Digital Defence in Healthcare: Medical Device Cyber Security in the EU and USA

The healthcare digitization changed the delivery of care to patients but also enhanced the exposure of medical devices to cyberattacks. The recalls of pacemakers and insulin pumps for being vulnerable to flaws underscore the present threats against patient safety. A comparative analysis of regulatory policies in the European Union (EU) and United States (US) reaffirms common priorities including lifecycle integration of cybersecurity, secure-by-design philosophy and post-market surveillance. In EU, technical advice comes from the European Union Agency for Cybersecurity (ENISA) and is in conformity with more extensive legislative tools, such as the Medical Device Regulation (MDR 2017/745), General Data Protection Regulation (GDPR), and the Network and Information Systems Directive (NIS). In US, Food and Drug Administration (FDA) promotes a prescriptive framework with comprehensive technical requirements, primarily the 2023 guidance that established the Secure Product Development Framework (SPDF) and imposed measures like encryption, authentication and regular patching. Although both frameworks align on fundamental principles, divergence still exists in scope, enforcement and technical detail, posing compliance issues to global manufacturers. Observed gaps highlight the pressing requirement for aligned global strategies that combine regulatory alignment, sharing of threat intelligence, and adaptive innovation to enhance device resilience and protect patient safety from expanding cyber threats.