Medical Device Safety Management Using Cybersecurity Risk Analysis

Dong Won Kim, Jin Young Choi, Keun Hee Han

Research output: Contribution to journalArticlepeer-review

11 Citations (Scopus)


Hospital biomedical engineering teams are responsible for establishing and regulating medical equipment management programs (MEMPs); these programs ensure the safety and reliability of medical devices. Concomitant with rapid technological advancements, medical devices have been developed that are now being integrated with information and communication technology. However, with the convergence of such diverse technologies, internal and external security threats are continuously increasing. Thus, to reduce medical device security threats, important devices must be identified and prioritized. In this study, we propose a multicriteria decision-making model that prioritizes medical devices by extending the Fennigkoh and Smith model to include security threats. First, we formulate criteria for evaluating medical device functions based on the classification of the medical devices according to their unique functions, connections, and data types. Then, through threat modeling, we develop a method of identifying and evaluating security threats to these devices. We discuss establishing a safer MEMP by analyzing the attack occurrence probability (AOP) and attack success probability (ASP) of medical devices and the inherent security threats that these devices face, none of which are considered in the existing model. Thus, by using the enhanced Fennigkoh and Smith model, our proposed approach enables the development of improved security-enhanced MEMPs, including cybersecurity risk assessments.

Original languageEnglish
Article number9119369
Pages (from-to)115370-115382
Number of pages13
JournalIEEE Access
Publication statusPublished - 2020

Bibliographical note

Funding Information:
This research was supported by the Konyang University Research Fund of 2019.

Publisher Copyright:
© 2013 IEEE.


  • Biomedical equipment
  • cybercare
  • security management

ASJC Scopus subject areas

  • General Computer Science
  • General Materials Science
  • General Engineering


Dive into the research topics of 'Medical Device Safety Management Using Cybersecurity Risk Analysis'. Together they form a unique fingerprint.

Cite this