Smart Medicine: Introduction to the Cybersecurity Aspects of Health Wearables

The line between lifestyle gadgets and medical devices is becoming increasingly blurred. More and more wearables are offering functions that go beyond fitness tracking—providing ECGs, blood sugar measurements, or fall detection. But as soon as a wearable performs a medical purpose, it is subject to the strict regulations of the European Union. This article explains when wearables are considered medical devices and what requirements manufacturers must meet under the EU Medical Device Regulation (MDR).

1. When Is a Wearable a Medical Device?

A wearable is legally considered a medical device if it serves a medical purpose—such as the diagnosis, monitoring, or treatment of diseases. The mere measurement of steps or heart rate does not yet make a product a medical device. However, if:

• The device claims to detect cardiac arrhythmias
• It is used for continuous glucose monitoring
• Or it supports treatment decisions

then it falls under the MDR and must be certified accordingly.

2. Classification Under MDR

The MDR distinguishes medical devices into four risk classes:

• Class I: Low-risk devices (e.g., thermometers)
• Class IIa: Medium-risk devices (e.g., software for monitoring)
• Class IIb: Higher-risk devices (e.g., infusion pumps)
• Class III: High-risk devices (e.g., implantable defibrillators)

Most wearables with diagnostic or therapeutic functions fall into Class IIa or IIb. The classification determines how extensive the approval process will be.

3. Requirements for Manufacturers

If a wearable is classified as a medical device, the following obligations apply:

• Risk analysis: Identification and minimization of risks associated with the device
• Clinical evaluation: Evidence of effectiveness and safety through studies or existing data
• Technical documentation: Complete documentation on hardware, software, and manufacturing
• Quality management system: Usually certified according to ISO 13485
• Post-market surveillance: Regular monitoring and reporting of device performance

The CE marking for medical devices may only be applied after successful certification by a notified body.

4. Special Features for Software and Apps

If the software of the wearable provides medical decision support or processes diagnostic data, it must also be classified and certified as a medical device software (MDSW). Important standards include:

• IEC 62304 for software lifecycle management
• ISO 14971 for risk management
• IEC 82304-1 for health software safety

5. Data Protection and Cybersecurity

Medical wearables must not only meet performance requirements but also high security standards:

• GDPR compliance: Personal health data must be processed transparently and securely
• Secure design: Encryption, access control, and secure updates are mandatory
• Cybersecurity documentation: Evidence that the device is protected against known attack vectors

6. What Happens Without Certification?

Manufacturers who market a device with medical functions without proper certification risk:

• Sales bans and recalls
• Fines under the MDR or product liability laws
• Loss of trust and reputation damage

Distributors and importers also share responsibility and must verify MDR compliance.

7. Conclusion: Certification Is Essential for Medical Wearables

The EU MDR sets clear rules for medical wearables. Any manufacturer wishing to market such devices must ensure that they meet the legal, technical, and security requirements. Early and comprehensive planning of certification not only protects users but also creates trust and competitive advantage. In the rapidly growing market for digital health, compliance with MDR is not a burden—but a prerequisite for long-term success.