FDA moves to require patching in connected medical devices

The Food and Drug Administration is looking to mitigate serious cybersecurity threats to connected medical devices, especially attacks that could disrupt the operation of critical monitors and drug delivery equipment.

As part of a plan announced on April 17, the FDA wants software and firmware in devices directly linked to patient safety like insulin pumps and cardiac pacemakers to be able to be patched on an ongoing basis.

The FDA is also considering new requirements covering the disclosure of vulnerabilities and updated guidance to guard against ransomware attacks as well as major risks to patient safety.

"Our aim is to make sure that the new advances in technology that are enabling better capabilities and benefits are also harnessed to bring added assurances of safety, so that more patients can benefit from new devices and address unmet needs," FDA Commissioner Scott Gottlieb said.

The FDA is also looking at launching a public-private safety board to provide analysis and field expertise to device manufacturers and the FDA in a range of technological and clinical subject areas. The new entity, dubbed the CyberMed Safety (Expert) Analysis Board, would address a key "gap" in medical device cybersecurity response. The board would include a "go team" to investigate and offer mediation on cybersecurity incidents at the request of FDA or industry.  Funding for the board is included in the FDA's 2019 budget request.