National foreword

This Published Document is the UK implementation of IEC TR 60601‑4‑5:2021.

The UK participation in its preparation was entrusted to Technical Committee CH/62/1, Common aspects of Electrical Equipment used in Medical Practice.

A list of organizations represented on this committee can be obtained on request to its committee manager.

This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This Published Document was published under the authority of the Standards Policy and Strategy Committee on 31 January 2021.

FOREWORD

1)	The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports, Publicly Available Specifications (PAS) and Guides (hereafter referred to as "IEC Publication(s)"). Their preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with may participate in this preparatory work. International, governmental and non-governmental organizations liaising with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for Standardization (ISO) in accordance with conditions determined by agreement between the two organizations.
2)	The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international consensus of opinion on the relevant subjects since each technical committee has representation from all interested IEC National Committees.
3)	IEC Publications have the form of recommendations for international use and are accepted by IEC National Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any misinterpretation by any end user.
4)	In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications transparently to the maximum extent possible in their national and regional publications. Any divergence between any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter.
5)	IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any services carried out by independent certification bodies.
6)	All users should ensure that they have the latest edition of this publication.
7)	No liability shall attach to IEC or its directors, employees, servants or agents including individual experts and members of its technical committees and IEC National Committees for any personal injury, property damage or other damage of any nature whatsoever, whether direct or indirect, or for costs (including legal fees) and expenses arising out of the publication, use of, or reliance upon, this IEC Publication or any other IEC Publications.
8)	Attention is drawn to the Normative references cited in this publication. Use of the referenced publications is indispensable for the correct application of this publication.
9)	Attention is drawn to the possibility that some of the elements of this IEC Publication may be the subject of patent rights. IEC shall not be held responsible for identifying any or all such patent rights.

IEC TR 60601‑4‑5 has been prepared by subcommittee 62A: Common aspects of electrical equipment used in medical practice, of IEC technical committee 62: Electrical equipment in medical practice. It is a Technical Report.

The text of this Technical Report is based on the following documents:

Full information on the voting for its approval can be found in the report on voting indicated in the above table.

The language used for the development of this Technical Report is English.

This document has been drafted in accordance with the ISO/IEC Directives, Part 2, and developed in accordance with ISO/IEC Directives, Part 1 and ISO/IEC Directives, IEC Supplement, available at www.iec.ch/members_experts/refdocs. The main document types developed by IEC are described in greater detail at www.iec.ch/standardsdev/publications.

In this document, the following print types are used:

terms defined inClause 3: small capitals;
compliance statements inClause 4andClause 5: italics.

An asterisk (*) as the first character of a title or at the beginning of a paragraph or table title indicates that there is guidance or rationale related to that item in Annex A.

A list of all parts in the IEC 60601 series, published under the general title Medical electrical equipment, can be found on the IEC website.

The committee has decided that the contents of this document will remain unchanged until the stability date indicated on the IEC website under "http://webstore.iec.ch" in the data related to the specific document. At this date, the document will be

reconfirmed,
withdrawn,
replaced by a revised edition, or
amended.

INTRODUCTION

This document provides IT security specifications for medical electrical equipment (me equipment) and medical electrical systems (me systems) connectable to medical it-networks as network components. medical device software, although not in the scope of IEC 60601 (all parts), can also make use of this document. The intent of this document is to specify security capabilities that enable a medical device to be more easily integrated into a medical it-network environment at a given security level (SL).

Me systems placed onto the market as a whole by one legal manufacturer should follow this document as a whole network component of an it-network, in the same way as me equipment. Me systems configured by the owner of a medical it-network can be treated in the same way as other combinations of medical and nonmedical devices within a medical it-network and are out of the scope of this document but within the scope of standards for medical it-networks (e.g. IEC 80001 (all parts)[7]1).

This document references already existing security level (SL) requirements for components of an it-network as listed in IEC 62443‑4‑2:2019. This document is restricted to the network components which are medical devices in order to allow the use of additional nonmedical components within the medical it-network complying with IEC 62443 (all parts)[3] or with further appropriate security standards. This document modifies IEC 62443‑4‑2:2019 only for specific aspects of medical devices in medical it-networks. The primary goal of this document is to provide a flexible framework that facilitates addressing current and future vulnerabilities and applying necessary mitigations in a systematic, defendable manner. Each of the proposed countermeasures should take into account that requirements regarding the safety and performance of a medical device should not be negatively impacted.

The main audience for this document is medical device manufacturers and, where appropriate, compliance authorities. Compliance authorities include government agencies and regulators with the legal authority to perform audits to verify compliance with governing laws and regulations.

Medical it-network integrators, as a further audience, may make use of the security level classification for medical devices, to assist them in the secure integration of medical devices into their networks. This assistance will be to help medical it-network integrators to identify the realized capability security level SL-C of medical devices and thus to specify appropriate additional security countermeasures in the individual medical it-network they are procuring.

Medical device manufacturers should use this document to understand and apply the specifications for specific capability security level SL-C of their medical devices. a medical device may not provide the capability itself but may be designed to integrate with a higher-level entity – e.g. a hospital it-network or department it-network – and thus benefit from that entity's capability. This document should guide medical device manufacturers as to what specifications can be allocated and which specifications need to be native in the medical device. medical device manufacturers should provide documentation on how to properly integrate the medical device into a medical it-network (see Clause A.2 for typical network connections of medical devices).

This document should be used to apply and verify appropriate technical security specifications for medical devices which thus can easily be integrated into existing or growing medical it-networks and which in some cases are connected to the Internet. This document does not include security specifications for any additional services installed in a medical it-network.

As defined in IEC TS 62443‑1‑1:2009[4], there are a total of seven foundational requirements to be addressed:

identification and authentication control (IAC);
use control (UC);
system integrity (SI);
data confidentiality (DC);
restricted data flow (RDF);
timely response to events (TRE);
resource availability (RA).

NOTE 1 Data confidentiality includes the unauthorized access to medical device data which could be leveraged to cause all many types of harm. The focus of this document is safety-related security specifications for medical devices regarding data confidentiality. However, the listed provisions for safety-related data confidentiality are a good base also for non-safety-related security aspects.

These seven requirements are used for meeting the capability security level SL-C of a medical device which may be placed on a medical it-network. Defining SL-C for medical devices is the goal and objective of this document. The target security level SL-T and achieved security levels (SL-A) for a complete medical it-network or a subset of that network (e.g. a specific zone of it) are out of the scope of this document.

A capability security level SL-C is defined for countermeasures and for inherent security properties of a medical device. It is a measure of the effectiveness strength of the countermeasures, which are either separate or integral to a medical device, for the addressed security property and contributes to the achieved security level SL-A in the corresponding part of the medical it-network.

Countermeasures can be:

technical countermeasures (e.g. firewalls, anti-virus software, etc.), or
administrative countermeasures (e.g. policies, and procedures), or
physical countermeasures (e.g. locked doors, encapsulated printed circuit board, etc.).

The specified "component requirements" (CRs) for medical devices provided in this document are mainly derived from the it-network "system requirements" (SRs) in IEC 62443‑3‑3[5] which are in turn derived from the overall foundational requirements defined in IEC TS 62443‑1‑1:2009[4]. medical device specifications also include a set of "requirement enhancements" (REs). The combination of CRs and REs implemented into a medical device will determine the capability security level SL-C of the medical device.

As this document provides specifications for medical devices with external data interfaces or with a human interface for processing – e.g. entering, capturing or viewing – confidential patient data, the specifications will be designated as follows:

medical device specifications for me equipment and manufacturer provided by me systems;
medical device software specifications.

The majority of the specifications in this document are the same for these two types and are thus designated simply as a medical device specification. When a specification is only applicable to one of the above two types, it is specified as such.

This document refers to both essential performance and essential function, which are very distinct. Essential function is a well-established term for security aspects and is different from essential performance which is related to safety of one me equipment or me system in normal condition and single fault condition. An essential function considers, for instance, a successful attack on the medical it-network and its connected medical devices and supporting systems. This may lead to loss of the medical it-network supporting function and of some functions of the medical device itself. In that case, the medical device is still responsible for providing a condition sustaining the required minimum functions, including but not limited to basic safety and essential performance.

1 Scope

This document, which is a Technical Report, provides detailed technical specifications for security features of medical devices used in medical it-networks. medical devices dealt with in this document include medical electrical equipment, medical electrical systems and medical device software. medical device software, although not in the scope of IEC 60601 (all parts), can also make use of this document. Based on the seven foundational requirements described in the state-of-the-art document IEC TS 62443‑1‑1:2009[4], this document provides specifications for different medical device capability security levels (SL-C). The specified security capabilities of a medical device can be used by various members of the medical community to integrate the device correctly into defined security zones and conduits of a medical it-network with an appropriate medical it-network's target security level (SL-T).

This document is applicable to medical devices with external data interface(s), for example when connected to a medical it-network or when a human interface is used for processing – e.g. entering, capturing or viewing – confidential data.

This document does not apply to other software used on a medical it-network which does not meet the definition of medical device software.

NOTE 1 An example of this exclusion is software not incorporated into the medical device.

NOTE 2 This document does also not apply to industry protocols such as DICOM and HL7.

This document does not apply to in-vitro diagnostic devices (IVD).

2 Normative references

3 Terms and definitions

4 Common security constraints

4.1 Overview

4.2 * Support of essential function

4.3 Compensating countermeasures

4.4 Least privilege

4.5 Data minimization

4.6 * Overarching constraints

5 security levels for the different foundational requirements

5.1 * Application of security levels

5.2 Modified specifications for security levels

6 Technical description

7 Mapping of requirements to capability security levels (SL-C)

Bibliography

PD IEC TR 60601-4-5:2021

Medical electrical equipment - Guidance and interpretation. Safety-related technical security specifications

Current

Published:

31 Jan 2021