
AdobeStock_395355885

Driven by the need to reduce costs, improve efficiency, and enable secure data sharing among care providers and patients, the healthcare industry has been on a steady path of increasing connectivity between systems. Today, medical devices are connected to hospital networks and hospital networks are connected to the Internet. Traditionally, devices were protected because they were operating on stand-alone, separated networks. Now, patients and clinicians demand interoperable devices and sharing of data, which necessitates connectivity. This exposes hospital networks, including medical devices, to cyber threats.
A study conducted by Cynerio and the Ponemon Institute, surveying experts in leadership positions at 517 healthcare systems, demonstrated that 43% of respondents suffered at least one data breach in the prior 24 months with IoT/IoMT devices being involved in 88% of the cases. Three out of four infusion pumps delivering medications and fluids to patients have cybersecurity flaws, putting them at increased risk of being compromised by hackers, according to a new study by Palo Alto Networks’ Unit 42 threat research service.
Guidelines, regulations
Healthcare regulators have recognized this problem and are acting within the bounds of authorities, trying to curb the risks without hampering innovation and speed to market. For years, the U.S. Food and Drug Administration (FDA) and other global regulators have been establishing clear guidelines for the industry. FDA published pre- and post-market cybersecurity guidelines, but these guidelines and the FDA’s current regulatory authority were insufficient to demonstrably reduce cybersecurity risks.
To address the need for expanded regulatory action, Congress granted the FDA new legal authority,
In addition to the FDA’s regulatory authority, lawmakers are seeking to increase regulatory requirements more broadly – from the White House to Congress. However, the challenge for medical device manufacturers (MDMs) is figuring out how to meet the new requirements, while the regulatory environment is still evolving and is expected to continue to change for a while.
It's a question of how
One thing is certain: the FDA plans to enforce its new authorities. In March 2023, the FDA codified its plans to use its new enforcement discretion by publishing its Refuse to Accept guidance. In one of the most concise guidance documents to date, the FDA made it clear: MDMs must demonstrate they’ve taken reasonable steps to show they’ve designed secure products and they have a reasonable plan to maintain these products’ security throughout their lifespan.
This may seem deceptively simple – just build secure devices – but how? Should manufacturers build with strict cybersecurity rules? That’d be easy if cybersecurity didn’t inherently cause tension with device usability and availability. For example, surgical robots should only be used and updated by authorized personnel.
Fortunately, the FDA and IMDRF have provided roadmaps for proactively designing cybersecurity into devices: secure product development life cycle, good encryption, threat modeling, and
Once the device is proactively built with security by design, its security must be maintained through time. MDMs must produce software updates at reasonable intervals to address newly discovered vulnerabilities. There are two potential strategies for a post-market cybersecurity management plan. The first is updating the software frequently whenever vulnerabilities are present; with low vulnerability tolerance. The second is updating software less frequently, knowing vulnerabilities will inevitably exist in the system, but tolerating the vulnerabilities unless they have a high impact on patient safety. Major software producers such as Microsoft and Apple use the first strategy. Most MDMs selling hospital-based equipment use the second strategy. The second approach is non-optimal for security but has historically been optimal for devices operated by hospitals behind biomedical network firewalls. Now that the FDA has explicitly discouraged depending on network security as a primary defense, the optimal approach may have changed.
Ensuring medical device security requires a comprehensive approach that includes both over-the-air (OTA) updates from manufacturers and sound decision-making about vulnerabilities. OTA updates require investment in encryption and PKI as well as a sustaining engineering team to produce regular updates
Currently, manufacturers can analyze vulnerabilities one at a time. Some are working on triaging vulnerabilities at scale, but the work is new. There are efforts to provide data standards (e.g., SBOM, VEX, SSVC) for the exchange of information about vulnerabilities as the volume of known vulnerabilities is ever-increasing.
Medical devices have a critical role to save lives, treat diseases, diagnose, and improve the quality of life. The emergence of Internet connectivity in medical devices has brought new opportunities for innovation but also introduces risks. Recognizing this, global regulators have taken appropriate action by requiring manufacturers to explicitly address cybersecurity as an integral part of the overall value proposition of a device.
The healthcare industry is accustomed to change, constantly innovating, and knows how to handle risk. Ultimately, patients and citizens usually benefit from this healthy regulatory-industry tension. The industry is already reorganizing, re-optimizing, and placing bets on the next wave of clinical innovations, ideally with security in mind from the start.
Get curated news on YOUR industry.
Enter your email to receive our newsletters.Latest from Today's Medical Developments
- How to lower manufacturing costs for medical devices
- Close out July with our Lunch + Learn on medical machining solutions
- Research center developing digital twins for manufacturing
- Build your Controlled Unclassified Information (CUI) toolkit
- Kitov AI Inc., FANUC America partner to advance AI-driven smart manufacturing solutions
- Discover cutting-edge machining at SW North America's Open House
- Maximize efficiency: ROBOGUIDE V10's high-performance upgrades
- #47 Lunch + Learn Podcast with INSACO