FDA Releases Updated Guidance on Medical Device Cybersecurity
The U.S. Food and Drug Administration (FDA) has issued new draft guidance for medical device manufacturers to help them incorporate cybersecurity protections into their products at the premarket stage, and to ensure security risks are managed for the full life cycle of the products.
The FDA first released final guidance on premarket expectations for medical devices in 2014, then updated and released draft guidance in 2018. The latest update was deemed necessary due to the changing threat landscape, the increasing use of wireless, Internet- and network-connected devices, portable media, and the frequent electronic exchange of medical device-related health information. Further, the healthcare industry is being increasingly targeted by cyber threat actors, and the severity and clinical impact of healthcare cyberattacks have increased. Cyberattacks on healthcare providers have the potential to delay test results, diagnoses, and treatment, which could lead to patient harm.
The FDA felt that an updated approach was necessary to ensure cybersecurity risks were managed and reduced to a low and acceptable level. The updated guidance includes recommendations regarding cybersecurity device design, labeling, and the documentation the FDA suggests should be included in premarket submissions for devices with cybersecurity risk.
The FDA considered feedback received on the 2018 draft guidance, input from stakeholders gathered at various public meetings, and recommendations made in the Health Care Industry Cybersecurity (HCIC) Task Force Report when updating the guidance.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The guidance covers threat modeling, the requirement for a software bill of materials that includes all third-party software components, security risk assessment, security risk management, the implementation of security controls, cybersecurity testing, vulnerability management planning, and the importance of cybersecurity transparency.
By following the FDA’s recommendations, device manufacturers can ensure an efficient premarket review process and that their devices will be sufficiently resilient to cyber threats.
The FDA has requested public comment on the new draft guidance – Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions – which will be accepted until July 7, 2022. The FDA will then work on a final version of the guidance.
