9 February, 2016 Jason C. Gavejian, CIPP, Principal, Jackson Lewis P.C.
|FDA has issued a draft guidance medical device
manufacturers should take to address cybersecurity risks.
Last week (January 22, 2016), the U.S. Food and Drug Administration (FDA) issued draft guidance outlining important steps medical device manufacturers should take to address cybersecurity risks to keep patients safe and better protect the public health. The draft guidance, which details the agency’s recommendations for monitoring, identifying, and addressing cybersecurity vulnerabilities in medical devices after they have entered the market, is part of the FDA’s ongoing efforts to ensure the safety and effectiveness of medical devices in the face of potential cyber threats.
Commenting on the guidance, Suzanne Schwartz, M.D., M.B.A., Associate Director for Science and Strategic Partnerships and Acting Director of Emergency Preparedness/Operations and Medical Countermeasures in the FDA’s Center for Devices and Radiological Health said,
"All medical devices that use software and are connected to hospital and health care organizations’ networks have vulnerabilities—some we can proactively protect against, while others require vigilant monitoring and timely remediation. [The] draft guidance will build on the FDA’s existing efforts to safeguard patients from cyber threats by recommending medical device manufacturers continue to monitor and address cybersecurity issues while their product is on the market."
The draft guidance recommends the implementation of a structured and systematic cybersecurity risk management program to identify and respond in a timely fashion to identified vulnerabilities which includes:
- Application of the 2014 NIST voluntary framework for Improving Critical Infrastructure Cybersecurity;
- Monitoring cybersecurity information sources for identification and detection of cybersecurity vulnerabilities and risk;
- Understanding, assessing and detecting presence and impact of a vulnerability;
- Establishing and communicating processes for vulnerability intake and handling;
- Clearly defining essential clinical performance to develop mitigations that protect, respond and recover from the cybersecurity risk;
- Adopting a coordinated vulnerability disclosure policy and practice; and
- Deploying mitigations that address cybersecurity risk early and prior to exploitation.
In addition to outlining program components, the guidance also includes proposed steps device manufactures should take to report cybersecurity vulnerabilities. The FDA specified that for the bulk of cases, advance notice of actions taken by manufacturers to address cybersecurity vulnerabilities will not be required. However, the FDA would require device manufactures to provide agency notice for the small subset of cybersecurity vulnerabilities that may compromise the clinical performance of a device and present a reasonable probability of serious adverse health consequences or death. In instances where a vulnerability is quickly addressed in a way that sufficiently reduces the risk of harm to patients, the guidance specifies that the FDA does not intend to enforce urgent reporting if: there are no serious adverse events or deaths associated with the vulnerability; within 30 days of learning of the vulnerability, the manufacturer notifies users and implements changes that reduce the risk to an acceptable level; and the manufacturer is a participating member of an ISAO and reports the vulnerability, its assessment, and remediation to the ISAO.
In summarizing the FDA’s goal, Schwartz said, “The FDA is encouraging medical device manufacturers to take a proactive approach to cybersecurity management of their medical devices…[o]nly when we work collaboratively and openly in a trusted environment, will we be able to best protect patient safety and stay ahead of cybersecurity threats.”
Whether your organization is impacted by the FDA draft guidance or not, the core principles of “Identify, Protect, Detect, Respond, and Recover” should be followed by all organizations as they address cybersecurity. The draft guidance is subject to a 90 day public comment period.
4819-4440-4013, v. 1
Will you comment to FDA on this draft guidance? Do you think the guidance sufficiently address the problem?
Jason C. Gavejian is a Principal in the Morristown, New Jersey, office of Jackson Lewis P.C. and a Certified Information Privacy Professional (CIPP/US) with the International Association of Privacy Professionals.
Mr. Gavejian represents management exclusively in all aspects of employment litigation, including restrictive covenants, class-actions, harassment, retaliation, discrimination and wage and hour claims in both federal and state courts. Additionally, Mr. Gavejian regularly appears before administrative agencies, including the Equal Employment Opportunity Commission, the Office for Civil Rights (OCR), the New Jersey Division of Civil Rights, and the New Jersey Department of Labor. His practice also focuses on advice/counseling employers regarding daily workplace issues.
Mr. Gavejian regularly provides training to both executives and employees and regularly speaks on current privacy, monitoring, BYOD, social media, TCPA, and information management issues. His views on these topics have been discussed in multiple publications, including Inc.com, @Law Magazine, Risk and Insurance Magazine, LXBN TV, and HR.BLR.com.
Prior to joining Jackson Lewis, Mr. Gavejian served as a judicial law clerk for the Honorable Richard J. Donohue on the Superior Court of New Jersey, Bergen County.