The Shifting Sands of Medical Device Cybersecurity Regulation

Regulatory and standards bodies have been busy in the medtech cybersecurity space from the U.S. Food and Drug Administration (FDA) releasing new draft premarket cybersecurity guidance, to the Health Sector Coordinating Council (HSCC) publishing model contract language to support Healthcare Delivery Organizations (HDOs) and Medical Device Manufacturers (MDMs) in jointly defining roles, responsibilities and expectations of each party in their relationships. These two efforts have the potential to significantly change in most cases for the better the development and manufacture of medical devices and technologies. The first guidance from the FDA addressing cybersecurity needs for a premarket submission was released in 2014, then updated in 2018.