{"id":940,"date":"2018-04-17T22:25:00","date_gmt":"2018-04-17T22:25:00","guid":{"rendered":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/2018\/04\/17\/9-proposed-health-care-cyber-security-policies-from-a-health-trade-association-medical-supplier-liability-is-the-key\/"},"modified":"2018-04-17T22:25:00","modified_gmt":"2018-04-17T22:25:00","slug":"9-proposed-health-care-cyber-security-policies-from-a-health-trade-association-medical-supplier-liability-is-the-key","status":"publish","type":"post","link":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/9-proposed-health-care-cyber-security-policies-from-a-health-trade-association-medical-supplier-liability-is-the-key\/","title":{"rendered":"9 Proposed Health Care Cyber Security Policies from a Health Trade Association. Medical Supplier Liability is the Key."},"content":{"rendered":"<p>Healthcare Supply Chain Association recommends these contract provisions for health care contracts:<\/p>\n<div title=\"Page 1\">\n<ul>\n<li>Suppliers should warrant their <strong>compliance with FDA premarket and post market guidance<\/strong> relative to cybersecurity risks throughout their product\u2019s lifecycle.<\/li>\n<li>Products should be assessed and <strong>warranted to be free of known malicious code <\/strong>or other vulnerabilities at the time of delivery and\/or implementation.<\/li>\n<li>Suppliers should <strong>comply with all reasonable security practices<\/strong> required by the provider that are consistent with current network and device security guidelines and best practices looking to:\n<ul>\n<li>International Organization for Standardization (ISO) International Electrotechnical Commission (I(IEC)\u00a0(\u00a0ISO\/IEC)<\/li>\n<li>the Association for the Advancement of Medical Instrumentation (AAMI)<\/li>\n<li>the Open Web Application Security Project( OWASP)<\/li>\n<li>The SANS Institute<\/li>\n<li>the Center for Internet Security<\/li>\n<li>National Institute of Standards and Technology (NIST)<\/li>\n<\/ul>\n<\/li>\n<li>The <strong>expected useful life of the device or service should be specified within the purchase agreement and security updates<\/strong> to the software and all supporting software components should be made available for the stated useful life at no additional cost to the provider<\/li>\n<li>Suppliers should make every effort to <strong>assist providers in resolving cybersecurity threats<\/strong> and vulnerabilities in a timely manner.<\/li>\n<li>Purchase agreements for medical devices and services should contain appropriate liability and warranty provisions that contain<strong> no limitations on supplier\u2019s liability due to failure to comply with cyber security terms.<\/strong><\/li>\n<li><strong>Cyber security sharing initiatives<\/strong> should be explicitly allowed and exempted from any non-disclosure provisions<\/li>\n<li><strong>A Manufacturers Disclosure Statement for Medical Device Security <\/strong>(MDS2) should be provided for any device that maintains or transmits data.<\/li>\n<li><strong>SUPPLIER\u00a0WARRANITES.\u00a0<\/strong>Suppliers should warrant that they internally follow cybersecurity best practices, provide documentation describing in detail their cybersecurity\/penetration testing process as well as program details for patching, incident response and secure set up and configuration.<\/li>\n<\/ul>\n<p><a href=\"http:\/\/c.ymcdn.com\/sites\/www.supplychainassociation.org\/resource\/resmgr\/HSCA_Recommended_Cybersecuri.pdf\">HSCA | Recommendations for Medical Device\u00a0Cybersecurity Terms and Conditions<\/a><\/p>\n<ol style=\"list-style-type:none;\">\n<li>\n<p>\u00a0<\/p>\n<\/li>\n<\/ol>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Healthcare Supply Chain Association recommends these contract provisions for health care contracts:<\/p>\n<div title=\"Page 1\">\n<ul>\n<li>Suppliers should warrant their <strong>compliance with FDA premarket and post market guidance<\/strong> relative to cybersecurity risks throughout their product\u2019s lifecycle.<\/li>\n<li>Products should be assessed and <strong>warranted to be free of known malicious code <\/strong>or other vulnerabilities at the time of delivery and\/or implementation.<\/li>\n<li>Suppliers should <strong>comply with all reasonable security practices<\/strong> required by the provider\u2026<\/li>\n<\/ul>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25,22,13,3],"tags":[],"class_list":["post-940","post","type-post","status-publish","format-standard","hentry","category-biometrics","category-contracting-procurement","category-health-care-data","category-legislative-trend","entry"],"_links":{"self":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/940","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/comments?post=940"}],"version-history":[{"count":0,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/940\/revisions"}],"wp:attachment":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/media?parent=940"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/categories?post=940"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/tags?post=940"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}