The FDA's Medical Device Cybersecurity Overhaul Has Real Teeth

The physical and cyber safety issues surrounding medical devices like IV pumps is finally being meaningfully addressed by a new policy taking effect this week. Last week, the Food and Drug Administration (FDA) implemented new recommendations regarding the cybersecurity of medical devices, a long-standing source of worry for both patients and healthcare institutions. Experts argue that this time, the FDA's decision might actually make a difference. The directive is just the latest in a long line of attempts by the FDA to place some guardrails around the susceptibility of items like insulin pumps and heart monitors to hacking. Manufacturers of medical devices are urged to submit "a plan to monitor, identify, and resolve, as required, in a reasonable time, postmarket cybersecurity vulnerabilities, and exploits" as of right now. Also, "create, develop, and maintain methods and procedures to offer a reasonable confidence that the device and connected systems are cybersecure" is required of manufacturers. Patches must be made available "on a fairly justified regular cycle" and "as quickly as practicable out of cycle" for newly discovered significant vulnerabilities. Finally, the FDA is requesting that software bill of materials be included with new devices (SBOM). Some people may be reminded of previous initiatives that fell short of significantly enhancing cybersecurity in this crucial sector. But according to analysts, this protracted journey has finally come to a genuine inflection point. New medical devices won't be allowed on the market as of right now if they don't meet these requirements.