HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

FDA Releases Updated Guidance on Medical Device Cybersecurity

The U.S. Food and Drug Administration (FDA) has issued new draft guidance for medical device manufacturers to help them incorporate cybersecurity protections into their products at the premarket stage, and to ensure security risks are managed for the full life cycle of the products.

The FDA first released final guidance on premarket expectations for medical devices in 2014, then updated and released draft guidance in 2018. The latest update was deemed necessary due to the changing threat landscape, the increasing use of wireless, Internet- and network-connected devices, portable media, and the frequent electronic exchange of medical device-related health information. Further, the healthcare industry is being increasingly targeted by cyber threat actors, and the severity and clinical impact of healthcare cyberattacks have increased. Cyberattacks on healthcare providers have the potential to delay test results, diagnoses, and treatment, which could lead to patient harm.

The FDA felt that an updated approach was necessary to ensure cybersecurity risks were managed and reduced to a low and acceptable level. The updated guidance includes recommendations regarding cybersecurity device design, labeling, and the documentation the FDA suggests should be included in premarket submissions for devices with cybersecurity risk.

The FDA considered feedback received on the 2018 draft guidance, input from stakeholders gathered at various public meetings, and recommendations made in the Health Care Industry Cybersecurity (HCIC) Task Force Report when updating the guidance.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The guidance covers threat modeling, the requirement for a software bill of materials that includes all third-party software components, security risk assessment, security risk management, the implementation of security controls, cybersecurity testing, vulnerability management planning, and the importance of cybersecurity transparency.

By following the FDA’s recommendations, device manufacturers can ensure an efficient premarket review process and that their devices will be sufficiently resilient to cyber threats.

The FDA has requested public comment on the new draft guidance – Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions – which will be accepted until July 7, 2022. The FDA will then work on a final version of the guidance.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.