FDA has previously released guidance on medical device cybersecurity, but it never really had teeth – until now.

Late last year, President Joe Biden signed a $1.7 trillion omnibus appropriations bill into law, which included authorization for FDA to confirm that medical devices meet specific cybersecurity standards before hitting the market. The law also requires medical device manufacturers to maintain adequate post-market surveillance from a cybersecurity standpoint, and addresses both device hardware design as well as device software, according to a report published by PwC. The legislation goes into effect tomorrow.

MD+DI sat down with Tiffany Gallagher, health industries risk and regulatory leader at PwC and one of the authors of the report, who helped us breakdown the implications of the new medical device cybersecurity requirements.

What is the current state of medical device cybersecurity?

According to studies cited in a September 2022 report on medical device cybersecurity published by the FBI, 53% of connected medical device and other internet of things (IoT) devices in hospitals had known critical vulnerabilities, and about a third of healthcare IoT devices have an identified critical risk potentially impacting technical operation and functions of medical devices.

Medical devices that are susceptible to cyberattacks include (but are not limited to) insulin pumps, implantable cardiac defibrillators, mobile cardiac telemetry, pacemakers, and implantable pain pumps. Hackers can potentially direct these devices to give inaccurate readings, administer drug overdoses, or otherwise endanger patient health.

Citing research from 2021, the FBI noted an average of 6.2 vulnerabilities per medical device, and recalls were issued for critical devices such as pacemakers and insulin pumps with known security issues, while more than 40% of medical devices at the end-of-life stage offer little to no security patches or upgrades.

"The current state, as it relates specifically to medical device product security, is very immature," Gallagher told MD+DI. "This is a very important piece of legislation that we really hope will move the needle, specifically as it relates to med devices because you're talking directly [about] patients' safety."

The Medical Device Innovation Consortium (MDIC) published a medical device cybersecurity benchmarking report in October 2022, which came to the same conclusion.

"The cyber threat landscape is constantly evolving, with each innovation opening new threat vectors. This is as true for the medical technology industry as it is for any other, with the added concern of patient safety," the authors of the MDIC report wrote. "Our results indicate that while cybersecurity maturity varies significantly between [medical device manufacturers], the industry as a whole has a low level of cybersecurity maturity, especially concerning design control."

First comes life-cycle management

"Before you even get there, you need to know where your devices are and where they exist in the market, and that idea of having product life-cycle management is also not incredibly mature," Gallagher said. "... How do you track, how do you identify challenges within those assets that you have, when and how do you decommission."

Figuring those things out will be critical for manufacturers to focus on as they implement the medical device cybersecurity requirements under the new legislation.

While the law will apply to new medical devices going through FDA review, Gallagher said there is a need for organizations to take a step back and understand their current exposure to cyberattacks, because healthcare providers are beginning to reach out to manufacturers to ask questions about cybersecurity as it relates to existing products.

What should medical device manufacturers be doing now to get up to speed?

Gallagher and her co-authors note several steps in their report for medical device companies to get up to speed on cybersecurity:

"The first step is really like making sure you have a mechanism in place to track all your devices and going back to that product life-cycle management," Gallagher said. "And that becomes really important and a little bit complicated because it's not just the device itself but if those devices have software on them that's connected, having the bill of materials of what that software is becomes an important part of that broader product life-cycle management."

But it certainly won't be easy.

"This is going to be hard for the industry, because cybersecurity is hard, doing it on their devices is hard," Gallagher said. "I mean, there's not enough cyber talent ... cyber's just hard in general and ... tracking devices is going to be hard, you can't have down time.." 

You've heard of design for manufacturability, now think 'design for cybersecurity'

Medical device R&D teams are already well-versed (or should be) in the concept of design for manufacturability, now they just need to get used to incorporating cybersecurity features into new product designs. As Gallagher and her co-authors noted in their report, it is much harder to add cybersecurity into a product after it's already built.

"Cybersecurity by design, or compliance by design, will be a key aspect there because you're going to have to show that to the FDA," Gallagher said.

There's a broad spectrum of risks manufacturers will need to think about ... building it all up front just makes perfect sense," she said. "And thinking about it in an integrated way, like, 'what are all the risks I'm trying to mitigate?"

Important milestones to be aware of

"FDA will look at everything that's been happening in the market, questions that are continuously coming in as well as what they're seeing around applications ... and be able to give that feedback back to the team or back to the group," Gallagher said.