We are considering connecting a medical device into a hospital patient system we are developing. We are based in the EU and must adhere to the
EU Regulation on the protection of personal data
The most important things for us, is that the data we receive is correct data integrity and that it cannot be viewed data security.
Is there a particular communications protocol we should be considering?
I do not think the whole topic of complying with the GDPR legislation in Europe can be addressed in a single SE question. Therefore, I will simply stick to the question, which communication protocol will provide data integrity and data confidentiality (or data security as you have called it).
One well established state-of-the-art way to go would be to use TLS (transport layer security) on top of TCP/IP. Then you have addressed the topics of data integrity and data confidentiality and you need not worry about the application layer protocol used on top of TCP/IP + TLS.
You need to take care that the node receiving the critical information is authenticated in the TLS handshake, when establishing a TLS connection.
This means, if the medical device sends the security critical information to the hospital management system, the hospital management system needs to be authenticated via public key cryptography, just like a webserver needs to authenticate itself in https to a browser.
In case security critical information is sent in both directions, you will have to go with mutual authentication in the TLS handshake.
