Health software and health IT systems safety, effectiveness and security — Part 2-2: Guidance for the implementation, disclosure and communication of security needs, risks and controls

This document presents an informative set of common, high-level security-related capabilities and additional considerations to be used across the life cycle of health software and health IT systems, for the information exchange between the health software manufacturers (including medical device manufacturers), healthcare delivery organizations (HDOs) and other stakeholders. It is applicable to health software running on any platform and in any environment such as cloud, on premise or hybrid. While important security topics, the following are outside the scope of this document: a) the security policies of the HDO, b) the product and services security policies of the manufacturer, c) determinations of risk tolerance by the HDO or manufacturer, and d) clinical studies where there is a need to secure personal data. As security risks can be caused by any product on health IT systems and health IT Infrastructure, considerations in this document can be applied for other products that are not health software. IEC TS 81001-2-2:2025 withdraws and replaces: – IEC TR 80001-2-2, Application of risk management for IT-networks incorporating medical devices – Part 2-2: Guidance for the communication of medical device security needs, risks and controls – IEC TR 80001-2-8, Application of risk management for IT-networks incorporating medical devices – Part 2-8: Application guidance – Guidance on standards for establishing the security capabilities identified in IEC TR 80001-2-2 This document includes the following significant changes: a) Combines and updates the contents of IEC TR 80001-2-2 and IEC TR 80001-2-8; b) Extends the scope to health software instead to only medical device software; c) Aligns contents and definitions to ISO 81001-1:2021 and the updated IEC 80001-1; d) Removed the Configuration of Security Features (CNFS) capability, as any configurable security capability shall be clearly communicated. e) Provide security control mappings to several new standards, e.g. IEC TR 60601-4-5, IEC 62443-4-2, ISO/IEEE 11073-40102 and the recent versions of previous standards, e.g. ISO/IEC 27002 and NIST 800-53 version 5.

Sécurité, efficacité et sûreté des logiciels de santé et des systèmes TI de santé — Partie 2-2: Recommandations pour la mise en œuvre, la divulgation et la communication des besoins, des risques et des contrôles en matière de sécurité

General Information

Status
Published
Publication Date
02-Oct-2025
Current Stage
6060 - International Standard published
Start Date
03-Oct-2025
Due Date
17-Feb-2025
Completion Date
03-Oct-2025
Ref Project

Relations

Technical specification
IEC/TS 81001-2-2:2025 - Health software and health IT systems safety, effectiveness and security — Part 2-2: Guidance for the implementation, disclosure and communication of security needs, risks and controls Released:10/3/2025
English language
96 pages
sale 15% off
Preview
sale 15% off
Preview

Standards Content (Sample)


IEC TS 81001-2-2
Edition 1.0 2025-09
INTERNATIONAL
STANDARD
Health software and health IT systems safety, effectiveness and security -
Part 2-2: Coordination - Guidance for the implementation, disclosure and
communication of security needs, risks and controls
ICS 11.040.01; 35.240.80  ISBN 978-2-8327-0739-5

IEC TS 81001-2-2:2025-09(en)
All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or
by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either
IEC or IEC's member National Committee in the country of the requester. If you have any questions about IEC copyright
or have an enquiry about obtaining additional rights to this publication, please contact the address below or your local
IEC member National Committee for further information.

IEC Secretariat Tel.: +41 22 919 02 11
3, rue de Varembé info@iec.ch
CH-1211 Geneva 20 www.iec.ch
Switzerland
About the IEC
The International Electrotechnical Commission (IEC) is the leading global organization that prepares and publishes
International Standards for all electrical, electronic and related technologies.

About IEC publications
The technical content of IEC publications is kept under constant review by the IEC. Please make sure that you have the
latest edition, a corrigendum or an amendment might have been published.

IEC publications search - IEC Products & Services Portal - products.iec.ch
webstore.iec.ch/advsearchform Discover our powerful search engine and read freely all the
The advanced search enables to find IEC publications by a
publications previews, graphical symbols and the glossary. With
variety of criteria (reference number, text, technical a subscription you will always have access to up to date content
committee, …). It also gives information on projects, replaced tailored to your needs.
and withdrawn publications.
Electropedia - www.electropedia.org
IEC Just Published - webstore.iec.ch/justpublished The world's leading online dictionary on electrotechnology,
Stay up to date on all new IEC publications. Just Published containing more than 22 500 terminological entries in English
details all new publications released. Available online and and French, with equivalent terms in 25 additional languages.
once a month by email. Also known as the International Electrotechnical Vocabulary
(IEV) online.
IEC Customer Service Centre - webstore.iec.ch/csc
If you wish to give us your feedback on this publication or need
further assistance, please contact the Customer Service
Centre: sales@iec.ch.
IEC TS 81001-2-2:2025 © IEC 2025
CONTENTS
FOREWORD . 3
INTRODUCTION . 5
1 Scope . 7
2 Normative references . 8
3 Terms and definitions . 8
4 Use of security capabilities . 9
4.1 Structure of a security capability entry . 9
4.2 Guidance on the communication of security capabilities and shared
responsibility . 9
4.3 Guidance for use of security capabilities in the risk management process . 9
4.4 Guidance on the application of risk management processes . 9
5 Security capabilities . 10
5.1 General . 10
5.2 Automatic logoff (ALOF) . 11
5.3 Audit controls (AUDT) . 11
5.4 Authorization (AUTH) . 12
5.5 Cybersecurity product upgrades (CSUP) . 13
5.6 Health data de-identification (DIDT) . 14
5.7 Data backup and disaster recovery (DTBK) . 15
5.8 Emergency access (EMRG) . 15
5.9 Health data integrity and authenticity (IGAU) . 16
5.10 Malware detection/protection (MLDP) . 16
5.11 Node authentication (NAUT) . 17
5.12 Person authentication (PAUT) . 18
5.13 Physical locks on product (PLOK). 19
5.14 Third-party components in product life cycle roadmaps (RDMP) . 19
5.15 System and application hardening (SAHD) . 20
5.16 Health data storage confidentiality (STCF) . 20
5.17 Transmission confidentiality (TXCF) . 21
5.18 Transmission integrity and authenticity (TXIG) . 21
6 Additional supporting information . 21
6.1 General . 21
6.2 Connectivity capabilities (CONN). 22
6.3 Management of personally identifiable information (MPII) . 22
6.4 Remote services (RMOT) . 23
6.5 Software Bill of Materials (SBOM) . 24
6.6 Security guides (SGUD) . 25
7 Examples of some security capabilities . 25
7.1 Example of detailed specification under security capability: Person
authentication (PAUT) . 25
7.2 Example for Software Bill of Materials (SBOM) . 26
8 References and other resources . 27
8.1 General . 27
8.2 Manufacturer disclosure statement for medical device security (MDS2) . 28
8.3 Application security questionnaire (ASQ) . 28
8.4 HL7 Functional Electronic Health Record (EHR) . 28
IEC TS 81001-2-2:2025 © IEC 2025
8.5 Standards and frameworks . 28
Annex A (informative) Sample scenario showing the exchange of security information . 31
A.1 Introduction to the security characteristics scenario. 31
A.2 Manufacturer Disclosure Statement for Medical device Security (MDS2) . 32
Annex B (informative) Examples of regional specification on a few security capabilities . 46
Annex C (informative) Guidance for selecting security controls to satisfy the security
capabilities . 49
C.1 General . 49
C.2 Automatic logoff (ALOF) . 52
C.3 Audit controls (AUDT) . 53
C.4 Authorization (AUTH) . 55
C.5 Cybersecurity product upgrades (CSUP) . 58
C.6 Health data de-identification (DIDT) . 59
C.7 Data backup and disaster recovery (DTBK) . 61
C.8 Emergency access (EMRG) . 63
C.9 Health data integrity and authenticity (IGAU) . 64
C.10 Malware detection/protection (MLDP) . 66
C.11 Node authentication (NAUT) . 69
C.12 Person authentication (PAUT) . 72
C.13 Physical locks on product (PLOK). 74
C.14 Third-party components in product life cycle roadmaps (RDMP) . 76
C.15 System and application hardening (SAHD) . 78
C.16 Health data storage confidentiality (STCF) . 82
C.17 Transmission confidentiality (TXCF) . 84
C.18 Transmission integrity and authenticity (TXIG) . 86
C.19 Connectivity capabilities (CONN). 87
C.20 Management of personally identifiable information (MPII) . 89
C.21 Remote services (RMOT) . 90
C.22 Software Bill of Materials (SBOM) . 92
C.23 Security guides (SGUD) . 93
Annex D (informative) Security capability and additional security information mapping
to C-I-A-A-A . 97
Bibliography . 99
Alphabetized index of defined terms . 103

Figure 1 – Health software Field of Application as shown in IEC 81001-5-1 [3] . 7
Figure 2 – Sample Structure for “Medical device2” . 26

Table 1 – Example SBOM for “Medical device2” . 27
Table D.1 – Sample mapping by a hypothetical HDO . 97

IEC TS 81001-2-2:2025 © IEC 2025
INTERNATIONAL ELECTROTECHNICAL COMMISSION
____________
Health software and health it systems safety, effectiveness and security -
Part 2-2: Coordination - Guidance for the implementation, disclosure and
communication of security needs, risks and controls

FOREWORD
1) The International Electrotechnical Commission (IEC) is a worldwide organization for standardization comprising
all national electrotechnical committees (IEC National Committees). The object of IEC is to promote international
co-operation on all questions concerning standardization in the electrical and electronic fields. To this end and
in addition to other activities, IEC publishes International Standards, Technical Specifications, Technical Reports,
Publicly Available Specifications (PAS) and Guides (hereafter referred to as “IEC Publication(s)”). Their
preparation is entrusted to technical committees; any IEC National Committee interested in the subject dealt with
may participate in this preparatory work. International, governmental and non-governmental organizations liaising
with the IEC also participate in this preparation. IEC collaborates closely with the International Organization for
Standardization (ISO) in accordance with conditions determined by agreement between the two organizations.
2) The formal decisions or agreements of IEC on technical matters express, as nearly as possible, an international
consensus of opinion on the relevant subjects since each technical committee has representation from all
interested IEC National Committees.
3) IEC Publications have the form of recommendations for international use and are accepted by IEC National
Committees in that sense. While all reasonable efforts are made to ensure that the technical content of IEC
Publications is accurate, IEC cannot be held responsible for the way in which they are used or for any
misinterpretation by any end user.
4) In order to promote international uniformity, IEC National Committees undertake to apply IEC Publications
transparently to the maximum extent possible in their national and regional publications. Any divergence between
any IEC Publication and the corresponding national or regional publication shall be clearly indicated in the latter.
5) IEC itself does not provide any attestation of conformity. Independent certification bodies provide conformity
assessment services and, in some areas, access to IEC marks of conformity. IEC is not responsible for any
services carried out by independent certification bodies.
6) All users should en
...

Questions, Comments and Discussion

Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.