# Integral Security Pillars for Medical Devices:
## 3 Results
### Review of Regulations, Cybersecurity Studies, and Common Vulnerabilities
#### 3.2.1 Regulations

Table 3: HIPAA and its supporting regulations (Privacy, Security, National Identifiers, Transactions and Codes, and Breach Notification). * **ENISA** ENISA (European Union Agency for Cybersecurity) is not a legal regulation like HIPAA, but rather an agency that provides guidelines, recommendations, and best practices in cybersecurity. Its main objective is to promote cybersecurity across Europe [27]. * **GDPR** The General Data Protection Regulation (GDPR) establishes principles and requirements for the protection of personal data within the European Union. Although there are no specific GDPR controls exclusively for medical devices, its general principles apply to any processing of personal data, including that performed by these devices [29]. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Normative** & **Year** & **Name** & **Description** \\ \hline \hline \multirow{8}{*}{ENISA} & \multirow{8}{*}{Professional services} & \multirow{8}{*}{Ic includes consulting, audits, and technical support. Good practices encompass cybersecurity training, restricted access policies, and continuous risk management. It includes telemedicine systems and remote patient monitoring. It is recommended to use secure connections, robust authentication, and personal and health data protection. They manage the physical infrastructure of healthcare buildings (HVAC, lighting, security). Practices include network segmentation, continuous monitoring, and regular software updates. They handle clinical information, such as electronic health records (EHR/EMR). Implementing role-based access controls, data encryption, and audits of access and modifications is crucial. Cloud services for storing and processing health data. Best practices include vendor security assessment, encryption, and disaster recovery plans. Verify the identity of users and devices. Multi-factor authentication, identity management, and monitoring of authentication activities are recommended. They control industrial processes in healthcare facilities. Practices include network segmentation, real-time monitoring, and regular system updates. It connected medical devices that manage patient data. Security by design, data encryption, and threat monitoring are essential. Healthcare professionals and patients use mobile devices. Secure applications, mobile device management policies, and malware protection are recommended. Network equipment that supports healthcare IT infrastructure. Best practices include implementing firewalls, network segmentation, and updating network firmware and software. \\ \hline \hline \end{tabular}
\end{table} 
Table 4: ENISA good practices for the security of healthcare services. * **HITRUST**  
HITRUST (Health Information Trust Alliance) is a non-profit organization that develops and maintains the HITRUST Information Security Framework (HITRUST CSF). This set of controls and best practices is specifically designed to manage information security risks in the healthcare sector and related industries [7].