EN 18031 and Medical Tablet Cybersecurity: Five Things Hospital IT Teams Should Know

From EN 18031 Compliance to Secure Deployment

Since 1 August 2025, new EU RED cybersecurity requirements apply to certain connected radio equipment, with EN 18031 providing the compliance framework. Medical devices regulated under MDR or IVDR are excluded from overlapping RED cybersecurity requirements. However, not every hospital tablet qualifies as a medical device: tablets used for patient registration, communication or general administration may still fall under RED. Hospital IT teams should verify each device’s regulatory classification and obtain the relevant compliance documentation. Exemption from RED does not remove cybersecurity responsibilities.

When selecting medical tablets, hospitals should check practical security features such as TPM 2.0, Secure Boot, BitLocker, fingerprint or smart card authentication, secure software updates and centralized device management. They should also confirm the manufacturer’s software support and vulnerability management policy. Before connecting a tablet to hospital networks, IT teams should document the device model, OS, firmware version, security settings and network interfaces to support updates, change detection and incident investigation. After deployment, tablets should run on controlled network segments with access limited to necessary systems such as EHR and PACS. Clear policies are needed for Wi-Fi 6E and optional 4G LTE, while Windows devices can use tools such as Microsoft Intune for patch and security management; firmware updates may require separate manufacturer procedures.

Estone’s MW-100 rugged tablet and MD-100 medical tablet have obtained EN 18031 Parts 1 and 2 certification. Both support Windows 11 Pro/IoT, TPM 2.0 and configurable wireless connectivity; the MD-100 also offers IEC 60601-1 and IEC 60601-1-2 medical electrical safety and EMC certification. Overall, medical tablet cybersecurity goes beyond EN 18031 and requires combined attention to regulatory compliance, hardware security, network access and lifecycle software maintenance. The applicable certification scope and security features should be confirmed for each product configuration.