FDA calls on medical device makers to focus on cybersecurity
The agency's recommendations follow reports of vulnerabilities in some medical devices
IDG News Service - Medical device makers should take new steps to protect their products from malware and cyberattacks or face the possibility that U.S. Food and Drug Administration won't approve their devices for use, the FDA said.
The FDA issued new cybersecurity recommendations for medical devices on Thursday, following reports that some devices have been compromised.
Recent vulnerabilities involving Philips fetal monitors and in Oracle software used in body fluid analysis machines are among the incidents that prompted the FDA to issue the recommendations, an FDA spokeswoman said.
In one case reported in October, malware slowed down fetal monitors used on women with high-risk pregnancies at a Boston hospital, and in another case, the FDA in January issued a warning about Oracle software that could allow remote access to the databases of Roche Cobra analysis devices, she said.
Representatives of Philips and Oracle didn't immediately respond to requests for comment on the FDA recommendations.
"Many medical devices contain configurable embedded computer systems that can be vulnerable to cybersecurity breaches," the FDA said in its recommendations. "As medical devices are increasingly interconnected, via the Internet, hospital networks, other medical device, and smartphones, there is an increased risk of cybersecurity breaches, which could affect how a medical device operates."
Under proposed rules issued by the FDA, the agency is recommending that device makers provide it with their plans for providing updates and patches, said Erica Jefferson, an FDA spokeswoman.
"Once the guidance is finalized, the agency might consider withholding marketing clearance or approval for medical devices that fail to appropriately address cybersecurity risks," she said.
The FDA is not aware of any patient injuries or deaths associated with cybersecurity incidents, the agency said. The agency doesn't have "any indication that any specific devices or systems in clinical use have been purposely targeted at this time," it said.
The FDA has seen medical devices infected or disabled by malware, and the presence of malware on hospital computers, smartphones and tablets, the agency said. The agency has also found health care providers with "uncontrolled distribution of passwords" and disabled passwords in software designed to have limited access, it said.
Other healthcare providers have failed to apply software updates and patches in a timely manner, the agency said.
The agency wants medical device makers to "take appropriate steps to limit the opportunities for unauthorized access to medical devices," the FDA said in its recommendations. Manufacturers should review their cybersecurity practices to assure that appropriate safeguards are in place to prevent unauthorized access, the agency said.
Healthcare providers should also take steps to limit access and to improve cybersecurity, the agency said.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is firstname.lastname@example.org.
- 18 Hot IT Certifications for 2014
- CIOs Opting for IT Contractors Over Hiring Full-Time Staff
- 12 Best Free iOS 7 Holiday Shopping Apps
- For CMOs Big Data Can Lead to Big Profits
- Slideshow: 5 ways to lock down your mobile device
- Slideshow: 10 mistakes companies make after a data breach
- How to rob a bank: A social engineering walk through
- Which smartphone is the most secure?
For the love of Jiminy Cricket, how much cybersecurity incompetence are American citizens expected to accept and excuse while also footing the $660 million bill? Online security experts say the “new and improved” Healthcare.gov site may actually be more insecure now than before it was fixed!
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Healthcare Firm Ramps Up for Claims Processing Spikes
- Huge increases in claims processing loads and stringent SLAs for Medicaid patients prompted Molina Healthcare to enhance their IT infrastructure with VCE.
- The Telemedicine Revolution: Patients Can't Wait
- How high bandwidth, low latency ethernet communications is changing the practice of medicine. Comcast Ethernet offers the robust, scalable backbone for telemedicine for...
- Escape Plan: How Integrated IT Portfolio Management Helps Organizations Clear the Chaos
- Meaningful Use, ICD-10 compliance, EMR Implementation--do you feel lost in this ever-growing jungle?
- The Six Main Steps To Structured Analogy
- The role of structured analogy software is to automate the data extraction and processing work, provide visualization of the historical context forjudgments and...
- Explore Data with SAS Visual Analytics
- The role of structured analogy software is to automate the data extraction and processing work, provide visualization of the historical context forjudgments and... All Healthcare IT White Papers
- Modernizing SAP environments with minimum risk - a path to Big Data Hear from top IDC analyst, Richard Villars, about the path you can start taking now to enable your organization to get the benefits...
- The Power of the Citrix Mobility Solution, XenMobile Does everything become a smartphone? Or does the smartphone begin to do everything? How can we afford to support BYOD? Rather, how can...
- BYOD Happens: How to Secure Mobility How to navigate the journey of securing mobility, including the BYOD corruption of IT, the top ten mobility strategies, and the mobility management...
- Fighting Fraud Videos: IBM Intelligent Investigation Manager Short videos about IBM Intelligent Investigation Manager (IIM) for Fraud. IIM optimizes the investigation of fraud for customers across many industries in both...
- IBM Intelligent Investigation Manager: Online Product Demo Intelligent Investigation Manager optimizes fraud investigation and analysis and it dynamically coordinates and reports on cases, provides analysis and visualization, and enables more...
- All Healthcare IT Webcasts
Johns Hopkins, OhioHealth, Kaiser Permanente and other top healthcare organizations each won a place on Computerworld's Best Places to Work in IT 2013 list. Honorees say the distinction helps them both recruit and retain top talent.
Want to join this elite group? Nominate your organization for our 2014 list.