U.S. Food and Drug Administration (FDA) staff have released new guidelines to strengthen the cybersecurity level of Internet-connected products used by hospitals and healthcare providers.
According to a guidance document released today, applicants seeking approval for new medical devices have plans designed to “monitor, identify and address” cybersecurity issues that may be associated with them. must be submitted.
In addition, the applicant must outline a process for providing “reasonable assurance” that the device in question is protected with regular security updates and patches, including in critical situations.
Finally, they are expected to provide FDA with a “software bill of materials.” It should include commercial, open source, and off-the-shelf software components.
FDA guidelines provide information on the definition of a “cyber device.” It is intended as a device, or as a device that includes software verified, installed or approved by the Sponsor in the device, capable of connecting to the Internet, and containing technical characteristics that enable it to connect to the Internet. Vulnerable to cyber security threats.
This guidance document is part of the $1.7 trillion federal total spending bill signed into law by President Joe Biden in December 2022. The law also requires the FDA to update its medical device cybersecurity guidance at least every two years.
More on Biden’s cybersecurity efforts: White House releases National Cybersecurity Strategy
The new FDA guidelines come months after Sonar security experts discovered three vulnerabilities in OpenEMR. OpenEMR is open source software for electronic medical records and practice management.
Recently, a notorious Russian-affiliated hacktivist group known as KillNet was observed targeting healthcare applications hosted using Microsoft Azure infrastructure.
Given the tremendous efforts threat actors have made to target the healthcare industry, the FDA’s new requirements could be life-saving. This is especially true considering his September 2022 report by Proofpoint’s Ponemon Institute, which linked rising mortality rates to cyberattacks targeting healthcare facilities.
