Master’s in Ethics, Privacy and Security Engineering in Digital Health
Online master's programme of 1,900 hours in ethics, privacy and security engineering in digital health. 12 modules covering digital health ethics, health data protection, privacy by design, secondary use of data, healthcare cybersecurity, secure health software, incident management, responsible AI, governance and compliance, and digital patient rights, with an assigned technical tutor.
Master’s in Ethics, Privacy and Security Engineering in Digital Health — studying from Malta
Malta's healthcare system relies on public hospitals alongside a growing private sector, creating demand for engineers in medical devices, clinical technology and facilities. The Medicines Authority and the Health Directorate set regulatory expectations that shape work on medical equipment. Biomechanics and wearable technology are emerging interests, particularly in rehabilitation, sports science and occupational safety. Professionals in this area often collaborate with clinicians, distributors and regulators to ensure devices meet national and European requirements.
Fees for Malta: €6,920 (Euro), with instalments and employer sponsorship available.
Relevant bodies in Malta
Typical roles
Questions from Malta
Is this programme recognised by a professional body in Malta for engineers working in health, biomechanics or wearables?
SEIUM Institute's qualifications are its own private qualifications. They are not official Maltese state degrees and are not accredited by any national body. In Malta, engineering titles are regulated through the Malta Council for Professions and the Chamber of Engineers, and medical devices fall under the Medicines Authority. Recognition of a private qualification is decided by employers or the relevant body, so check with them before enrolling.
Will employers in Malta value this training for roles in wearables or operational safety?
Employers in Malta's health technology, manufacturing and safety-related sectors decide for themselves how much weight to give a private online qualification. Many weigh practical experience and a final project heavily. SEIUM's programmes include a final project, but whether it helps your career in Malta depends on your employer's view. Speaking with prospective employers beforehand is the most reliable way to find out.
Can I study this alongside a full-time job in Malta, and is employer funding possible?
The programmes are 100% online and taught in English, so you can study from home without a student visa. Master's programmes are 1,900 hours, postgraduate diplomas 800 hours and specialist courses 300 hours, so plan your weekly time accordingly. Fees are payable in instalments, and employer sponsorship is possible. Each student gets an assigned technical tutor for support.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Apply bioethical principles to digital health projects.
Comply with the GDPR and Spanish regulations when processing health data.
Design solutions with privacy by design.
Manage the secondary use of data within the EHDS.
Protect healthcare organisations and software against cyber threats.
Assess healthcare AI against responsibility criteria.
Implement governance and compliance models.
Who it's for
- Data protection officers in hospitals, health services and digital health companies.
- Health information security managers.
- AI ethics consultants advising on clinical algorithms.
- Regulatory compliance auditors.
- Healthcare cybersecurity analysts.
- Data governance managers.
- Engineering or science graduates seeking to enter hospitals and health services.
What you'll work with
- Regulation (EU) 2016/679 (GDPR, data protection)
- Organic Law 3/2018 (LOPDGDD, Spanish data protection and digital rights law)
- Regulation (EU) 2024/1689 (EU Artificial Intelligence Act)
- Directive (EU) 2022/2555 (NIS2, network and information security)
- Royal Decree 311/2022 (Spanish National Security Framework, ENS)
- ISO/IEC 27001 (information security management)
- ISO 27799 (information security in health)
- Regulation (EU) 2025/327 (European Health Data Space)
- PILAR
- OWASP Threat Dragon
- ARX Data Anonymization Tool
- Microsoft Purview
- Wireshark
12 modules · 1900 h
1.1Bioethical principles applied to technology1.2Autonomy, beneficence, non-maleficence and justice1.3Ethics of health data1.4Patient trust in digital systems1.5Digital divide and equity1.6Ethics of AI in health1.7Conflicts of interest in health technology1.8Clinical and research ethics committees1.9Landmark ethical cases1.10Case study: ethical dilemma of a contact-tracing app
2.1GDPR and special categories of data2.2LOPDGDD and provisions on health research2.3Legal bases for health data processing2.4Data subject rights2.5Data protection officer in health2.6Record of processing activities2.7Processors and international transfers2.8AEPD sanctioning regime2.9Relevant AEPD rulings2.10Workshop: record of processing activities for a hospital
3.1Principles of privacy by design3.2Data protection impact assessments (DPIA)3.3Data minimisation and purpose limitation3.4Pseudonymisation and anonymisation3.5Re-identification risk3.6Differential privacy in health statistics3.7Generation of synthetic patient data3.8Confidential computing and secure enclaves3.9Dynamic consent management3.10Practical: DPIA of a telemonitoring platform
4.1Research with health data4.2Law 14/2007 and biological samples4.3Secondary use under the EHDS4.4Health data access bodies4.5Secure processing environments4.6Data altruism4.7Biobanks and genetic data4.8Governance of federated data4.9Transparency towards citizens4.10Case study: data access application for research
5.1Threat landscape in the health sector5.2Ransomware in hospitals5.3National Security Framework (ENS) in public centres5.4The NIS2 Directive and health entities5.5ISO 27001 and 277995.6Medical device security5.7IEC 80001-1 medical networks5.8Professional access to health records5.9Staff awareness5.10Laboratory: analysis of a ransomware incident
6.1IEC 81001-5-1 processes for health software6.2MDCG 2019-16 for manufacturers6.3Privacy-centred threat modelling6.4Secure development and OWASP6.5SBOM and vulnerabilities6.6Penetration testing of health applications6.7Cyber Resilience Act6.8Patch management in devices6.9Coordinated vulnerability disclosure6.10Practical: STRIDE threat modelling of a health app
7.1Incident response plan7.2Breach notification to the AEPD7.3NIS2 notification to the CSIRT7.4Continuity of care during cyberattacks7.5Backup and recovery7.6Digital forensic analysis of the incident7.7Communication with patients7.8Lessons learned after a cyber incident7.9Cybersecurity exercises7.10Case study: hospital cyberattack drill
8.1Regulation (EU) 2024/1689 and high risk8.2Managing algorithmic bias8.3Explainability and transparency8.4Effective human oversight of AI8.5Fundamental rights impact assessment8.6WHO ethical guidance8.7Independent algorithmic auditing8.8Liability for damage8.9Model documentation8.10Workshop: ethical audit of a triage algorithm
9.1Data governance models9.2ISO 27701 management systems9.3Integrated regulatory compliance9.4Privacy audits9.5Technology procurement and contracts9.6Supplier assessment9.7Compliance indicators9.8Training and culture9.9Accountability9.10Practical: compliance plan for a digital health supplier
10.1Law 41/2002 and information rights10.2Access to the health record10.3Spanish Charter of Digital Rights10.4Digital accessibility of health services10.5Health apps and consumers10.6Advertising and digital health10.7Neurorights and neural data10.8Right to explanation10.9Patient participation10.10Case study: patient portal and its rights
11.1Telemedicine and privacy11.2Wearables and wellness data11.3Genomics and sensitive data11.4Medical imaging and AI11.5Digital mental health11.6Insurers and data use11.7Employers and health data11.8Decentralised clinical research11.9Public health and surveillance11.10Case study: analysis of a corporate wearable
12.1Digital health project under analysis12.2Ethical analysis of the project12.3Data protection analysis12.4Cybersecurity assessment12.5Responsible AI analysis12.6Governance proposal12.7Compliance plan12.8Recommendations and roadmap12.9Master's Thesis report12.10Master's Thesis: defence before a panel
How you'll learn
100% online training on the SEIUM campus, with downloadable materials, recorded classes and an assigned technical tutor. There are no fixed timetables: you progress at your own pace within each intake, so the programme is compatible with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is PILAR, OWASP Threat Dragon, ARX Data Anonymization Tool, Microsoft Purview and Wireshark, in free, academic or evaluation versions. Practical work is based on real procedures: data protection impact assessments, cyber incident drills and ethical audits of algorithms. Assessment is continuous by module, plus the final Master's Thesis.
Standards covered: Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, Regulation (EU) 2024/1689 on artificial intelligence, Directive (EU) 2022/2555 (NIS2), Royal Decree 311/2022 (National Security Framework), ISO/IEC 27001, ISO 27799, Regulation (EU) 2025/327 on the European Health Data Space.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Where this takes you
Requirements
- University degree in engineering, science or architecture, or equivalent demonstrable professional experience.
- Internet connection and a computer capable of running the programme software.
- English sufficient to read technical standards.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 1,900 hours over 12–14 months. You set your own pace within each intake, and your tutor helps you plan the workload around your job.
You work with PILAR, OWASP Threat Dragon, ARX Data Anonymization Tool, Microsoft Purview and Wireshark, using free, academic or evaluation versions. Your tutor indicates the free alternative wherever one exists.
A SEIUM Institute diploma, awarded on passing the continuous assessment and the Master's Thesis. It is SEIUM's own qualification, not an official state degree; its recognition depends on the programme completed and the regulations of each country.
Yes. Modules passed in a course or postgraduate diploma in the same area are recognised in the higher programme. Ask about the recognition policy when you enrol.
A university degree in engineering, science or architecture (or equivalent professional experience), a computer able to run the software, and English sufficient to read technical standards.
Start dates are set by SEIUM's faculty for each intake. Our admissions team will confirm the next available date when you apply.
Related programmes
Master’s in Inclusive Design and Universal Accessibility Engineering
Online master's programme of 1,900 hours in Inclusive Design and Universal Accessibility Engineering, with 12 modules covering disability and design, the regulatory framework, anthropometry, accessible buildings,…
Master’s in Operational Safety, HSE & Risk Engineering
Online master's programme of 1,900 hours in Operational Safety, HSE and Risk Engineering, with 12 modules covering risk concepts, the HSE regulatory framework, hazard identification, qualitative…
Master’s in Impact Biomechanics and Sports Protection Engineering
Online master's programme of 1,900 hours in impact biomechanics and sports protection engineering: 12 modules covering impact mechanics, injury biomechanics, injury criteria, energy-absorbing materials, helmets, body…
More in Health, Biomechanics, Wearables & Operational Safety
All Health, Biomechanics, Wearables & Operational Safety programmes → · How to apply · Fees & financing · Scholarships