Health-ISAC sets nine security domains for medical devices, and a gap now needs an executive's name on it

MedDevice Cyber Staff · Sep 17 · 3 min read · Via Health-ISAC

Health-ISAC's Medical Device Security Council published a white paper on September 17 setting nine capability domains for hospitals to use when they evaluate, procure, and deploy medical devices. The list: authentication, authorization, secure remote vendor access, privacy and data handling, encryption, event logging, patches and updates, secure cloud connectivity, and boundary protection. The paper is decision support, not a certification standard or a procurement checklist.

The baseline splits devices into two buckets: those running a full operating system, and those on embedded or constrained platforms that cannot support every native control. For a constrained device, hospitals are told to build layered protection around it instead of demanding the device do everything itself.

The named owner requirement is the part manufacturers should read twice. A device that cannot meet a hospital's own security standard now needs a documented exception, and that exception needs an executive's name attached to it. Phil Englert, Health-ISAC's VP of medical device security, put it plainly: the issue is a business risk, and "the CISO should be an internal advisor."

Samantha Jacques, VP of clinical engineering at McLaren Health Care, said hospitals already lean on compensating controls "very, very early to try and get that layered security." Native device security, in practice, often arrives second.

The baseline lands next to a separate HIPAA Security Rule proposal that would eliminate the "addressable" designation, the label that has let covered entities treat many security controls as optional for two decades. Health-ISAC frames its nine domains as the kind of specificity regulators are already moving toward, without waiting for that rule to finalize.

A manufacturer that cannot say where its product lands on encryption, event logging, and secure remote vendor access at RFP time is handing the hospital's procurement team an exception to write, with someone else's name on it. Build the nine-domain matrix once per product line and keep it current. Every major health system's clinical engineering group is about to start asking these same nine questions.

Questions & Answers

What are the nine domains in Health-ISAC's medical device security baseline?

Health-ISAC's Medical Device Security Council white paper, published September 17, 2026, lists authentication, authorization, secure remote vendor access, privacy and data handling, encryption, event logging, patches and updates, secure cloud connectivity, and boundary protection.

Is Health-ISAC's medical device baseline a certification requirement?

No. Health-ISAC describes the nine-domain baseline as a decision support resource for hospital procurement and deployment decisions, not a certification standard or mandatory checklist, and it does not replace FDA's premarket cybersecurity requirements under Section 524B.

What happens when a medical device cannot meet a hospital's security standard under the Health-ISAC baseline?

The device needs a documented exception with a named executive attached to it, according to the September 2026 Health-ISAC white paper, shifting accountability for unmet controls to an individual decision-maker.

← Back to FDA & Regulation