WSGR ALERT

FDA Updates Cybersecurity Guidance for Medical Device Manufacturers

November 14, 2018

The U.S. Food and Drug Administration (FDA) recently issued a dense, 24-page draft guidance, titled "Content of Premarket Submissions for Management of Cyber Security in Medical Devices" (the guidance). The guidance notes that cybersecurity incidents have "rendered medical devices and hospital networks inoperable"1 and that the "need for effective cybersecurity to ensure medical device functionality and safety has become more important…"2

The FDA previously issued a final guidance in 2014, but notes that the "rapidly evolving landscape, and the increased understanding of threats and their potential mitigations" necessitated an updated approach. The FDA intends the guidance, when finalized, to replace 2014 final guidance.3,4 The guidance takes a principles-based regulatory approach.

Guidance Applicability

The guidance applies to medical devices that contain "software (including firmware)," "programmable logic," and "software that is a medical device."5 For devices that contain software, the guidance applies to: Premarket Notifications (i.e., 510(k) submissions—traditional, special, and abbreviated); De Novo requests; Premarket Approval Applications (PMAs); Product Development Protocols (PDPs); and Humanitarian Device Exemption (HDE) applications.6

Regulatory Framework (Tiers 1 and 2)

The guidance defines two tiers of cybersecurity risk. Medical devices have a tier-1 risk if: (i) the device is capable of connecting to another medical or non-medical product network or the internet; and (ii) a cybersecurity incident affecting the device could directly result in harm to patients.7 Examples of tier 1 devices include connected or connectable: implantable cardioverter defibrillators, pacemakers, left ventricle assist devices, brain stimulators, dialysis devices, infusion, and insulin pumps.8

It is worth noting that the guidance's cybersecurity risk assessment is different than the FDA's general categorization of medical devices by risk (i.e., class I, II, and III). For example, a wireless connected insulin pump can be both a class II (intermediate risk) medical device and tier-1 cybersecurity (higher) risk device.

The second tier, or tier 2, is a device for which the criteria for a tier 1 device are not met. We note that outside of the enumerated tier 1 cybersecurity risk devices, when a medical device is connected or connectable, the standard that "a cybersecurity incident affecting the device could directly result in harm to multiple patients" may make it difficult to accurately determine if a medical device is a tier 1 or tier 2 cybersecurity risk. Manufacturers should address the cybersecurity tier in which their device may be fall, and the mitigation factors and testing requirements, with the FDA during prescheduled, pre-submission meetings.

Loss of PHI Not Considered a Patient Harm

Interestingly, for purposes of the guidance, harms such as loss of protected health information (PHI) are not considered patient harms.9 However, loss of PHI may nevertheless violate applicable federal and state laws, including privacy laws and the Health Information Portability and Accountability Act (HIPAA).

Trustworthy Devices

A significant part of the guidance is devoted to helping to ensure that a device can be trustworthy.

The guidance states that trustworthy devices: (i) are reasonably secure from cybersecurity intrusion and misuse; (ii) provide a reasonable level of availability, reliability, and operation; (iii) are reasonable suited to performing their intended functions; and (iv) adhere to generally accepted security procedures.10

The guidance provides suggestions for designing and manufacturing a trustworthy device, as well as recommendations for documentation and testing to be included with premarket submissions. The guidance notes that specific protection mechanisms "should prevent all unauthorized device use (through all interfaces); ensure code, data, and execution integrity (subversion of system functionality/safety/security features); and as appropriate, protect confidentiality of data."11

Labeling Recommendations

The guidance also discusses labeling considerations for medical devices with cybersecurity risks.12 The guidance provides 14 specific recommendations—recommendation No. 12 is worthy of mention. Recommendation 12 includes providing a Cybersecurity Bill of Materials (CBOM). The CBOM should include, "but not be limited to, a list of commercial, open source, and off-the-shelf software and hardware components to enable device users…to effectively manage their assets…identify vulnerabilities of the device…and deploy countermeasures to maintain the device's essential performance."13

Cybersecurity Documentation

Finally, the guidance identifies documentation that manufacturers should include in premarket submissions—additional to any submitted software verification and validation documentation. This documentation includes design documentation and risk management documentation, including the CBOM.14 The recommended documentation is extensive, and manufacturers should put into place systems to track and compile the materials necessary to comply with the FDA's recommendations.

Conclusion

Medical device manufacturers should extensively plan for, and expect, increased FDA scrutiny of the cybersecurity protections of devices that they have in development, as a prerequisite for gaining FDA clearance or approval. Device manufacturers should therefore assess and address cybersecurity risks early in development, as part of design controls, and continuing throughout the device's lifecycle. Finally, as the comments period for the guidance remains open, device manufacturers should consider submitting comments to help further clarify the pre-submission requirements.

For questions regarding the guidance or the FDA's regulation of the cybersecurity risk of medical devices, please contact Vern Norviel, David Hoffmeister, or any member of the patents and innovation strategies or FDA/life sciences practices.

Charles Andres contributed to the preparation of this WSGR alert.


1 For a recent example of the impact of a medical device hack, see the Law360 article: "The Serious and Immense Impact of a Medical Device Hack."
2 The guidance at 4.
3 The FDA maintains a recognized consensus standards database addressing information technology and medical device security.
4 Cybersecurity of medical devices is receiving ongoing attention from the U.S. government, the FDA, and others. In October 2018, the FDA and the Department of Homeland Security (HHS) announced the implementation of "a new framework for greater coordination and cooperation between the two agencies for addressing cybersecurity in medical devices." And also in October 2018, MITRE Corporation—under contract with the FDA—published its "Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook" for healthcare delivery organizations. Finally, the FDA's Center for Devices and Radiological Health (CDRH) recently entered into a Memorandum of Understanding with the National Health Information Sharing and Analysis Center, Inc. (NH-ISAC) and MediSAO.

Previously, the FDA issued guidance for premarket submissions for software contained in medical devices, and separately issued guidance for cybersecurity for networked medical devices containing off-the-shelf security.
5 The guidance at 5.
6 Id. at 5-6.
7 Id. at 10.
8 Id.
9 Id. at 16.
10 Id.
11 Id. at 12-18.
12 Id. at 18-21.
13 Id. at 20.
14 Id. at 21-24.