FDA issues draft cybersecurity recommendations for medical device makers

The Food and Drug Administration Friday issued draft guidance for medical device manufacturers on monitoring, identifying and addressing cybersecurity vulnerabilities in medical devices after they enter the market. “All medical devices that use software and are connected to hospital and health care organizations’ networks have vulnerabilities – some we can proactively protect against, while others require vigilant monitoring and timely remediation,” said Suzanne Schwartz, M.D., acting director of emergency preparedness/operations and medical countermeasures in the FDA’s Center for Devices and Radiological Health. “Today’s draft guidance will build on the FDA’s existing efforts to safeguard patients from cyber threats by recommending medical device manufacturers continue to monitor and address cybersecurity issues while their product is on the market.” The agency will accept comments on the draft guidance for 90 days and discuss the guidance at a public workshop tomorrow on “collaborative approaches to medical device cybersecurity.”