Achieving security level 1 according to IEC TR 60601-4-5
For the Atlan anesthesia device with software 2.0x/2.1x an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-1) the following measures are required:
If the device is used in a network, the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The operator must inform the user before accessing the device about policy requirements if needed.
In case of logging failure, the device does not create a notification. Therefore, the device cannot achieve SL-1 in this point.
Achieving security level 1 according to IEC TR 60601-4-5
For the Perseus anesthesia device with software 2.0n an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-1) the following measures are required:
If the device is used in a network, the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The operator must inform the user before accessing the device about policy requirements if needed.
In case of logging failure, the device does not create a notification. Therefore, the device cannot achieve SL-1 in this point.
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
The access to exported log and configuration data must be restricted.
Fabius
For the Fabius anesthesia device with software 3.n an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-1) the following measures are required:
If the device is used in a network, the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports, unless required.
If required, the operating organization must inform the user about policy requirements before accessing the device.
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
The access to exported log and configuration data must be restricted.
The device cannot achieve SL-1 in the following points:
In case of logging failure, the device does not create a notification.
The device only logs selected security events.
Oxylog 2000 plus
For the Oxylog 2000 plus ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Oxylog 3000 plus
For the Oxylog 3000 plus ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Oxylog VE300
For the Oxylog VE300 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Carina
For the Carina ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Babyleo TN500
For the Dräger IncuWarmer Babyleo TN500 warming therapy device an analysis according to IEC 60601-4-5 has been executed to identify its security level.
The analysis revealed that security level 1 (SL-T=1) cannot be achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures are required:
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
Do not leave the device unattended when restricted device functions are active.
The operating organization must inform the user before accessing the device about policy requirements if needed.
The device does not provide a specialized security logging mechanism.
If a serial-to-network adapter is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
Access to exported and transmitted data outside of the device must be restricted.
Modifications, updates, and service shall only be executed by trained service personnel.
The device is not intended for network connection, therefore the network is disabled. Do not connect the device to the hospital LAN via the Ethernet interface.
The device contains patient-related data. In the event of disposal, remove the data by starting the device with a new patient setup in the new patient dialogue.
The analysis revealed that for the security level 1 (SL-T=1) the following measures are required:
The operator must inform the user before accessing the device about policy requirements if needed.
Access to exported and transmitted data outside of the device must be restricted.
If a serial-to-network adapter is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
M540 Converter Service 2.0n
Achieving security level 1 according to IEC TR 60601-4-5
For the M540 Converter Service with software 2.0n an analysis according to IEC TR 60601-4-5 has been executed to determine its security level. The analysis revealed that for the security level 1 (SL-T =1) the following measures are required:
The security level of the hospital network must ensure that no attackers can access the Infinity network (use of an isolated network).
The host PC of the M540 Converter Service shall only be operated in an access restricted location. The responsible organization must ensure that only authorized people have access to this PC and the M540 Converter Service software.
D-Vapor / D-Vapor 3000
For the D-Vapor / D-Vapor 3000 Desflurane anaesthetic agent delivery device with software 3.00 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-1) the following measures are required:
If the device is connected to a network (to conduct service activities), the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports, unless required.
If required, the operating organization must inform the user about policy requirements before accessing the device.
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
The access to exported log data must be restricted.
The device cannot achieve SL-1 in the following points:
The device does not log explicit security events.
In case of logging failure, the device does not create a notification.
Savina 300
For the Savina 300 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Savina Color
For the Savina Color ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Evita 2
For the Evita 2 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Evita 4
For the Evita 4 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Evita XL
For the Evita XL ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Evita V300
For the Evita V300 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Evita V500
For the Evita V500 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Evita V600/V800 V3.x
For the Evita V600/V800 ventilator device with software 3.x an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that security level 1 (SL-1) is achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures can be applied to increase security:
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
If the serial interface is activated and a connector is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
Babylog 8000
For the Babylog 8000 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Babylog VN500
For the Babylog VN500 ventilator device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Babylog VN600/VN800 V3.x
For the Babylog VN600/VN800 ventilator device with software 3.x an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that security level 1 (SL-1) is achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures can be applied to increase security:
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
If the serial interface is activated and a connector is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
Evita V600/V800 V2.x
For the Evita V600/V800 ventilator device with software 2.x an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that security level 1 (SL-1 is achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures can be applied to increase security:
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
If a serial connector is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
Evita V600/V800 V1.05.01
For the Evita V600/V800 V1.05.01 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Babylog VN600/VN800 V2.x
For the Babylog VN600/VN800 ventilator device with software 2.x an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that security level 1 (SL-1) is achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures can be applied to increase security:
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
If a serial connector is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
Babylog VN600/VN800 V1.05.01
For the Babylog VN600/VN800 V1.05.01 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Babytherm 8004/10
For Babytherm 8004/10 warming therapy device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organization must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Zeus IE
For the Zeus IE anesthesia device with software 2.03 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-T 1) the following measures are required:
If the device is used in a network, the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The operator must inform the user before accessing the device about policy requirements if needed.
In case of logging failure, the device does not create a notification. Therefore, the device cannot achieve SL-T1 in this point.
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
The access to exported log and configuration data must be restricted.
Scio Four
For the Scio Four respiratory gas monitor with software versions 04.13.01 and 04.23.02 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-T 1) the following measures are required:
If the device is used in a network, the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports, unless required.
If required, the operating organization must inform the user about policy requirements before accessing the device.
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
The device cannot achieve SL-T 1 in the following points:
The device does not log explicit security events.
Dräger CO2 Mainstream Sensor
For the Dräger CO2 Mainstream Sensor with software version SW 04.26.00 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-T 1) the following measures are required:
If required, the operating organization must inform the user about policy requirements before accessing the device.
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
The device cannot achieve SL-T 1 in the following points:
The device does not log explicit security events.
Achieving security level 1 according to IEC TR 60601-4-5
For the Ambia medical supply unit with revision 25 and higher an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-T=1) the following measures are required:
The device shall only be operated in an access restricted location. The responsible organization must ensure that only authorized people have access to the device.
Vamos / Vamos plus
For the Vamos /Vamos plus respiratory gas monitor an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-T 1) the following measures are required:
If the device is used in a network, the security level of the hospital network must ensure that no attackers can access the device (isolated network).
The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports, unless required.
If required, the operating organization must inform the user about policy requirements before accessing the device.
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
The device cannot achieve SL-T 1 in the following points:
The device does not log explicit security events.
Targeted Alarm Service 1.n
For the Targeted Alarm Service with software version 1.n an analysis according to IEC TR 60601-4-5 has been executed to determine its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization. These requirements are comprehensively detailed in the administration manual for the Targeted Alarm Service.
PulmoVista 500
For the PulmoVista 500 ventilator device with software 1.x an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that security level 1 (SL-1) cannot be achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures are required:
The device does not provide a specialized security logging mechanism.
The device shall only be operated in an access restricted location. The operating organisation must ensure that only authorized people have access to the device.
If a serial connector is used within the devices system context, the hospital network must ensure network protection measures for isolated networks.
Modifications, updates, and service shall only be executed by trained service personnel.
PulmoVista 500 SW2.0
For the PulmoVista 500 device with software 2.0 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that security level 1 (SL-1) is achieved. For a secure device operation in terms of IEC 60601-4-5, the following measures can be applied to increase security:
The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
The operator must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Modifications, updates, and service shall only be executed by trained service personnel.
Dräger Infinity MCable Mainstream CO2
For the Dräger Infinity MCable Mainstream CO2 with software version SW 01.07 an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis revealed that for the security level 1 (SL-T 1) the following measures are required:
If required, the operating organization must inform the user about policy requirements before accessing the device.
The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
The device cannot achieve SL-T 1 in the following points:
The device does not log explicit security events.
Patient Vicinity IT Workstation
For the Patient Vicinity IT Workstation an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organisation must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operator must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
Caleo
For the Dräger Caleo warming therapy device an analysis according to IEC 60601-4-5 has been executed to identify its security level. The analysis identified that certain security requirements essential for achieving Security Level 1 (SL-T = 1) need to be implemented by the responsible organization:
Network Protection Measures: The hospital network must ensure network protection measures for isolated networks to prevent unauthorized access and potential cybersecurity threats.
Communication Ports: The device cannot deactivate its communication ports. Therefore, do not connect any devices to the ports unless required for specific operations.
User Policy Information: The operating organization must inform the user about policy requirements before accessing the device, if needed, to ensure compliance with security protocols.
Security Logging: The device does not provide a specialized security logging mechanism. Therefore, alternative monitoring measures should be considered if necessary.
Physical Access Restriction: The device shall only be operated in an access restricted location. The operating organization must ensure that only authorized people have access to the device.
Service and Maintenance: Modifications, updates, and service shall only be executed by trained service personnel.
