Navigating the MedTech Cybersecurity Ecosystem

00:00

0.5
1
1.25
1.5
1.75
2

This is a podcast episode titled, Navigating the MedTech Cybersecurity Ecosystem. The summary for this episode is: Cybersecurity continues to be a crucial concern for medical device safety and effectiveness in the US, for manufacturers and regulators alike.In this episode of the Global Medical Device Podcast Jon Speer talks to Mike Drues from Vascular Sciences about the opportunities and challenges associated with medical device cybersecurity. Listen as Mike and Jon share their thoughts on the potential ways to eliminate or reduce cyber threats and encourage better cybersecurity practices for medical devices.<h3>Some highlights of this episode include:</h3><ul><li>Cybersecurity is an important topic, but why is the FDA concerned about it? It’s important not to over-generalize.</li><li>For example, identity theft may involve a physical medical device or Software as a Medical Device (SaMD). With that, a person’s personal information such as their credit card number could be stolen. Should not be the FDA’s concern.</li><li>What about patient privacy? Personal health information or confidential electronic health records are a HIPAA matter - not the FDA’s concern.</li><li>Cybersecurity related to the safety and efficacy of a medical device, however, is the FDA’s concern.  Safety and efficacy of medical devices is part of FDA’s Center for Devices and Radiological Health (CDRH) mission.</li><li>Some have seen in the popular press or been told the urban legend around cybersecurity concerns for implantable devices, such as insulin pumps, pacemakers, catheters, and angioplasty (a.k.a. the Johnny Carson Procedure).</li><li>NIST’s call for position papers/statements covered five areas:</li><li>Criteria for designating critical software.</li><li>Initial list of secure software development lifecycle standards, best practices, and other acceptable guidelines.</li><li>Guidelines outlining security measures that will be applied to the federal government’s use of critical software.</li><li>Initial minimum requirements for testing software source code.</li><li>Guidelines for software integrity chains and provenance.</li><li>The categories above are not new and don’t really relate to cybersecurity. These should be standard operating procedures for companies developing products where cybersecurity and software is applicable.</li><li>How to minimize or avoid cybersecurity concerns? Join boards/committees to create standards, and determine if there’s a legitimate reason to connect to the internet and communicate with the outside world.</li></ul><h3>Memorable Quotes from this episode:</h3>“Safety and efficacy of medical devices is at least a paraphrase of part of the FDA - CDRH mission.” Jon Speer“If there’s a cybersecurity concern that could affect the safety of the device, that is something that FDA could and should be, quite frankly, concerned about.” Mike Drues“I’m a big fan of using regulatory logic.” Mike Drues“None of this is new. These should be standard operating procedures for companies that are developing products where cybersecurity and software is applicable.” Jon Speer<h3>Links:</h3><a href="https://www.medtechdive.com/news/fda-lays-out-device-cybersecurity-efforts-as-feds-look-to-implement-biden-e/601524/" rel="noopener noreferrer" target="_blank">FDA lays out device cybersecurity efforts as feds look to implement Biden executive order</a><a href="https://www.nist.gov/itl/executive-order-improving-nations-cybersecurity/workshop-and-call-position-papers" rel="noopener noreferrer" target="_blank">Workshop and Call for Position Papers on Standards and Guidelines to Enhance Software Supply Chain Security</a><a href="https://www.fda.gov/media/149954/download" rel="noopener noreferrer" target="_blank">Response to NIST Workshop and Call for Position Papers on Standards and Guidelines to Enhance Software Supply Chain Security</a><a href="https://www.hhs.gov/hipaa/for-professionals/index.html" rel="noopener noreferrer" target="_blank">Health Insurance Portability and Accountability Act (HIPAA)</a><a href="https://www.fda.gov/about-fda/fda-organization/center-devices-and-radiological-health" rel="noopener noreferrer" target="_blank">FDA - Center for Devices and Radiological Health (CDRH)</a><a href="https://www.hhs.gov/" rel="noopener noreferrer" target="_blank">U.S. Department of Health and Human Services (HHS)</a><a href="https://www.cnbc.com/id/100306578" rel="noopener noreferrer" target="_blank">The Terrorist Hack that Shocked America – and Why it Matters (Homeland Episode)</a><a href="https://www.sun-sentinel.com/news/fl-xpm-1999-03-25-9903250167-story.html" rel="noopener noreferrer" target="_blank">Johnny Carson Procedure (Angioplasty)</a><a href="https://www.algore.com/" rel="noopener noreferrer" target="_blank">Al Gore</a><a href="https://www.iso.org/home.html" rel="noopener noreferrer" target="_blank">International Organization for Standardization (IOS)</a><a href="https://www.astm.org/" rel="noopener noreferrer" target="_blank">ASTM International - Standards Worldwide</a><a href="https://www.ul.com/" rel="noopener noreferrer" target="_blank">Underwriters Laboratories (UL)</a><a href="https://www.linkedin.com/in/michaeldrues" rel="noopener noreferrer" target="_blank">Mike Drues of Vascular Sciences on LinkedIn</a><a href="https://www.greenlight.guru/blog/multiple-function-device" rel="noopener noreferrer" target="_blank">Global Medical Device Podcast, Episode 164: What is a multiple function device?</a><a href="https://www.greenlight.guru/academy" rel="noopener noreferrer" target="_blank">Greenlight Guru Academy</a><a href="https://virtual-summit.greenlight.guru/" rel="noopener noreferrer" target="_blank">The Greenlight Guru True Quality Virtual Summit</a><a href="https://www.greenlight.guru/podcast-mtqs" rel="noopener noreferrer" target="_blank">MedTech True Quality Stories Podcast</a><a href="https://www.youtube.com/channel/UCYfQsPqHW8H8mZ4xpM4gn1Q" rel="noopener noreferrer" target="_blank">Greenlight Guru YouTube Channel</a><a href="https://www.greenlight.guru/" rel="noopener noreferrer" target="_blank">Greenlight Guru</a>

DESCRIPTION

Cybersecurity continues to be a crucial concern for medical device safety and effectiveness in the US, for manufacturers and regulators alike.

In this episode of the Global Medical Device Podcast Jon Speer talks to Mike Drues from Vascular Sciences about the opportunities and challenges associated with medical device cybersecurity. Listen as Mike and Jon share their thoughts on the potential ways to eliminate or reduce cyber threats and encourage better cybersecurity practices for medical devices.

Some highlights of this episode include:

Cybersecurity is an important topic, but why is the FDA concerned about it? It’s important not to over-generalize.
For example, identity theft may involve a physical medical device or Software as a Medical Device (SaMD). With that, a person’s personal information such as their credit card number could be stolen. Should not be the FDA’s concern.
What about patient privacy? Personal health information or confidential electronic health records are a HIPAA matter - not the FDA’s concern.
Cybersecurity related to the safety and efficacy of a medical device, however, is the FDA’s concern. Safety and efficacy of medical devices is part of FDA’s Center for Devices and Radiological Health (CDRH) mission.
Some have seen in the popular press or been told the urban legend around cybersecurity concerns for implantable devices, such as insulin pumps, pacemakers, catheters, and angioplasty (a.k.a. the Johnny Carson Procedure).
NIST’s call for position papers/statements covered five areas:
Criteria for designating critical software.
Initial list of secure software development lifecycle standards, best practices, and other acceptable guidelines.
Guidelines outlining security measures that will be applied to the federal government’s use of critical software.
Initial minimum requirements for testing software source code.
Guidelines for software integrity chains and provenance.
The categories above are not new and don’t really relate to cybersecurity. These should be standard operating procedures for companies developing products where cybersecurity and software is applicable.
How to minimize or avoid cybersecurity concerns? Join boards/committees to create standards, and determine if there’s a legitimate reason to connect to the internet and communicate with the outside world.

Memorable Quotes from this episode:

“Safety and efficacy of medical devices is at least a paraphrase of part of the FDA - CDRH mission.” Jon Speer

“If there’s a cybersecurity concern that could affect the safety of the device, that is something that FDA could and should be, quite frankly, concerned about.” Mike Drues

“I’m a big fan of using regulatory logic.” Mike Drues

“None of this is new. These should be standard operating procedures for companies that are developing products where cybersecurity and software is applicable.” Jon Speer