Medical device security represents a growing problem within the healthcare industry. An increasing number of medical devices and systems contain critical health related information for which integrity, availability, and confidentiality must be maintained. HIPAA's Security Rule requires that US healthcare providers have a security program addressing this problem in place by April 21, 2005. Through a collaborative effort, ACCE and ECRI have developed the first comprehensive guideline for implementing the security management and risk analysis process for medical technology.