Search for:
Cybersecurity, Data and Tech

Singapore: Health Sciences Authority launches public consultation on the Best Practices Guide for Medical Device Cybersecurity

By and 3 Mins Read

In brief

On 10 March 2025, the Health Sciences Authority (HSA) launched its public consultation for the draft on the Best Practices Guide for Medical Device Cybersecurity. The document provides medical device manufacturers and healthcare providers with best practice recommendations and considerations on general cybersecurity principles to protect the security of medical devices for their entire product life cycle. 

Summary of guidelines

The Best Practices Guide for Medical Device Cybersecurity is not meant to provide regulatory requirements but instead share best practices for medical device manufacturers and healthcare providers. The general principles that undergird the best practices are shared responsibilities between manufacturers and healthcare providers, transparency and communication, and ensuring that devices are secure by design. The substantive guidelines are separated according to pre-market and post-market stages and collectively encompass the entire product life cycle of medical devices.

Pre-market stage

The guide provides best practices for medical device manufacturers at the development stage based on the following elements:

  • Designing security features: incorporating security features into product design
  • Risk management strategies: identifying, analyzing and mitigating cybersecurity risks
  • Security testing: conducting thorough security testing to identify and rectify any vulnerabilities in the device’s security
  • User information: providing comprehensive user guidelines on how to operate the device safely and effectively
  • Post-market plan: developing a plan for cybersecurity activities, including monitoring, timely detecting and addressing any security threats that arise after the device enters the market
  • Software bill of materials: listing software components to provide oversight over the components of the devices and any attendant vulnerability in the respective components

Post-market stage

At this stage, the guide envisions greater involvement of healthcare providers alongside device manufacturers. Thus, the best practices are aimed at providing guidance for both parties and into three stages: the support stage, the limited-support stage and the end-of-support stage. The guide is cognizant of the gradual transfer of responsibility from the device manufacturer to the end user as the product reaches the end of its life cycle and makes provisions accordingly within the guidelines.

  • Support stage: Manufacturers are given guidance as to the comprehensive cybersecurity support that they are expected to provide to healthcare providers at this stage.
  • Limited-support stage: This stage gives guidance to both manufacturers and healthcare providers on the best practices to manage the transition from full support.
  • End-of-support stage: Security providers are the primary focus of the guidelines at this stage with some recommendations targeted at manufacturers in a residual role.

Key takeaways

The HSA has been active in ensuring the cybersecurity of medical devices. This has resulted in initiatives such as the cybersecurity labeling scheme for medical devices that was launched on 16 October 2024. Medical device manufacturers and healthcare providers should continue to stay updated on the HSA’s developments to keep in line with regulatory requirements and best practices.

The consultation period for the guide is running from 10 March 2025 to 12 May 2025.

* * * * *

LOGO_Wong&Leow_Singapore

© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Categories:
Tags:
Author

Andy Leck is the head of the Intellectual Property and Technology (IPTech) Practice Group and a member of the Dispute Resolution Practice Group in Singapore. He is a core member of Baker McKenzie's regional IP practice and also leads the Myanmar IP Practice Group. Andy is recognised by reputable global industry and legal publications as a leader in his field. He was named on "The A-List: Singapore's Top 100 lawyers" by Asia Business Law Journal 2018. In addition, Chambers Asia Pacific notes that Andy is "a well-known IP practitioner who is highlighted for his record of handling major trade mark litigation, as well as commercial exploitation of IP rights in the media and technology sectors. He's been in the industry for a long time and has always been held in high regard. He is known to be very fair and is someone you would like to be in the trenches with you during negotiations." Furthermore, Asian Legal Business acknowledges Andy as a leading practitioner in his field and notes that he “always gives good, quick advice, [is] client-focused and has strong technical knowledge for his areas of practice.” Andy was appointed by the Intellectual Property Office of Singapore (IPOS) as an IP Adjudicator to hear disputes at IPOS for a two-year term from April 2021. He has been an appointed member of the Singapore Copyright Tribunal since May 2010 and a mediator with the WIPO Arbitration and Mediation Center. He is also appointed as a Notary Public & Commissioner for Oaths in Singapore. He previously served on the International Trademark Association’s Board of Directors and was a member of the executive committee.

Author

Ren Jun Lim is a principal with Baker McKenzie Wong & Leow. He represents local and international clients in both contentious and non-contentious intellectual property matters. He also advises on a full range of healthcare, as well as consumer goods-related legal and regulatory issues. Ren Jun co-leads Baker McKenzie Wong & Leow's Healthcare as well as Consumer Goods & Retail industry groups. He sits on the Law Society of Singapore IP Committee and on the Executive Committee of the Association of Information Security Professionals. He is also a member of the Vaccines Working Group, Singapore Association of Pharmaceutical Industries, a member of the International Trademark Association, as well as a member of the Regulatory Affairs Professionals Association. Ren Jun is ranked in the Silver tier for Individuals: Enforcement and Litigation and Individuals: Prosecution and Strategy, and a recommended lawyer for Individuals: Transactions by WTR 1000, 2020. He is also listed in Asia IP's Best 50 IP Expert, 2020, recognised as a Rising Star by Managing IP: IP Stars, 2019 and one of Singapore's 70 most influential lawyers aged 40 and under by Singapore Business Review, 2016. Ren Jun was acknowledged by WTR 1000 as a "trademark connoisseur who boasts supplementary knowledge of regulatory issues in the consumer products industry." He was also commended by clients for being "very responsive to enquiries and with a keen eye for detail, he is extremely hands-on. His meticulous and in-depth approach to strategising is key to the excellent outcomes we enjoy."

Related Posts