Healthcare & Pharma
93 regulations apply to this sector.
Written for this sector
21 CFR 111FDA rule on current good manufacturing practice for dietary supplements21 CFR 210/211FDA current good manufacturing practice regulations for finished pharmaceuticals21 CFR 50/56FDA regulations on informed consent and IRB review for clinical investigations21 CFR 58FDA good laboratory practice regulations for nonclinical laboratory studies21 CFR 806FDA regulation requiring reports of corrections and removals of medical devices21 CFR 807FDA establishment registration and device listing requirements for medical devices21 CFR 812FDA investigational device exemption regulations for clinical studies of devices21 CFR 820FDA quality system regulation governing medical device design and manufacturing21 CFR Part 11FDA rule governing electronic records and signatures in pharma/biotechAI ActMedical AI is classified high-risk with strict conformity requirementsCIRCIAHealthcare critical infrastructure must report cyber incidentsEU GMPGMP is written specifically for pharmaceutical and medicinal product manufacturing.EUICS2Healthcare named as critical sector for cyber incident reportingFDA 21 CFR 210/211FDA 21 CFR 210/211 sets GMP standards specifically for pharmaceutical manufacturersFDA 21 CFR 803FDA 21 CFR 803 mandates medical device adverse event reporting to FDAFDA 21 CFR 806FDA 21 CFR 806 requires reporting of medical device corrections and removals to FDAFDA 21 CFR 812FDA 21 CFR 812 governs Investigational Device Exemptions for clinical device trialsFDA QMS 820FDA Quality Management System regulation governs medical device manufacturers directlyGDPRHealth data is special category data under GDPR with heightened obligations.GS1 StandardsGS1 identifiers are mandated for pharmaceutical and medical device traceability.Health Insurance Portability and Accountability ActHIPAA is written specifically to protect health information in healthcare.IEC 60601IEC 60601 defines safety requirements for medical electrical equipment.IEC 62304IEC 62304 specifically governs software lifecycle for medical devices.IEC 62366IEC 62366 mandates usability engineering processes specifically for medical devices.ISO 10993Biocompatibility standard specifically written for medical devices and healthcare productsISO 13485QMS standard written specifically for medical device design and manufactureISO 14155Standard written specifically for clinical investigations of medical devices in humansISO 14971Risk management standard written specifically for medical devicesISO 22301Healthcare continuity is critical for patient safety and regulatory compliance.ISO 22313Healthcare uses this guidance to operationalise continuity management systems.ISO 22317BIA identifies critical clinical and operational processes for continuity planning.ISO 22320Hospitals and health agencies are central actors in emergency management.ISO 27001Healthcare organisations certify to ISO 27001 to protect sensitive patient data.IVDRIVDR regulates in vitro diagnostic medical devices for healthcare use.MDRMedical Device Regulation is written specifically for medical device manufacturers and suppliers.NIS2Health sector is a named essential entity category under NIS2.PPE Regulation 2Healthcare workers are major PPE users; procurement subject to regulation.Also applies
ADRPharmaceutical companies transporting hazardous substances must complyAFSCAVeterinary medicines and animal health products fall under AFSCA oversightAI EOEO addresses AI use in drug discovery and healthcare applicationsBE WhistleblowingHealthcare entities subject to whistleblowing obligations.Biocides RegulationDisinfectants and pharmaceutical biocides fall under regulation.CCPA/CPRAHealthcare entities processing CA consumer personal data in scopeCIS ControlsHealthcare organisations adopt CIS Controls for data protectionCISA Cross-Sector Cybersecurity Performance GoalsHealthcare is a critical infrastructure sector under CPG guidanceCLPPharmaceutical chemical substances subject to CLP classificationDGAHealth data sharing for research purposes addressed in DGA framework.DMBOK v2Healthcare data management programs reference DMBOK practicesEC 178/2002Food supplements and pharma-adjacent products may fall in scopeEIDAS2Healthcare digital services increasingly use eIDAS-compliant identity verification.EU 396/2005Pesticide residue limits have public health implications monitored by health authorities.EU Cosmetics RegBoundary between cosmetics and medicines requires pharma regulatory awareness.EU Data ActConnected medical devices generate data covered by the Act's access rules.EU Foreign Direct Investment Screening RegulationHealth infrastructure and medical supply chains flagged as sensitive post-COVID.FTC AI GuidanceAI in health-related consumer products subject to FTC consumer protection rules.Geneva Convention I, 1949Medical personnel, units and transports in armed forces are specifically protected.Geneva Convention II, 1949Medical personnel and hospital ships at sea receive specific protections.HACCP CodexPharmaceutical manufacturing adapts HACCP principles for product safety.IAEA StatuteNuclear medicine and radiopharmaceuticals are subject to IAEA guidelines.IATA DGRPharma shipments of hazardous substances by air require IATA DGR compliance.ISO 22318Pharma supply chains require resilience to ensure medicine availability.ISO 22322Health authorities issue public warnings during disease outbreaks and crises.ISO 22361Health sector leadership uses crisis frameworks during pandemics and emergencies.ISO 22989Healthcare AI applications reference standard terminology for compliance and safety.ISO 23053Healthcare AI developers use the framework for safe ML system design.ISO 23894Healthcare AI deployments require risk management to ensure patient safety.ISO 25010Medical software must meet quality characteristics for safety and reliability.ISO 27002Healthcare organisations apply security controls to protect patient health data.ISO 27004Healthcare organisations measure security performance to satisfy compliance obligations.ISO 27005Healthcare uses it to manage risks around sensitive patient dataISO 27017/27018Healthcare cloud users apply ISO 27018 for patient data privacyISO 27034Healthcare software systems require application security controlsISO 27035Healthcare organisations apply it for managing data breach incidentsISO 27040Healthcare organisations use it to secure stored patient dataISO 27701Healthcare organisations apply it to manage sensitive patient privacyISO 29100Healthcare IT systems apply the framework for patient data privacyISO 29134Healthcare organisations conduct PIAs for patient data processing systemsISO 31700Health data systems must incorporate privacy by design principlesISO 42001Healthcare AI systems require responsible AI management per ISO 42001ISO 9001Healthcare organizations apply ISO 9001 for quality system compliance.NIST 800-53Healthcare organizations use NIST 800-53 controls for system security.NIST AI RMFAI in healthcare diagnostics and drug discovery requires robust risk management.NIST CSFHealthcare uses NIST CSF for cybersecurity program structuring.NIST IoT CSFMedical IoT devices fall within scope of IoT cybersecurity guidance.NIST IoT Cyber BaselineConnected medical devices are subject to IoT cybersecurity baselines.NIST Privacy FrameworkHealthcare handles sensitive personal data requiring structured privacy risk management.NIST RMFUsed to structure HIPAA-related security risk managementNY SHIELD ActHealthcare entities with NY resident data in scopeOWASP SAMMHealthcare software teams use SAMM to ensure secure SDLCPPE RegulationMedical and healthcare PPE is a major category subject to this regulation.Red Flags RuleHealthcare creditors extending credit must implement identity theft programs.Registration, Evaluation, Authorisation and Restriction of ChemicalsPharmaceutical raw materials and medical devices contain regulated substances.US State Privacy LawsHealth data is frequently subject to enhanced protections under state privacy laws.TRIZ for Healthcare & Pharma
Worked contradictions and resolutions for this sector.
Pharma TRIZ
Healthcare TRIZ