A hospital group, a medical device maker or a health software vendor can sit under five or six security regimes at once, each with its own regulator, scope test and evidence format. In the US the HIPAA Security Rule governs electronic protected health information while the FDA regulates the security of connected devices before they reach the market. In Europe, medical device law, NIS2 and the new European Health Data Space overlap, and in England the NHS Data Security and Protection Toolkit sets the bar for anyone touching NHS data. This map sets the main health sector cyber rules side by side: who they cover, what they require, where each one stands as of 25 October 2026, and how to build one control set that evidences all of them. It is written for CISOs, compliance leads and product security teams in providers, payers, digital health companies and device manufacturers. Status as of 25 October 2026; recheck dates before you rely on them.
Key takeaways
- HIPAA's rewrite is still a proposal. HHS issued the Security Rule NPRM on 27 December 2024 (published 6 January 2025, 90 FR 898). The latest Unified Agenda moved it to Long-Term Actions with a July 2027 final action date, and HHS says the current rule remains in effect.
- Device security is a premarket gate. Section 524B of the FD&C Act has applied to "cyber devices" since 29 March 2023, requiring a postmarket vulnerability plan, patching processes and a software bill of materials in the submission; FDA's premarket guidance was last finalised on 27 June 2025.
- Europe layers product law on operator law. MDR and IVDR Annex I set IT security requirements for devices (interpreted by MDCG 2019-16 rev.1), NIS2 covers healthcare providers and device manufacturers as entities, and the EHDS adds certified security requirements for electronic health record systems from 2029.
- England adds an annual self-assessment. Every organisation with access to NHS patient data and systems must provide assurance through the DSPT, now in its 2026-27 version 9 and aligned to the NCSC Cyber Assessment Framework.
- Non-human identities are in scope everywhere. Integration engines, HL7 and FHIR interfaces, device service accounts and AI agents reading records all touch regulated data, so asset inventories, MFA exceptions and access reviews must include them.
Regulations and frameworks at a glance
| Regime | Region | Who is in scope | Core security demand | Status (as of 25 October 2026) |
|---|---|---|---|---|
| HIPAA Security Rule, 45 CFR Part 164 Subparts A and C | US | Covered entities (plans, clearinghouses, providers doing standard transactions) and business associates | Administrative, physical and technical safeguards for ePHI based on risk analysis | In force |
| HIPAA Security Rule NPRM (RIN 0945-AA22) | US | Same as above | Mandatory MFA, encryption, asset inventory, network map, scans, penetration tests, 72-hour restoration | Proposed; Long-Term Actions, final action listed July 2027 |
| HIPAA Breach Notification Rule, 45 CFR 164.400-414 | US | Covered entities and business associates | Notify individuals, HHS and (above 500 residents of a state) media within 60 days of discovery | In force |
| FD&C Act section 524B and FDA premarket cybersecurity guidance | US | Sponsors of 510(k), De Novo, PMA and similar submissions for cyber devices | Vulnerability monitoring plan with coordinated disclosure, secure processes, patches, SBOM | In force since 29 March 2023; guidance finalised 27 June 2025 |
| EU MDR 2017/745 and IVDR 2017/746 Annex I, with MDCG 2019-16 rev.1 | EU | Manufacturers of medical devices and in vitro diagnostics, including software as a medical device | Secure development life cycle, IT security requirements, protection against unauthorised access | In force; MDCG guidance rev.1 dated July 2020 |
| NIS2 Directive (EU) 2022/2555 | EU | Healthcare providers, EU reference laboratories, pharmaceutical and medical device manufacturers above size thresholds | Article 21 risk management measures, Article 23 incident reporting, management accountability | Applies through national transposition laws |
| European Health Data Space Regulation (EU) 2025/327 | EU | Manufacturers of EHR systems, health data holders, health data access bodies | Certified security and interoperability for EHR systems; secure processing environments for secondary use | In force 26 March 2025; key obligations apply from 2029 and 2031 |
| Data Security and Protection Toolkit (DSPT) | England | All organisations with access to NHS patient data and systems | Annual self-assessment against the National Data Guardian's 10 data security standards, CAF-aligned for larger bodies | 2026-27 version 9 live |
| UK NIS Regulations 2018 | UK | Health sector operators of essential services | Appropriate and proportionate security measures; incident notification within 72 hours | In force; being amended by the Cyber Security and Resilience Bill |
Scope: who and what is covered
Scope tests differ by what they regulate. HIPAA regulates the organisation and the data, FDA and MDR regulate the product, NIS2 regulates the entity by sector and size, and the EHDS regulates both a product class (EHR systems) and data flows.
- HIPAA: covered entities and business associates that create, receive, maintain or transmit ePHI, including cloud hosts, billing firms, IT support and software vendors, and their subcontractors. Consumer health apps outside a business associate relationship are not covered; see the Health Data Privacy Beyond HIPAA Guide.
- FDA 524B: a "cyber device" is one that includes software validated, installed or authorised by the sponsor, can connect to the internet, and contains technological characteristics that could be vulnerable to cybersecurity threats. In practice almost any networked or software-driven device meets the test.
- MDR and IVDR: every device placed on the EU market, including standalone medical device software. The cybersecurity requirements sit in the general safety and performance requirements of Annex I, so they apply regardless of risk class, although the depth of evidence scales with class.
- NIS2: the health sector in Annex I covers healthcare providers, EU reference laboratories, entities carrying out research and development of medicinal products, manufacturers of basic pharmaceutical products and preparations (see the pharma and GxP cybersecurity guide), and manufacturers of devices considered critical during a public health emergency. Annex II adds manufacturers of medical devices and in vitro diagnostic devices. Medium and large entities are in scope by default; Member States may designate smaller ones.
- EHDS: manufacturers of EHR systems placed on the EU market, health data holders who must make data available for secondary use, and the health data access bodies that run secure processing environments.
- DSPT: NHS trusts, GP practices, social care providers, commissioning bodies and any supplier with access to NHS patient data or systems, which brings many software and managed service providers into scope by contract.
Key obligations
United States
| Area | HIPAA Security Rule (in force) | HIPAA NPRM (proposed) | FDA section 524B |
|---|---|---|---|
| Risk analysis | Required, 164.308(a)(1) | Written, including review of asset inventory and network map, threats and risk levels | Threat modelling and cybersecurity risk management in the premarket submission |
| Authentication | Person or entity authentication, 164.312(d); MFA not mandated | MFA required with limited exceptions | Authentication and authorisation controls designed into the device |
| Encryption | Addressable at rest and in transit | Required at rest and in transit, limited exceptions | Cryptographic controls per FDA guidance |
| Vulnerability management | Not specified | Scanning at least every six months, penetration testing every 12 months | Postmarket monitoring plan with coordinated vulnerability disclosure; regular patch cycle and out-of-cycle fixes for critical vulnerabilities |
| Inventory | Implied by risk analysis | Technology asset inventory and network map, reviewed every 12 months | Software bill of materials covering commercial, open-source and off-the-shelf components |
| Recovery | Contingency plan, data backup | Restore certain systems and data within 72 hours | Not applicable |
| Access changes | Termination procedures (addressable) | Notify certain regulated entities within 24 hours of a workforce access change | Not applicable |
| Third parties | Business associate agreements | Annual written verification of business associates' technical safeguards | Supplier and component risk in the SBOM and risk file |
The current rule is covered in depth in the HIPAA Security Rule Guide, and the proposal in the HHS HIPAA Security Rule Update Guide. For device programmes see the FDA Medical Device Cybersecurity Guide.
European Union and United Kingdom
- MDR Annex I, sections 17.2 and 17.4 (IVDR Annex I section 16): software must be developed according to the state of the art, taking into account development life cycle, risk management including information security, verification and validation; manufacturers must state minimum requirements for hardware, IT network characteristics and IT security measures, including protection against unauthorised access. MDCG 2019-16 rev.1 explains how to meet these, including security risk management, a joint responsibility model with operators, and information for users such as a customer security documentation pack.
- NIS2 Article 21: risk management measures including policies on risk analysis, incident handling, business continuity and backup, supply chain security, vulnerability handling and disclosure, cryptography, access control and asset management, and MFA or continuous authentication where appropriate. Management bodies must approve the measures and can be held liable.
- NIS2 Article 23: significant incidents need an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Hospitals that also process personal data run this alongside the GDPR 72-hour clock; see the Cyber Incident Reporting Requirements Map.
- EHDS: EHR systems must meet harmonised security and interoperability requirements and be self-certified by manufacturers before market placement; patients can restrict professionals' access to parts of their data; secondary use happens only in secure processing environments from which personal data cannot be downloaded, and re-identification is prohibited.
- DSPT: evidence against the 10 data security standards (staff responsibilities, training, managing data access, process reviews, responding to incidents, continuity planning, unsupported systems, IT protection, accountable suppliers and others). From 2024-25 the toolkit moved larger NHS bodies to a CAF-aligned format with outcome-based assessment, and the site publishes CAF-aligned audit guidance.
Timeline and current status
| Date | Event |
|---|---|
| July 2020 | MDCG 2019-16 rev.1 Guidance on cybersecurity for medical devices published |
| 29 December 2022 | Consolidated Appropriations Act, 2023 signed; section 3305 adds FD&C Act section 524B |
| 29 March 2023 | Section 524B requirements take effect for cyber device submissions |
| 17 October 2024 | NIS2 transposition deadline; national laws arrive on different dates |
| 27 December 2024 / 6 January 2025 | HIPAA Security Rule NPRM issued by HHS OCR and published in the Federal Register (90 FR 898) |
| Spring 2025 Unified Agenda | HIPAA rule at Final Rule Stage, final action targeted May 2026 |
| 26 March 2025 | EHDS Regulation enters into force after publication on 5 March 2025 |
| 27 June 2025 | FDA finalises updated premarket cybersecurity guidance, adding Section VII on cyber devices and superseding the September 2023 version |
| Latest Unified Agenda | HIPAA rule moved to Long-Term Actions, final action listed for July 2027 |
| 2026-27 | DSPT version 9 in use |
| 2027 | Commission due to adopt key EHDS implementing acts |
| 2029 | EHDS: patient summaries and ePrescriptions exchangeable across Member States; secondary use rules apply to most data categories |
| 2031 | EHDS: medical images, lab results and discharge reports exchangeable; secondary use applies to remaining categories such as genomic data |
The HIPAA date is the one most likely to move. Plan to the proposed controls because they reduce real risk, but do not tell auditors or boards that they are already law.
Enforcement and penalties
- HIPAA: HHS OCR investigates complaints and breach reports and settles through resolution agreements with corrective action plans, or imposes civil money penalties tiered by culpability and adjusted annually for inflation (45 CFR 160.404). State attorneys general can also sue under HITECH. The Change Healthcare breach, where a Citrix remote-access portal without MFA was entered with a stolen credential and 192.7 million people were affected, led to an OCR investigation, a consolidated class action and a Nebraska attorney general lawsuit.
- Breach notification: individuals must be told without unreasonable delay and no later than 60 days after discovery; breaches of 500 or more go to HHS within the same 60 days and appear on the public OCR breach portal; smaller breaches are logged and reported within 60 days of the end of the calendar year. See the Data Breach Notification Checklist.
- FDA: the lever is market access. A submission for a cyber device that lacks the 524B content can be refused or held; FDA's guidance describes the documentation it expects, and postmarket failures can lead to recalls and safety communications.
- EU MDR and IVDR: notified bodies assess Annex I conformity, and national competent authorities enforce through market surveillance, corrective action and penalties set in national law.
- NIS2: fines of up to EUR 10 million or 2% of worldwide turnover for essential entities and EUR 7 million or 1.4% for important entities, plus supervisory measures and, for essential entities, temporary bans on management functions.
- DSPT: no statutory fine, but a "standards not met" outcome affects NHS contracts and access to national systems, and NHS England can require improvement plans.
What it means for AI agents and non-human identities
Health IT runs on machine-to-machine traffic: interface engines moving HL7 v2 messages, FHIR APIs serving apps, PACS and modality integrations, device management platforms, robotic process automation in revenue cycle, and now AI agents summarising records or drafting prior authorisations. Each of those uses a non-human identity, and each touches regulated data.
| Requirement | Where it comes from | What it means for NHIs and agents |
|---|---|---|
| Unique identification and audit controls | HIPAA 164.312(a)(2)(i), 164.312(b) | No shared interface accounts; every agent and integration gets its own identity so audit logs show which one read which record |
| Asset inventory and network map | HIPAA NPRM; NIS2 Article 21 asset management | Inventory must list service accounts, API clients, certificates and agents that create, receive or transmit ePHI, with their data flows |
| MFA with limited exceptions | HIPAA NPRM; NIS2 Article 21(2)(j) | Machine identities cannot do MFA, so document the exception and use compensating controls: workload identity federation, short-lived tokens, mutual TLS, IP or network restrictions |
| 24-hour access change notices | HIPAA NPRM | When a vendor's engineer or integration is offboarded, its credentials at the covered entity must be revoked; track keys issued to business associates |
| Device authentication and authorisation | FDA premarket guidance; MDR Annex I 17.4 | No hard-coded or default credentials in devices; per-device credentials and a documented key management design |
| Patient access restrictions | EHDS | Agents acting for clinicians must honour the same access restrictions as the clinician, not run under a broad system account |
See the Healthcare Identity Security Guide for clinical workflow identity, and the Service Account Security Guide for the machine side.
Compliance steps
- Determine applicability per legal entity and product. Record for each entity whether it is a covered entity, business associate, NIS2 essential or important entity, DSPT participant, device manufacturer or EHR system manufacturer. Many groups are several at once.
- Build one control set mapped many ways. Use NIST CSF 2.0 or ISO/IEC 27001:2022 as the spine, map each control to HIPAA citations, NIS2 Article 21 points, DSPT standards and device requirements, and evidence it once.
- Close the NPRM gaps that are cheap now. MFA on remote access and email, an asset inventory that includes non-human identities, encryption at rest, and tested restoration of critical systems. The Change Healthcare intrusion is the reference case for remote access without MFA.
- Inventory clinical and device assets. Ask device suppliers for SBOMs and MDS2 forms, map devices to network segments, and record which ones cannot be patched or cannot take endpoint agents.
- Run the incident clocks as a single playbook. HIPAA's 60 days, GDPR's 72 hours, NIS2's 24 hours and UK NIS's 72 hours can all start from the same ransomware event; assign one owner per clock.
- Govern machine and agent access. Assign owners to every interface account, rotate or replace static secrets with short-lived credentials, and include agents in quarterly access reviews.
- Measure and report. Track the metrics below at board or quality committee level.
Metrics that show it is working
- MFA coverage: percentage of remote access paths and privileged accounts with phishing-resistant MFA.
- Inventory completeness: percentage of systems holding ePHI with a named owner and mapped data flows, including non-human identities.
- Restoration time: tested time to restore tier-one clinical systems against the proposed 72-hour target.
- Device vulnerability exposure: count of devices with known exploited vulnerabilities and no compensating control.
- Stale machine credentials: service account or API keys older than policy, or with no owner.
Common failure patterns
- Treating the NPRM as law, or ignoring it: both distort priorities; plan to it, label it accurately.
- Remote access without MFA: vendor and support portals are the usual gap, as Change Healthcare showed.
- Device risk left to biomedical engineering alone: security never sees the inventory or the SBOMs.
- Shared integration accounts: one interface engine credential used across many feeds makes audit controls meaningless.
- NIS2 scope assumed from the sector name: device manufacturers often miss Annex II and providers miss national designations.
Framework mapping
| Theme | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Legal and regulatory requirements understood | GV.OC-03 | PM-9 |
| Identities and credentials for users, services and hardware | PR.AA-01 | IA-2, IA-9 |
| Supply chain and supplier security | GV.SC-05 | SR-3 |
| Incident notification | RS.CO-02 | IR-6 |
Practitioner checklist
- Map every legal entity and product to the regimes in the at-a-glance table and record the result.
- Confirm the HIPAA NPRM status on the Federal Register and Unified Agenda before each board report.
- Enforce MFA on every remote access path, including vendor portals and support tools.
- Build an asset inventory and ePHI network map that includes service accounts, API clients, certificates and AI agents.
- Require SBOMs, MDS2 forms and a coordinated vulnerability disclosure contact from device suppliers.
- For device makers, check every cyber device submission against section 524B and the June 2025 FDA guidance.
- Confirm NIS2 scope in each Member State where you operate, including Annex II manufacturing.
- Complete the DSPT on time and align evidence with the CAF where you are a larger NHS body or supplier.
- Test restoration of critical clinical systems and record the time achieved.
- Run one incident playbook with a clock owner for HIPAA, GDPR, NIS2 and UK NIS deadlines.
Standards and references
- HHS: HIPAA Security Rule NPRM Fact Sheet
- Unified Agenda: RIN 0945-AA22 HIPAA Security Rule
- HHS: Breach Notification Rule
- 21 U.S.C. 360n-2: Ensuring cybersecurity of devices (FD&C Act section 524B)
- FDA: Cybersecurity in Medical Devices
- European Commission: MDCG guidance documents (MDCG 2019-16 rev.1)
- European Commission: European Health Data Space Regulation
- NHS England: Data Security and Protection Toolkit
This guide summarises health sector cybersecurity regulation as of 25 October 2026 and is not legal advice. Related NHI Mgmt Group resources: HIPAA Security Rule Guide · HHS HIPAA Security Rule Update (2025 NPRM) Guide · Healthcare Identity Security Guide · Medical Device Security Guide · Global Cybersecurity Regulatory Map