## 2 Background and Related Work
### Regulations and Standards  
Nowadays, healthcare applications and medical devices need to be compliant with various regulations. Ensuring security and privacy is a vital requirement for compliance with these regulations. This section presents the various regulations from the US and EU markets with their individual security and privacy requirements. * FDA: The 800 series under Title 21 of the Code of Federal Regulations (CFR) outlines the regulations which govern medical devices within the United States (US). This regulation is enforced by the Food and Drug Administration (FDA). The FDA recognizes that the security and privacy of medical devices is a shared responsibility among stakeholders, including health care facilities, patients, health care providers, and man  
Figure 1: General architecture of WBAN application [5]. ufacturers of medical devices [9]. Medical devices should be designed to protect assets and functionality, and to reduce the risk of loss of authenticity, availability, integrity and confidentiality. As part of Title 21 CFR part 820 -Quality System Regulation states that the medical device manufacturer needs to employ a cybersecurity risk management program [10]. The aim of the risk management program is to reduce the likelihood of the device functionality being compromised, intentionally or unintentionally, by inadequate cybersecurity. An effective cybersecurity risk management program should address cybersecurity in both premarket and postmarket medical device development lifecycle phases. * HIPAA: The Health Insurance Portability and Accountability Act of 1996 (HIPAA) was brought forward by the Secretary of the US Department of Health and Human Services (HHS) as a law to enforce regulations for governing electronically managed patient information in the healthcare industry, and includes privacy and security protection of electronic personal health information(e-PHI) [11]. Title II of HIPAA provides five rules: Privacy Rule, Transactions and Code Sets Rule, Security Rule, Unique Identifiers Rule, and Enforcement Rule. The purpose of these rules is to prevent fraud and abuse within the healthcare system. The Privacy Rule requires implementing different policies and procedures to provide federal protections for personal health information held by covered entities. This rule also ensures patient rights concerning that information. The Security Rule specifies a series of administrative, physical, and technical safeguards to assure the confidentiality, integrity, and availability of electronically protected health information. Below are the key security and privacy requirements outlined in the HIPAA Security and Privacy Rule:
* Ensure the confidentiality, integrity, and availability of all PHI while they create, receive, store and transmit. * Identify and protect against reasonably anticipated threats to the security or integrity of the information. * Protect against reasonably anticipated, impermissible uses or disclosures of the information. * Perform risk analysis as part of the security management processes
* Implement technical policies and procedures that allow only authorized persons to access e-PHI. * Implement policies and procedures to ensure that e-PHI is not improperly altered or destroyed. * Implement security measures to guard against unauthorized access to e-PHI. * EU Medical Devices Regulations: The European Medical Device Regulation (EU MDR) ensures high standards of safety, security, and quality of medical devices being marketed within the EU for human uses [12]. EU MDR is also known as EU Directive 2017/745 and 2017/746, which was published in 2017. The cybersecurity requirements listed in Annex I of the MDR deal with the medical device's premarket and postmarket aspects. Below is the list of key cybersecurity requirements from the EU MDR:
* Manufacturers shall establish, implement, document and maintain a risk management system.