Cybersecurity of the Internet of Medical Things as an Element of National Health Resilience
DOI:
https://doi.org/10.5281/zenodo.24012226Keywords:
Internet of Medical Things, Cybersecurity, National resilienceAbstract
This study aims to analyze the urgency of cybersecurity for the Internet of Medical Things (IoMT) as a critical infrastructure of national health resilience, and to compare the regulatory frameworks of Indonesia and the United States. Employing a normative legal research method with a statute approach and a comparative approach, this study finds that Indonesian legal instruments (the Personal Data Protection Law and the Presidential Regulation on Vital Information Infrastructure) remain reactive and data-centric, leaving legal gaps concerning pre-market certification obligations and post-market surveillance for IoMT devices. In contrast, the United States, through the Food and Drug Administration (FDA), adopts a device-centric approach that mandates manufacturers to implement a Secure Product Development Framework (SPDF) as an absolute prerequisite for obtaining marketing authorization. The absence of binding technical standards in Indonesia creates asymmetric vulnerabilities that threaten demographic stability and state sovereignty. This study recommends a paradigm shift in legal framework through the revision of the Draft Law on Cyber Security and Resilience to accommodate security-by-design standardization, the establishment of a cross-sectoral Medical Cyber Security Verification Unit, and the acceleration of ratification of the Budapest Convention to ensure the protection of medical infrastructure.
References
[1] Al Kuwaiti, A., Nazer, K., Al-Reedy, A., et al. (2023). A review of the role of artificial intelligence in healthcare. Journal of Personalized Medicine, 13(6), 951.
[2] Armawi, A., & Wahidin, D. (2018). Ketahanan nasional dan bela negara. WIRA: Media Informasi Kementerian Pertahanan, Edisi Khusus 2018, 6-11.
[3] Directive (EU) 2024/2853 of the European Parliament and of the Council of 23 October 2024 on liability for defective products (recast). Official Journal of the European Union.
[4] Federal Food, Drug, and Cosmetic Act, 21 U.S.C. § 360i-1 (Section 524B), added by Consolidated Appropriations Act, 2023, Pub. L. No. 117-328.
[5] Fichtner, J. R., & Strader, T. J. (2022). Will products liability litigation help protect IoT users from cyber-physical attacks? Journal of International Technology and Information Management, 31(1), Article 3.
[6] Food and Drug Administration. (2016). Postmarket Management of Cybersecurity in Medical Devices (Guidance). Center for Devices and Radiological Health.
[7] Food and Drug Administration. (2017, August 29). FDA Safety Communication: Firmware Update to Address Cybersecurity Vulnerabilities Identified in Abbott's Implantable Cardiac Pacemakers.
[8] Food and Drug Administration. (2026, February 3). Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Final Guidance).
[9] ISO. (2021). ISO 81001-1:2021 Health software and health IT systems safety, effectiveness and security — Part 1: Principles and concepts. Geneva: ISO.
[10] Kitab Undang-Undang Hukum Pidana (Undang-Undang Nomor 1 Tahun 2023). Lembaran Negara Republik Indonesia Tahun 2023 Nomor 1.
[11] Marzuki, P. M. (2005). Penelitian Hukum. Jakarta: Kencana.
[12] Maulaningrum, P., Mujanah, S., & Fianto, A. Y. A. (2025). Transformasi digital di sektor kesehatan: Tinjauan literatur tentang penerapan teknologi informasi dalam manajemen pelayanan. JIMEK, 5(1), 494-503.
[13] Mulyono, H. (2017). Geostrategi Indonesia dalam dinamika politik global dan regional. Jurnal Kajian Lemhannas RI, 5(1), 19-30.
[14] Peraturan Badan Siber dan Sandi Negara Nomor 9 Tahun 2021 tentang Perubahan atas Peraturan BSSN Nomor 8 Tahun 2021 tentang Penyelenggaraan Penilaian Kesiapan Penerapan SNI ISO/IEC 27001 Menggunakan Indeks Keamanan Informasi.
[15] Peraturan Badan Siber dan Sandi Negara Nomor 10 Tahun 2023 tentang Pengukuran Tingkat Kematangan Keamanan Siber.
[16] Peraturan Menteri Kesehatan Republik Indonesia Nomor 24 Tahun 2022 tentang Rekam Medis. Berita Negara Republik Indonesia Tahun 2022 Nomor 829.
[17] Peraturan Presiden Republik Indonesia Nomor 82 Tahun 2022 tentang Pelindungan Infrastruktur Informasi Vital. Lembaran Negara Republik Indonesia Tahun 2022 Nomor 129.
[18] Rachman, A. (2023). Strategi Pertahanan Negara Indonesia. Bojonegoro: Madza Media.
[19] Raihan, K., et al. (2024). Have AI-enhanced telemedicines in Indonesia adopted the principles of personal data protection? Yustisia Jurnal Hukum, 13(2).
[20] Rifa’i, I. J., Purwoto, A., Ramadhani, M., dkk. (2023). Metode Penelitian Hukum. Banten: Sada Kurnia Pustaka.
[21] Salsabila, M., Slam, Z., Alamsyah, M. N., & Hilmi, H. D. (2024). National resilience in historical and geostrategic perspectives: Essence and conception. Jurnal Lemhannas RI, 12(4), 435-452.
[22] Shahrour, G., Junejo, A., & Al-Said Ahmad, A. (2026). Security and privacy challenges in healthcare IoT systems with cloud, edge, and fog computing: A systematic literature review. Journal of Network and Computer Applications, 62, 101005.
[23] Simanjuntak, S. Y., & Waluyo, B. (2025). Criminal liability for hacking personal data through ransomware attacks on digital service providers in Indonesia. Jurnal Daulat Hukum, 8(4), 8-15.
[24] Soekanto, S., & Mamudji, S. (1985). Penelitian Hukum Normatif Suatu Tinjauan Singkat. Jakarta: Raja Grafindo Persada.
[25] Syafar, F. (2025). Cybersecurity attacks in Indonesian healthcare institutions: Incidence, operational impact and a socio-technical defense framework. World Journal of Advanced Engineering Technology and Sciences, 17(02), 470-474.
[26] Tran, A. H. (2017). The Internet of Things and potential remedies in privacy tort law. Columbia Journal of Law and Social Problems, 50(2), 263-298.
[27] Undang-Undang Republik Indonesia Nomor 3 Tahun 2002 tentang Pertahanan Negara. Lembaran Negara Republik Indonesia Tahun 2002 Nomor 3.
[28] Undang-Undang Republik Indonesia Nomor 34 Tahun 2004 tentang Tentara Nasional Indonesia. Lembaran Negara Republik Indonesia Tahun 2004 Nomor 127.
[29] Undang-Undang Republik Indonesia Nomor 27 Tahun 2022 tentang Pelindungan Data Pribadi. Lembaran Negara Republik Indonesia Tahun 2022 Nomor 196.
