US FDA calls on medical device makers to focus on cybersecurity

The agency's new recommendations follow reports of vulnerabilities in some medical devices, the FDA says

Medical device makers should take new steps to protect their products from malware and cyberattacks or face the possibility that U.S. Food and Drug Administration won't approve their devices for use, the FDA said.

The FDA issued new cybersecurity recommendations for medical devices on Thursday, following reports that some devices have been compromise.

Recent vulnerabilities involving Philips fetal monitors and in Oracle software used in body fluid analysis machines are among the incidents that prompted the FDA to issue the recommendations, a spokeswoman for the agency said.

In one case reported in October, malware slowed down fetal monitors used on women with high-risk pregnancies at a Boston hospital, and in another case, the FDA in January issued a warning about Oracle software that could allow remote access to the databases of Roche Cobra analysis devices, she said.

Representatives of Philips and Oracle didn't immediately respond to requests for comment on the FDA recommendations.

"Many medical devices contain configurable embedded computer systems that can be vulnerable to cybersecurity breaches," the FDA said in its recommendations. "As medical devices are increasingly interconnected, via the Internet, hospital networks, other medical device, and smartphones, there is an increased risk of cybersecurity breaches, which could affect how a medical device operates."

Under proposed rules issued by the FDA, the agency is recommending that device makers provide it with their plans for providing updates and patches, said Erica Jefferson, an FDA spokeswoman.

"Once the guidance is finalized, the agency might consider withholding marketing clearance or approval for medical devices that fail to appropriately address cybersecurity risks," she said.

The FDA is not aware of any patient injuries or deaths associated with cybersecurity incidents, the agency said. The agency doesn't have "any indication that any specific devices or systems in clinical use have been purposely targeted at this time," it said.

The FDA has seen medical devices infected or disabled by malware, and the presence of malware on hospital computers, smartphones and tablets, the agency said. The agency has also found health care providers with "uncontrolled distribution of passwords" and disabled passwords in software designed to have limited access, it said.

Other health care providers have failed to apply software updates and patches in a timely manner, the agency said.

The agency wants medical device makers to "take appropriate steps to limit the opportunities for unauthorized access to medical devices," the FDA said in its recommendations. Manufacturers should review their cybersecurity practices to assure that appropriate safeguards are in place to prevent unauthorized access, the agency said.

Health care providers should also take steps to limit access and to improve cybersecurity, the agency said.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Join the CSO newsletter!

Error: Please check your email address.

Tags regulationsecurityU.S. Food and Drug AdministrationRochehealth caregovernmentindustry verticalsdata protectionOracleErica Jeffersonphilips

More about IDGOraclePhilipsRoche

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Grant Gross

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place