In the Chinese context, “internet plus health care” (IPHC) is introduced as an umbrella term to mean the use of digital technologies to support the delivery of health care and health-related services. IPHC holds great potential to strengthen China’s health system, transform the delivery of health services, and improve equitable, affordable, and universal access to health care. The Chinese government has adopted a variety of regulatory and policy instruments to facilitate the utilization of IPHC before, during, and after COVID-19. This article provides an overview of the development of IPHC in China, with a focus on the regulatory landscape. It then analyzes the challenges that remain in the regulatory framework and concludes with recommendations for furthering the development and utilization of IPHC in the post-COVID-19 era.

Over the last decade, the number of connected-to-network medical devices has grown significantly, which is leading to their increased exposure to cyber incidents and attacks. Medical devices’ cybersecurity is of utmost relevance all over the world. The EU legal framework here is heavily characterized by fragmentation and a lack of regulatory guidance. Moreover, legal literature on the topic is scarce, mainly because the regulation of cybersecurity and medical devices is a relatively novel subject. This chapter analyzes the applicable legal framework for cybersecurity of medical devices in the EU and pinpoints the main ethical concerns as well as the relevant regulatory challenges. The chapter introduces the key ethical concerns (i.e., harm to users’ privacy, confidentiality and integrity risks, misuse of personal and health data) and critically assesses the EU legislation regarding medical devices’ cybersecurity (such as the new EU medical devices Regulation, GDPR, NIS Directive, the Cybersecurity Act) respectively applicable to different stakeholders having different obligations. Recommendations on possible ways the stakeholders may approach medical devices’ cybersecurity are drafted with the special attention given to pre/postmarket obligations for manufacturers, the notion of data controllership, requirements applicable to operators of essential services, and the certification schemes relevant for the sector.