An implantable medical device (12, 102) comprising: a housing configured to be implanted within a patient; and one or more processors disposed within the housing and configured to: receive a programming package comprising a collection of configuration change requests, transaction credentials, and a signature indicative of a source of the programming package, wherein one of the transaction credentials is a first hash of the collection of configuration change requests; validate an external device (14, 104, 106) as the source by decrypting the signature using a key that is uniquely associated with the external device (14, 104, 106); verify the transaction credentials and the configuration change requests of the programming package; generate a second hash of the collection of configuration change requests; compare the second hash that is generated to the first hash that is received in the programming package; and responsive to both (i) the second hash matching the first hash and (ii) the transaction credentials and the configuration change requests being verified, execute the collection of configuration change requests to update an operating configuration of the IMD. a housing configured to be implanted within a patient; and one or more processors disposed within the housing and configured to: receive a programming package comprising a collection of configuration change requests, transaction credentials, and a signature indicative of a source of the programming package, wherein one of the transaction credentials is a first hash of the collection of configuration change requests; validate an external device (14, 104, 106) as the source by decrypting the signature using a key that is uniquely associated with the external device (14, 104, 106); verify the transaction credentials and the configuration change requests of the programming package; generate a second hash of the collection of configuration change requests; compare the second hash that is generated to the first hash that is received in the programming package; and responsive to both (i) the second hash matching the first hash and (ii) the transaction credentials and the configuration change requests being verified, execute the collection of configuration change requests to update an operating configuration of the IMD. receive a programming package comprising a collection of configuration change requests, transaction credentials, and a signature indicative of a source of the programming package, wherein one of the transaction credentials is a first hash of the collection of configuration change requests; validate an external device (14, 104, 106) as the source by decrypting the signature using a key that is uniquely associated with the external device (14, 104, 106); verify the transaction credentials and the configuration change requests of the programming package; generate a second hash of the collection of configuration change requests; compare the second hash that is generated to the first hash that is received in the programming package; and responsive to both (i) the second hash matching the first hash and (ii) the transaction credentials and the configuration change requests being verified, execute the collection of configuration change requests to update an operating configuration of the IMD.