Susceptibility to Phishing Attacks at US Health Care Institutions [68]	Cybersecurity, Phishing, Phishing Simulation, Health Care Delivery, Health Care Data and Systems, Email Click Rate, Employee Awareness and Training, Phishing Attacks.
2019	Health care and cybersecurity: bibliometric analysis of the literature [69]	Cybersecurity, Healthcare Delivery, Healthcare Information Systems, Cyberattacks, Data Breaches, Ransomware, Phishing, Security Incidents, Mitigation Measures, Vulnerabilities, Weaknesses, Exploit, Confidentiality, Integrity, Availability.
2019	Security Vulnerabilities, Attacks, Countermeasures, and Regulations of Networked Medical Devices—A Review [70]	Networked Medical Devices, Medical Telemetry, Security Vulnerabilities, Cyberattacks, Countermeasures, Regulations, FDA, HIPAA, GDPR.
2019	Medical device vulnerability mitigation effort gap analysis taxonomy [71]	Medical Devices, Vulnerabilities, Mitigation, Cybersecurity, Associated Parties, Effort, Risk Assessment, Data Breaches, Healthcare, Standards Organizations, Academia, Device Manufacturers, Including Authorities, Sensitive Data.
2019	Integrated security, safety, and privacy risk assessment framework for medical devices [72]	Medical Devices, Security, Safety, Privacy, Risk Assessment, FDA (Food and Drug Administration), EU (European Union), MDR (Medical Device Regulation), CVSS (Common Vulnerability Scoring System), CWE (Common Weaknesses Enumeration), Cyber Threats, Healthcare.
2018	Cybersecurity in healthcare: A narrative review of trends, threats and ways forward [73]	Cybersecurity, Healthcare, Medical Devices, Electronic Health Records (EHRs), Hacking, Malware, Ransomware, Insider Threats, Vulnerabilities to Exploit, WannaCry Attack, General Data Protection Regulation (GDPR), Internet of Things (IoT).
2018	Cybersecurity in Hospitals: A Systematic, Organizational Perspective [74]	HITECH, HIPAA, National Institute of Standards and Technology (NIST), Internal Politics, Technology Saturated Environment, Cybersecurity, FDA, Cybercriminal, Hospital Systems, Cyberattacks.
2018	Cyber Attacks Classification in IoT-Based-Healthcare Infrastructure [75]	Cyberattacks in IoT-Based Healthcare Infrastructure, Independent Variables, Attack Vectors/Types, Malicious Action, Infrastructure Layers, Specific Attack Classifications, Session Medjacking, Ransomware, Denial Of Service, RFID-Related Attacks, Malware Injection Attacks, Vulnerabilities, Threats, Risks, Weaknesses in IoT Systems.
2018	Cybersecurity of healthcare IoT-based systems: Regulation and case-oriented assessment [76]	Cybersecurity of IoT-Based Healthcare Systems, Cybersecurity, International Regulations and Standards, ISO, IEC, HIPAA, IoT Architecture, IoT Healthcare Architecture Layers, Cybersecurity Assessment, Protected Health Information (PHI), Threats and Vulnerabilities, Sensing, Network, Service, Application Interfaces.
2017	Cybersecurity in healthcare: A systematic review of modern threats and trends [77]	Cybersecurity Threats, Healthcare Technology, Data Breaches, Security Measures, Government Regulations and Policies, ACA, HITECH, Security, Medical Information, HIPAA, Ransomware.

3.2.3. Vulnerability and Attack Types Analysis

CVEs (common vulnerabilities and exposures) are unique identifiers assigned to known vulnerabilities and exposures in software and systems [78]. This naming system was developed to facilitate the exchange and comparison of information across various security databases and vulnerability assessment tools. Each CVE includes a brief description, the impact of the vulnerability, and links to additional resources detailing technical aspects and potential solutions. Since the primary purpose of CVEs is to provide a common standard for identifying and describing vulnerabilities, they are essential in this review to highlight trends in recorded attacks. The most recent records from 2018 to 2024 are detailed in Table 8 of the original document.

Table 8. Common vulnerabilities exposed between 2018 and 2024.

Vendor	Model	CVE	Type of Attack
Philips (Andover, MA, USA)	SureSigns VS4	CVE-2020-16237	Exploitable Remotely
		CVE-2020-16239
		CVE-2020-1624
	IntelliVue MX700 and MX800	CVE-2020-16216	Low Attack Complexity
		CVE-2019-13530	Use of Hard-coded Password, Download of Code Without Integrity Check
	IntelliVue MX100	CVE-2020-16214	Low Attack Complexity
	Philips HealthSuite Health Android App, all versions	CVE-2018-19001	Inadequate Encryption Strength
	IntelliBridge EC 40 and 60 Hub	CVE-2021-33017	Authentication Bypass Using an Alternate Path or Channel
GE Healthcare (Chicago, IL, USA)	GE CARESCAPE B450/B650/B850	CVE-2020-6961	Exploitable Remotely/Low Skill Level to Exploit
		CVE-2020-6962
		CVE-2020-6963
		CVE-2020-6964
		CVE-2020-6965
		CVE-2020-6966
	EchoPAC	CVE-2024-27106	Exploitation Activity
	Ultrasound devices	CVE-2024-1628	OS Command Injection Vulnerabilities
	Imaging and Ultrasound Products	CVE-2020-25179	Information Leak
	XZ Utils	CVE-2024-3094	Embedded Malicious Code
Welch Allyn (Skaneateles Falls, NY, USA)	Spot Vital Signs 4400	CVE-2021-27410	Exploitable Remotely
		CVE-2021-27408
	Vital Signs Monitor	CVE-2024-1275	Exploitable Remotely
Dräger (Lübeck, Germany)	Infinity® Delta Series	CVE-2019-6446	Probability of Exploitation Activity
IBM (Armonk, NY, USA)	Merge Healthcare eFilm Workstation	CVE-2024-23619	Execute Code
	Merge Healthcare eFilm Workstation	CVE-2024-23622	Buffer Overflow
	Merge Healthcare eFilm Workstation	CVE-2024-23621	Buffer Overflow
CodeProjects	Health Care hospital Management System v1.0	CVE-2024-38348	SQL Injection Vulnerability
	Health Care hospital Management System v1.0	CVE-2024-38347	SQL Injection Vulnerability

Table 8. Common vulnerabilities exposed between 2018 and 2024.

Vendor	Model	CVE	Type of Attack
Philips (Andover, MA, USA)	SureSigns VS4	CVE-2020-16237	Exploitable Remotely
		CVE-2020-16239
		CVE-2020-1624
	IntelliVue MX700 and MX800	CVE-2020-16216	Low Attack Complexity
		CVE-2019-13530	Use of Hard-coded Password, Download of Code Without Integrity Check
	IntelliVue MX100	CVE-2020-16214	Low Attack Complexity
	Philips HealthSuite Health Android App, all versions	CVE-2018-19001	Inadequate Encryption Strength
	IntelliBridge EC 40 and 60 Hub	CVE-2021-33017	Authentication Bypass Using an Alternate Path or Channel
GE Healthcare (Chicago, IL, USA)	GE CARESCAPE B450/B650/B850	CVE-2020-6961	Exploitable Remotely/Low Skill Level to Exploit
		CVE-2020-6962
		CVE-2020-6963
		CVE-2020-6964
		CVE-2020-6965
		CVE-2020-6966
	EchoPAC	CVE-2024-27106	Exploitation Activity
	Ultrasound devices	CVE-2024-1628	OS Command Injection Vulnerabilities
	Imaging and Ultrasound Products	CVE-2020-25179	Information Leak
	XZ Utils	CVE-2024-3094	Embedded Malicious Code
Welch Allyn (Skaneateles Falls, NY, USA)	Spot Vital Signs 4400	CVE-2021-27410	Exploitable Remotely
		CVE-2021-27408
	Vital Signs Monitor	CVE-2024-1275	Exploitable Remotely
Dräger (Lübeck, Germany)	Infinity® Delta Series	CVE-2019-6446	Probability of Exploitation Activity
IBM (Armonk, NY, USA)	Merge Healthcare eFilm Workstation	CVE-2024-23619	Execute Code
	Merge Healthcare eFilm Workstation	CVE-2024-23622	Buffer Overflow
	Merge Healthcare eFilm Workstation	CVE-2024-23621	Buffer Overflow
CodeProjects	Health Care hospital Management System v1.0	CVE-2024-38348	SQL Injection Vulnerability
	Health Care hospital Management System v1.0	CVE-2024-38347	SQL Injection Vulnerability

3.3. Presentation of the Data and Analysis of the Results

The presentation of the data and the analysis of the results aim to offer a detailed and clear understanding of the information collected. Using tables and graphs, key variables are visualized, which allows for the intuitive identification of significant patterns, relationships, and trends. The graphs provide a visual representation of the data, facilitating the comparison, distribution, and evolution of variables over time. The tables, on the other hand, provide precision and detail, allowing for an analysis of the numerical values.

3.3.1. Analysis of the Data Obtained from the Regulations

Table 9, Table 10, Table 11, Table 12, Table 13 and Table 14 show the key variables according to each of the security regulations analyzed in this article.

Table 9. Key variables by normative ISO.

Normative	Key Variables
ISO 27701	Privacy Information Management, Personal Data, Medical Devices
ISO/IEC 27799	Health Information Security, Personal Health Information (PII), Healthcare Sector
ISO 13485	Quality Management Systems, Risk Management, Medical Devices, Software Security
ISO/IEC 27001	Information Security Management, Sensitive Information, ISMS (Information Security Management System)
ISO/IEC 82304-1	Health Software, Quality Requirements, Safety Requirements, Information Security Standards
ISO/IEC 27002	Information Security Controls, Best Practices, Confidentiality, Integrity, Availability
ISO/IEC 80001-1	Risk Management, IT Networks, Medical Devices, Interoperability, Information Security

Table 10. Key variables by normative NIST.

Normative Standard	Key Variables Identified
NIST Cybersecurity Framework (CSF)	Cybersecurity in critical infrastructure—Risk management—Security protections—Continuous improvement of cybersecurity programs—Applications in medical devices
NIST SP 800-63-3	Digital identity—Authentication—Access control—Data privacy
NIST SP 800-53 Rev. 5	Security controls—Information privacy—Information system protection—Risk management for medical systems—Medical device information security
NIST SP 800-37 Rev. 2	Risk management in medical devices—Cybersecurity throughout the lifecycle—Privacy risk management—Lifecycle-based security approach
NIST SP 1800-1	Protection of electronic health records (EHRs)—Security in mobile and wearable devices—Protection of personal health data—Security architectures for mobile devices
NIST SP 800-82 Rev. 2	Industrial Control Systems (ICS) security—Protection of medical devices in industrial environments—ICS risk management—Compliance with industrial security standards
NIST SP 800-88 Rev. 1	Secure data disposal—Media sanitization—Protection of sensitive data in medical devices—Data disposal policies for medical devices
NIST SP 800-30 Rev. 1	Risk assessment—Threat and vulnerability identification—Risk mitigation methods—Medical device security assessment
NIST SP 800-66 Rev. 1	HIPAA compliance—Protection of protected health data—Security in handling medical data—Security rules for devices handling health information

Table 11. Key variables by normative HIPAA.

Normative	Key Variables
HIPAA (1996)	Health insurance portability, fraud reduction, healthcare security, privacy standards, health info
Privacy Rule (2000)	Protected Health Information (PHI), data protection, use and disclosure limits, patient’s rights
Security Rule (2003)	Administrative security measures, physical security measures, technical security measures, PHI confidentiality, integrity, availability
National Identifier Rule (2004)	PHI security measures, identifier standards, administrative security, technical security
Transactions and Codes Rule (2000)	Electronic healthcare transactions, healthcare codes, standardization, administrative processes
Breach Notification Rule (2009)	PHI breach notification, affected individuals, HHS notification, media notification, unsecured PHI breach

Table 12. Key variables by normative ENISA.

Normative	Key Variables
Good practices for the security of healthcare services	Security in professional services, Consulting, Audits, Technical support, Cybersecurity training, Restricted access policies, Continuous risk management
Remote care systems	Telemedicine, Remote patient monitoring, Secure connections, Robust authentication, Protection of personal and health data
Building management systems	Physical infrastructure of buildings, HVAC management, Lighting, Security, Network segmentation, Continuous monitoring, Software updates
Clinical information systems	Clinical information, Electronic Health Records (EHRs/EMRs), Role-based access control, Data encryption, Audit of access and modifications
Cloud services	Cloud services, Health data storage, Vendor security assessment, Encryption, Disaster recovery plans
Identification systems	Identity verification, Multi-factor authentication, Identity management, Monitoring of authentication activities
Industrial control systems	Industrial processes in healthcare facilities, Network segmentation, Real-time monitoring, Regular system updates
Medical devices	Connected medical devices, Patient data management, Security by design, Data encryption, Threat monitoring
Mobile client devices	Mobile devices in healthcare, Secure applications, Mobile device management policies, Malware protection
Network equipment	Network equipment in healthcare IT infrastructure, Firewalls, Network segmentation, Firmware and software updates

Table 13. Key variables by normative GDPR.

Key Variables	Description
Fundamental Principles	Since its adoption in 2016 and enforcement in 2018, the GDPR has established principles for processing personal data, ensuring that it is lawful, fair, transparent, and limited to specific purposes.
Informed Consent	Requires that users expressly, informally, and freely consent to the processing of personal data, especially in the sensitive context of medical data.
Rights of Interested Parties	Ensures rights such as access, rectification, erasure, and data portability, allowing individuals to control their personal information.
Data Security	Requires the implementation of appropriate technical and organizational measures to protect personal data against loss or unauthorized access, which is essential for medical devices handling sensitive data.
Data Protection Impact Assessments (DPIA)	Establishes the need to conduct impact assessments when data processing involves high risks to individuals’ rights and freedoms, including situations that may arise with medical devices.
Responsibility and Compliance	Manufacturers and suppliers must demonstrate compliance with GDPR requirements, maintain records of processing activities, and cooperate with data protection authorities.

Table 14. Key variables by normative HITRUST.

Category	Variables Key
Adaptability and Customization	Adaptability
Compliance and Certification	Assessment and Certification
Structure and Controls	Control-Based Structure
Approach to Security	Integral Approach
Sector Application	Multi-Sectoral Application
Risk Management	Risk Management Orientation

The graph presents the frequency of the most relevant keywords identified in the analysis of regulations and studies related to cybersecurity in medical devices. See Figure 2.

Figure 2. Word count by occurrence. Graph showing the common key variables in the different regulations analyzed according to Table 9, Table 10, Table 11, Table 12, Table 13 and Table 14 of this article.

3.3.2. Analysis of Data Extracted from the Literature Review

The analysis of the data extracted from the table reveals significant patterns and trends. To facilitate the visualization and interpretation of these findings, a series of graphs illustrating the relationships between the variables and the distribution of the values are presented below. These graphs allow for a clearer and more concise understanding of the information contained in Table 7.

The following graph illustrates the annual evolution in the number of publications related to the analyzed topic, covering the period from 2017 to 2025. See Figure 3.

Figure 3. Number of related articles per year.

The following graph shows the frequency of keyword occurrences in the studies and publications analyzed, providing an overview of the main concepts associated with the topic of cybersecurity in the healthcare sector (Figure 4).

Figure 4. Total words per occurrence. Top 20 words from the “Variables” column corresponding to Table 7.

3.3.3. Analysis of Data Extracted from the Common Vulnerabilities Exposed

The following Table 15 shows a comparison between the vulnerabilities and their relationship with the security regulations.

Table 15. Comparative table of vulnerabilities and their relation to regulations.

CVE	Model	Type of Attack	Normatives
CVE-2025-2230	Philips Intellispace Cardiovascular	Replay attacks, authentication bypass	HITRUST: AC-1, AC-4; NIST SP 800-53: AC-2; ISO 27001: A.9.1
CVE-2025-2229	Philips Intellispace Cardiovascular	Fixed AES-128 encryption key vulnerability	HITRUST: AC-4, SC-7; GDPR: Art. 32; NIST SP 800-53: SC-12, SC-13
CVE-2020-16237	Philips SureSigns VS4	Exploitable remotely	HITRUST: AC-4, SC-7; ISO 27001: A.13.1
CVE-2020-16239	Philips SureSigns VS4	Exploitable remotely	HITRUST: AC-4, SC-7; ISO 27001: A.13.1
CVE-2020-1624	Philips SureSigns VS4	Exploitable remotely	HITRUST: AC-4, SC-7; ISO 27001: A.13.1
CVE-2020-16216	Philips IntelliVue MX700 and MX800	Low attack complexity	HITRUST: AC-2, SC-5; NIST SP 800-53: AC-2
CVE-2019-13530	Philips IntelliVue MX700 and MX800	Hard-coded password, code download without integrity check	HITRUST: SI-1, AC-6; NIST SP 800-53: AC-5, SC-8; ISO 27001: A.14.2.5
CVE-2020-16214	Philips IntelliVue MX100	Low attack complexity	HITRUST: AC-2, SC-5; NIST SP 800-53: AC-2
CVE-2018-19001	Philips HealthSuite Health Android App, all versions	Inadequate encryption strength	HITRUST: SC-13, AC-12; NIST SP 800-53: SC-12, SC-13; GDPR: Art. 32
CVE-2021-33017	Philips IntelliBridge EC 40 and 60 Hub	Authentication bypass using an alternate path or channel	HITRUST: AC-1, AC-4; NIST SP 800-53: AC-2
CVE-2022-0922	Philips E-alert Firmware	No authentication for critical system functionality	HITRUST: AC-4, SC-12; NIST SP 800-53: AC-2
CVE-2018-14803	Philips E-alert Firmware	Unauthorized disclosure of system information via HTTP headers	HITRUST: AC-5, SC-4; NIST SP 800-53: SC-12; ISO 27001: A.10.1
CVE-2020-6961	GE Healthcare GE CARESCAPE B450/B650/B850	Exploitable remotely, low skill level	HITRUST: AC-4, SC-7; NIST SP 800-53: AC-2; ISO 27001: A.13.1
CVE-2020-6962	GE Healthcare GE CARESCAPE B450/B650/B850	Exploitable remotely, low skill level	HITRUST: AC-4, SC-7; NIST SP 800-53: AC-2; ISO 27001: A.13.1
CVE-2020-6963	GE Healthcare GE CARESCAPE B450/B650/B850	Exploitable remotely, low skill level	HITRUST: AC-4, SC-7; NIST SP 800-53: AC-2; ISO 27001: A.13.1
CVE-2020-6964	GE Healthcare GE CARESCAPE B450/B650/B850	Exploitable remotely, low skill level	HITRUST: AC-4, SC-7; NIST SP 800-53: AC-2; ISO 27001: A.13.1
CVE-2020-6966	GE Healthcare GE CARESCAPE B450/B650/B850	Exploitable remotely, low skill level	HITRUST: AC-4, SC-7; NIST SP 800-53: AC-2; ISO 27001: A.13.1
CVE-2024-27106	GE Healthcare EchoPAC	Exploitation activity	HITRUST: AC-5, SI-1; NIST SP 800-53: AC-5, SI-2
CVE-2024-1628	GE Healthcare Ultrasound devices	OS command injection vulnerabilities	HITRUST: SI-2, AC-5; NIST SP 800-53: SI-3, AC-4
CVE-2020-25179	GE Healthcare Imaging and Ultrasound Products	Information leak	HITRUST: SI-3; NIST SP 800-53: SI-3; ISO 27001: A.10.1
CVE-2024-3094	GE Healthcare XZ Utils	Embedded malicious code	HITRUST: AC-4, SC-7; NIST SP 800-53: AC-4, SI-7
CVE-2021-27410	Welch Allyn Spot Vital Signs 4400	Exploitable remotely	HITRUST: AC-4, SC-7; ISO 27001: A.13.1
CVE-2021-27408	Welch Allyn Spot Vital Signs 4400	Exploitable remotely	HITRUST: AC-4, SC-7; ISO 27001: A.13.1
CVE-2024-1275	Welch Allyn Vital Signs Monitor	Exploitable remotely	HITRUST: AC-4, SC-7; ISO 27001: A.13.1
CVE-2019-6446	Dräger Infinity® Delta Series	Probability of exploitation activity	HITRUST: SI-2, SC-5; NIST SP 800-53: SI-4, SC-7
CVE-2024-23619	IBM Merge Healthcare eFilm Workstation	Execute code	HITRUST: SI-1, AC-5; NIST SP 800-53: SI-5, AC-6
CVE-2024-23622	IBM Merge Healthcare eFilm Workstation	Buffer overflow	HITRUST: SC-8, SI-5; NIST SP 800-53: SC-7, SI-7
CVE-2024-23621	IBM Merge Healthcare eFilm Workstation	Buffer overflow	HITRUST: SC-8, SI-5; NIST SP 800-53: SC-7, SI-7
CVE-2024-38348	CodeProjects Health Care hospital Management System v1.0	SQL injection vulnerability	HITRUST: AC-6, SI-1; NIST SP 800-53: SI-3, AC-4
CVE-2024-38347	CodeProjects Health Care hospital Management System v1.0	SQL injection vulnerability	HITRUST: AC-6, SI-1; NIST SP 800-53: SI-3, AC-4
CVE-2025-0683	Contec Health CMS8000 Patient Monitor	Exposure of private personal information	HITRUST: SI-1, AC-5; NIST SP 800-53: AC-2, SI-4
CVE-2025-1204	Contec Health CMS8000 Patient Monitor	Hidden functionality	HITRUST: AC-6, SC-5; NIST SP 800-53: AC-5
CVE-2025-0626	Contec Health CMS8000 Patient Monitor	Attempts to bypass network settings	HITRUST: SC-5, AC-4; NIST SP 800-53: AC-4, SC-7
CVE-2024-12703	Schneider Electric SE RemoteConnect and SCADAPackTM x70 Utilities	Remote code execution via deserialization	HITRUST: AC-5, SC-7; NIST SP 800-53: SI-5, SC-8

The following table provides a classification of attack types commonly identified in the field of cybersecurity for medical systems and devices. Each attack type is accompanied by its respective abbreviation to facilitate reference in the subsequent analysis. See Table 16 and Figure 5.

Table 16. List of identified attacks with their respective abbreviations according to Table 15.

Types of Attacks	Abbreviation
Exploitable remotely/low skill level to exploit	ER
Remote exploit	RX
Buffer overflow	BO
SQL injection vulnerability	SQL
Low attack complexity	LAC
Authentication bypass using an alternate path or channel	ABU
Embedded malicious code	EM
Execute code	EX
Exploitation activity	EA
Exposure of private personal information to an unauthorized actor	EPP
Hidden functionality	HF
Inadequate encryption strength	IES
Information leak	IL
OS command injection vulnerabilities	OCI
Probability of exploitation activity	PIV
Replay attacks and authentication bypass	RAA
The “monitor” binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address	MB
The software does not perform any authentication for critical system functionality	SDN
The vulnerability allows for an unauthorized disclosure of system information through HTTP headers	VAF
Token reuse vulnerability	TRV
Use of hard-coded password, download of code without integrity check	UHP

Figure 5. Number of occurrences of attacks recorded in the analyzed CVEs.

3.3.4. Result of the Analysis of the Information Obtained

ISO standards align with the systematization of information and focus on the management and administration of data, offering guidelines for the implementation of information security. Additionally, a gap was identified between the updating of these standards and technological advancements.

NIST controls provide a flexible and risk-oriented approach to strengthening cybersecurity in critical infrastructures, particularly in the healthcare sector. One key aspect is the existence of specific guidelines for digital identity management, which is crucial for medical devices that require robust authentication and access control.

The HIPAA Privacy Rule establishes national standards to protect Protected Health Information (PHI), ensuring its confidentiality and limiting its use and disclosure without patient consent. HIPAA mandates administrative, physical, and technical safeguards to protect electronic PHI, including access controls and encryption. It promotes transparency and accountability in incident management.

ENISA emphasizes the importance of cybersecurity training and the implementation of restricted access policies in the healthcare sector to prepare staff for cyber threats. It recommends security measures for remote care systems, such as telemedicine, including secure connections and robust authentication.

GDPR sets out essential principles for the processing of personal data, ensuring that it is lawful, fair, transparent, and limited to specific purposes—factors particularly relevant for medical devices. Additionally, it grants individuals rights over their personal data, such as access, rectification, deletion, and portability, promoting transparency and accountability in data handling.

The HITRUST framework offers a comprehensive approach to information security risk management by integrating standards such as HIPAA, NIST, ISO, and COBIT. This integration not only facilitates regulatory compliance but also strengthens organizational security, providing confidence that systems are well protected. It is adaptable to different types and sizes of organizations, allowing customization of controls according to specific needs.

The scientific literature review spans from 2017 to 2025, showcasing various studies focused on cybersecurity, vulnerabilities, and the detection of attacks in emerging technologies applied to infrastructures, such as blockchain and the IoT. According to the interpretation of the graphs, it is observed that in the last year, the number of scientific articles centered on key topics such as the need for clear regulatory frameworks, the security of critical infrastructure, the characterization of specific attacks, the consideration of human and organizational factors, and the adoption of rigorous analytical methodologies has doubled. This growth reflects an increasing attention towards patterns such as the intensive digitalization of the health sector, cybersecurity as a central axis, and the use of emerging technologies like artificial intelligence, advanced cryptography, and blockchain. Nevertheless, significant gaps persist related to the vulnerabilities of connected devices, the risks derived from interoperability, the challenges in the protection of new technologies, and the weaknesses linked to security culture and staff awareness, aspects that also evidence the urgency of a comprehensive socio-technical approach.

Regarding the review of recorded vulnerabilities, a trend is observed in the attacks, most of which are related to remote exploitation and malicious code injection.

There is a repetition of similar vulnerabilities in different versions or models from the same manufacturer, which may indicate structural deficiencies in secure development lifecycles.

Vulnerabilities that allow low-complexity attacks or remote exploitation represent a high real risk, as they can be easily exploited without the need for advanced tools.

Furthermore, cross-referencing using regulations such as HITRUST, NIST SP 800-53, and ISO 27001 shows a lack of systematic compliance with key controls, especially in access, secure communication, and information protection. This suggests a need to strengthen the design, testing, and maintenance of security in medical devices, particularly those with active connectivity.

It can be established that there is no one-to-one correspondence between CVEs and regulations; likewise, these regulations can be applied to many CVEs, depending on the type of control involved. Therefore, the same vulnerability can be related to several regulatory frameworks that address different aspects of the same problem: authenticity, network, monitoring, or privacy, among others.

3.4. Development of the Security Pillars Model

As a result of the development of the Integral Security Pillars for Medical Devices: A Comprehensive Analysis, a simplified and abstract representation of the design was created. This was performed to select the critical elements and define their relationships.

Various attributes were established for each element to visualize the structure and connections of the model derived from the review process, ensuring clarity and coherence. This representation was accompanied by information that facilitates its understanding and application.

The results were developed based on pillars and an integral approach to ensure both structural clarity and comprehensive coverage. From an engineering perspective, pillars refer to foundational components that support the integrity and functionality of a system, enabling modular analysis and targeted improvements. The term integral emphasizes the unification and concentration of information, allowing the model to aggregate and centralize critical aspects of security into a coherent framework that facilitates holistic assessment and implementation.

As a result, four essential elements that compose the Pillars of Security model were identified, as shown in Figure 6.

Figure 6. Integral Security Pillars for Medical Devices.

Description of the Elements of the Four Security Pillars

• Regulations:

Regulations are an essential component of the security model for medical device infrastructure, as they provide a normative framework that guides the implementation of data protection measures. These standards and procedures help organizations identify, prevent, and mitigate risks derived from cyber threats, ensuring the confidentiality, integrity, and availability of information. In the context of medical devices, regulations are crucial not only for setting protection standards but also for monitoring and regulating the use and operation of the devices, which is vital for protecting them against current and emerging threats. National regulations, best practices, and internal laws play a central role in ensuring that devices operate safely and are protected from unauthorized or malicious access, fostering a reliable environment for healthcare delivery.

• Model vs. Manufacturer:

Medical device manufacturers are tasked with innovating and solving technological challenges to improve healthcare and developing advanced technologies such as connected systems for diagnosis and monitoring (e.g., magnetic resonance imaging). However, it is essential to recognize that a wide range of devices has shown vulnerabilities in their software systems or communication protocols, which puts information security at risk. This element of the model emphasizes the importance of periodic updates and continuous support, providing a valuable complement to prevent and detect issues in the medical device infrastructure, enhancing protection against potential cyber threats.

• Vulnerability and Threat Analysis:

Proactive vulnerability and threat analysis is key to strengthening the cybersecurity posture of organizations, particularly those managing medical device infrastructures. Identifying and understanding the specific vulnerabilities of each device allows organizations to correct weaknesses before they are exploited. This analysis enables periodic and systematic protection of sensitive information, helping mitigate risks and ensuring that medical device systems operate safely in an increasingly interconnected environment. The ability to prevent security breaches is a crucial component for protecting both technological infrastructure and the confidentiality of data.

• Trends and Emerging Technologies:

Emerging technological trends and scientific advancements can have a significant impact on the landscape of cyber threats. The research and development of new technologies can not only facilitate the identification of vulnerabilities but also influence the adoption of new attack techniques and the improvement of cybersecurity measures. Innovations in areas such as artificial intelligence, the Internet of Things (IoT), the Internet of Medical Things (IoMT), and cloud computing have the potential to create both new opportunities and new risks. It is crucial to monitor these advancements to anticipate threats and strengthen the defenses of medical device systems, ensuring that security solutions adapt to new technological realities.

Mathematical Model

The Integral Security Pillars for Medical Devices are formally represented through a mathematical model based on Set Theory, which serves as a rigorous conceptual framework for structuring the system’s security architecture. See Figure 7.

Figure 7. Mathematical model based on Set Theory.

The model defines four primary sets, each corresponding to a fundamental security pillar:

• R: Regulations
• M: Model vs. Manufacturer
• V: Vulnerability and Threat Analysis
• T: Trends and New Technologies

The Universal Set U

Encompasses the complete domain of elements pertinent to cybersecurity in medical devices and is mathematically expressed as

U = R ∪ M ∪ V ∪ T

The central intersection zone Ω

Represents the optimal integration state, wherein all four pillars are fully aligned. Achieving this condition ensures comprehensive and cohesive cybersecurity coverage across the medical device ecosystem, facilitating robust protection against diverse cyber threats.

Ω = R ∩ M ∩ V ∩ T

4. Discussion

The interconnection of medical devices has improved healthcare delivery but has also increased exposure to cyber threats. Despite existing regulations such as ISO, NIST, and HIPAA, vulnerabilities persist. This study analyzes the gaps in the implementation of security measures, highlighting key findings and their relation to previous research, while also discussing the implications of these results and their impact on future research and improvements in medical device security.

The results of this study reveal the growing importance of integrating a comprehensive cybersecurity approach into medical device technology, especially in the context of system interconnection and the increasing number of common vulnerabilities and exposures (CVEs) associated with these devices. The analysis of regulations and standards such as ISO, NIST, HIPAA, ENISA, GDPR, and HITRUST highlights the need for closer alignment between security policies and the practices implemented by medical device manufacturers and suppliers. While these regulations have made significant progress in information protection, the findings indicate that the effective application of these regulations in medical devices still faces major challenges, such as a lack of consistency in the implementation of security measures and the growing sophistication of cyberattacks.

Identified vulnerabilities, such as remote exploitation in Philips devices or malicious code injections in GE Healthcare products, illustrate the severity of the threats facing medical device infrastructures. These results align with previous studies that have highlighted the insufficient protection of medical devices against cyberattacks, especially when integrated into complex healthcare information networks. The discrepancy between the existing regulations and practical implementations emphasizes the need for a more robust and adaptive approach to auditing and managing the security of these devices.

Furthermore, the findings reveal that the security of medical devices relies not only on protecting information but also on the integration of risk controls that consider interoperability and vulnerability management throughout the entire lifecycle of the devices. This supports the hypothesis that cybersecurity threats should be managed with a holistic approach, covering not only IT security but also physical security, identity management, and access control.

Future research could focus on the development of adaptive security frameworks that integrate best practices from multiple standards and enable real-time audits, especially in connected healthcare environments. It would also be valuable to explore the implementation of emerging technologies, such as artificial intelligence and machine learning, for detecting and mitigating threats in interconnected medical devices. Additionally, investigating the impact of cybersecurity training for healthcare professionals, considering the interaction between human factors and technology in healthcare settings, would be highly relevant.

This study reinforces the urgency of strengthening cybersecurity capabilities in medical devices to ensure the protection of information and the integrity of healthcare services, particularly in a context where reliance on interconnected systems continues to grow.

5. Conclusions

The findings of this study underscore the pressing need to adopt a comprehensive and systematic approach to cybersecurity in medical devices. Although international regulatory frameworks, such as ISO, NIST, HIPAA, ENISA, GDPR, and HITRUST, offer valuable guidance, substantial gaps persist in the practical implementation of critical controls, particularly in areas concerning authentication, secure communications, and data protection.

The vulnerability analysis identifies recurrent patterns and risks associated with remote exploitation and malicious code injection, thereby highlighting the limitations inherent in the secure development lifecycles of connected medical devices. Furthermore, the absence of a direct correspondence between documented vulnerabilities (CVEs) and regulatory frameworks accentuates the complexity of the current regulatory landscape and reinforces the necessity for cross-disciplinary and integrated approaches.

Within this context, the proposed Integral Security Pillars Model provides a robust conceptual framework designed to align and integrate the essential components of cybersecurity. Its formal representation through Set Theory facilitates the visualization of interdependencies among regulatory standards, manufacturer responsibilities, threat intelligence, and emerging technological trends, thereby supporting the advancement towards a coherent, adaptive, and resilient cybersecurity architecture for interconnected healthcare environments.

This study proposes an integral security model for medical devices based on conceptual pillars that systematically structure the critical protection components. Through a detailed analysis of regulatory frameworks and best practices, supported by visual representations and a preliminary mathematical model, it provides a tool that facilitates the evaluation and continuous improvement of security in digital healthcare environments. This approach contributes to the standardization of criteria within a technologically and regulatory heterogeneous context and opens new research avenues for risk quantification and the secure integration of medical devices into interconnected healthcare infrastructures.

This model is independent of network architecture and focuses on the comprehensive security of the device, taking into account technical, organizational, regulatory, and interoperability factors. In other words, although it can be applied in connected environments, it is not exclusively dependent on the IoMT paradigm; rather, it aims to protect the device in any usage context.

As part of future work, the practical implementation of an audit model for medical device infrastructure is proposed, which will be theoretically validated through logical reasoning based on fundamental security principles. This implementation will include testing the model in various clinical environments and with different types of medical devices in order to assess its effectiveness in identifying and mitigating vulnerabilities in real-world scenarios.

Additionally, comparative studies are suggested to analyze the performance of the model against other existing approaches in practice, with the goal of identifying potential areas for improvement and optimization. In parallel, the development of automated tools for the application of the model could significantly facilitate audits, enhancing the efficiency and accuracy of the process.

Finally, continuous review and updates of the model are recommended, incorporating new regulations and technological advancements into the field of medical device security. This approach will ensure that the model remains relevant and effective in a constantly evolving environment, safeguarding the continued protection of medical device infrastructure against emerging cyber threats.