In brief
In August 2026, the Health Sciences Authority (HSA) published the finalized Best Practices Guide for Medical Device Cybersecurity (“Guide”) following a public consultation. The Guide provides best practices recommendations and considerations to all medical device manufacturers and healthcare providers on general cybersecurity principles to ensure that medical devices are secure throughout their Total Product Life Cycle.
In more detail
The consultation for the Guide ran from 10 March 2025 to 13 May 2025, which is covered by our previous article.
The consultation on the draft Guide received positive feedback, with respondents rating their understanding of the document at 4.5 out of 5. The HSA has incorporated the responses received to improve the clarity of the Guide.
The Guide is built on three key principles:
- Shared responsibilities between manufacturers and healthcare providers
- Transparency and communication
- Secure by design
Recommendations are organized across the Total Product Life Cycle, covering the pre-market development stage (including designing security features, risk management steps, security assessment and testing, user information, a post-market plan and a Software Bill of Materials) and the post-market support, limited-support and end-of-support stages, reflecting the gradual transfer of responsibility from manufacturer to healthcare provider as a device nears end of life.
Key takeaways
Manufacturers of medical devices and healthcare providers should refer to the finalized Guide to understand and implement best practices across the lifespan of the medical device. By implementing these practices, the security posture of medical devices can be enhanced, which will in turn protect patient safety and maintain the integrity of healthcare systems.
© 2026 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.