1. Security Standards Overview
AAMI Medical Device
Security Standards Overview
MDISS Fall 2017 Meeting
© 2017 Association for the Advancement of Medical Instrumentation
© 2011 Association for the Advancement of Medical Instrumentation

2. AAMI’s role
Leader in healthcare tech-oriented consensus-based problem solving
Sectoral preference for private consensus-based standards to
support regulatory
needs
Long track record of working with all stakeholders to develop national and international consensus standards *
© 2014 Association for the Advancement of Medical Instrumentation
© 2011 Association for the Advancement of Medical Instrumentation

3. AAMI Standards – The Three Pillars of Better Patient Outcomes
Access
Effectiveness
Safety
Security is integral to all three pillars!
© 2017 Association for the Advancement of Medical Instrumentation

4. AAMI Standards Philosophy
Standards only where there is a need
Preference for global solutions--“One standard, one test, worldwide”
Systems approach—Address safety and efficacy across full product lifecycle
© 2017 Association for the Advancement of Medical Instrumentation

5. AAMI Standards Program
Accredited by American National Standards Institute (ANSI)
Administers technical committees of the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)
Administers U.S. Technical Advisory Groups (TAGs) to ISO and IEC Committees
Develops American National Standards and technical reports
© 2017 Association for the Advancement of Medical Instrumentation
© 2011 Association for the Advancement of Medical Instrumentation

6. Evolution of AAMI Standards Program
Accredited by ANSI to develop American National Standards 1977
First standard published 1971
Electromedical devices
AAMI establishes ISO/TC 198 (sterilization) 1990
Assumes 1st ISO Secretariat 1987
AAMI establishes ISO/TC 210 (QMS, RM, etc.) 1993
Founded 1967
1960
Key standards initiatives
Now administers 12 ISO or IEC technical committee Secretariats
2013
Assumes 1st IEC Secretariat 1989
AAMI turns 50
2020
ECG devices
Sterilization
General medical devices
Dialysis technology
Biocompatibility and clinical evaluation
Industrial process control
Management system standards (QMS, RM, Human factors, etc.)
Combinations products
Medical device software
Anesthesia and respiratory equipment
Medical Device and medical network security

7. Domestic Standard Development
AAMI Medical Device Security WG
Technical Information Report 57
Principles for medical device
security—Risk management
Applies ANSI/AAMI/ISO approach
Revision underway as a full American National
Standard (AAMI SW96)
Also developing a Technical Information Report
TIR97, Principles for medical device security – Post-market
security management for device manufacturers
Work will likely be taken international in the future
© 2017 Association for the Advancement of Medical Instrumentation
© 2011 Association for the Advancement of Medical Instrumentation

8. International Device Security Standards Development
ISO/TC 210, Quality management and corresponding general aspects for medical devices
ISO/TC 215, Health informatics (Joint working group 7)
IEC/SC 62A, Common aspects of electrical equipment used in medical practice
© 2017 Association for the Advancement of Medical Instrumentation

9. Key international standards
ISO/IEC series (Risk management of networks incorporating medical devices)
Multiple parts--several parts of this series address security
Aimed at health care providers
Aligned with NEMA NH-1, Manufacturer
Disclosure Statement for Medical Device
Security (MDS2 forms)
Planned future revision will (likely align with
ISO risk management revision and
ISO (high level management structure)
© 2017 Association for the Advancement of Medical Instrumentation
© 2011 Association for the Advancement of Medical Instrumentation

10. ISO 14971 (medical device risk management)
Security management is part of risk management (current state)
Undergoing revision
Controversy over whether to delete “physical” from scope of harm (physical harm)
Controversy as to whether “security management” should be separate from “risk management”
© 2017 Association for the Advancement of Medical Instrumentation

11. AAMI Horizons
© 2017 Association for the Advancement of Medical Instrumentation

12. For more information AAMI Joe Lewelling
VP, Emerging Technology and Health IT
AAMI
Phone:
Address: 4301 North Fairfax Drive, Ste. 301, Arlington VA 2223
© 2017 Association for the Advancement of Medical Instrumentation