The Food and Drug Administration’s policies and procedures were insufficient for handling postmarket medical device cybersecurity events, and the agency has not adequately tested its ability to respond to emergencies resulting from cybersecurity events in medical devices, according to a Department of Health and Human Services Office of Inspector General report released Nov. 2.
 
OIG recommends that FDA: continually assess the cybersecurity risks to medical devices and update, as appropriate, its plans and strategies; establish written procedures and practices for securely sharing sensitive information about cybersecurity events with key stakeholders who have a need to know; enter into a formal agreement with federal agency partners to establish roles and responsibilities; and ensure the establishment and maintenance of procedures for handling recalls of medical devices vulnerable to cybersecurity threats.
 
FDA agreed with most recommendations and said it had already implemented many of them during the audit and would continue working to implement others. For example, FDA recently released updated pre-market guidance for medical device manufacturers on cybersecurity device design, labeling and documentation.

Related News Articles

Headline
The AHA and the Department of Homeland Security July 17 at 1 p.m. ET will host a webinar discussing current cybersecurity threats to the health care sector.
Headline
The AHA and the Department of Homeland Security July 17 at 1 p.m. ET will host a webinar discussing current cybersecurity threats to the health care sector.
Headline
Medtronic has recalled certain MiniMed insulin pumps due to cybersecurity risks, and will provide alternative pumps to the estimated 4,000 U.S. patients using…
Headline
The Centers for Disease Control and Prevention this week announced an anticipated shortage of Aplisol, one of two TB skin tests licensed by the Food and Drug…
Headline
Last week, Microsoft released security updates to fix a critical vulnerability in older versions of its Windows operating system.
Headline
President Trump yesterday signed an executive order to help strengthen the nation’s cybersecurity workforce.