FDA calls on medical device makers to focus on cybersecurity
The agency's recommendations follow reports of vulnerabilities in some medical devices
IDG News Service - Medical device makers should take new steps to protect their products from malware and cyberattacks or face the possibility that U.S. Food and Drug Administration won't approve their devices for use, the FDA said.
The FDA issued new cybersecurity recommendations for medical devices on Thursday, following reports that some devices have been compromised.
Recent vulnerabilities involving Philips fetal monitors and in Oracle software used in body fluid analysis machines are among the incidents that prompted the FDA to issue the recommendations, an FDA spokeswoman said.
In one case reported in October, malware slowed down fetal monitors used on women with high-risk pregnancies at a Boston hospital, and in another case, the FDA in January issued a warning about Oracle software that could allow remote access to the databases of Roche Cobra analysis devices, she said.
Representatives of Philips and Oracle didn't immediately respond to requests for comment on the FDA recommendations.
"Many medical devices contain configurable embedded computer systems that can be vulnerable to cybersecurity breaches," the FDA said in its recommendations. "As medical devices are increasingly interconnected, via the Internet, hospital networks, other medical device, and smartphones, there is an increased risk of cybersecurity breaches, which could affect how a medical device operates."
Under proposed rules issued by the FDA, the agency is recommending that device makers provide it with their plans for providing updates and patches, said Erica Jefferson, an FDA spokeswoman.
"Once the guidance is finalized, the agency might consider withholding marketing clearance or approval for medical devices that fail to appropriately address cybersecurity risks," she said.
The FDA is not aware of any patient injuries or deaths associated with cybersecurity incidents, the agency said. The agency doesn't have "any indication that any specific devices or systems in clinical use have been purposely targeted at this time," it said.
The FDA has seen medical devices infected or disabled by malware, and the presence of malware on hospital computers, smartphones and tablets, the agency said. The agency has also found health care providers with "uncontrolled distribution of passwords" and disabled passwords in software designed to have limited access, it said.
Other healthcare providers have failed to apply software updates and patches in a timely manner, the agency said.
The agency wants medical device makers to "take appropriate steps to limit the opportunities for unauthorized access to medical devices," the FDA said in its recommendations. Manufacturers should review their cybersecurity practices to assure that appropriate safeguards are in place to prevent unauthorized access, the agency said.
Healthcare providers should also take steps to limit access and to improve cybersecurity, the agency said.
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is firstname.lastname@example.org.
Apple does more to ensure its solutions are accessible to a wide range of users than any other platform, in spite of any drivel suggesting otherwise.
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Security, Privacy and Trust in Email Management
- This white paper discusses a SaaS-based email management solution that delivers the security, continuity and archiving capabilities your organization demands.
- The Total Cost of Email
- In this white paper, we'll explore the true costs of fragmented email management and uncover how to reduce those costs with a cloud-based...
- Balancing Security, Compliance and Cost: the Prescription for Healthcare Email Management: Move to the Cloud
- Learn how cloud-based technologies for core productivity tools such as email and collaboration can help healthcare organizations be more efficient with IT dollars...
- Email Security Checklist: Eight Steps for Healthcare Organizations
- Don't let fear of violating Healthcare Insurance Portability and Accountability Act (HIPAA) codes prevent you from using email to communicate sensitive information.
- Seven questions you must ask before choosing your patient portal solution
- By asking the right questions and connecting the right stakeholders, you can ensure that you implement a true community solution that will improve... All Healthcare IT White Papers
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Why Are Customers Really Deploying an NGFW? It seems every IT Security expert is talking about the NGFW, but what are people really doing? This webcast covers 5 real-world customer...
- Charting Your Analytical Future - "Making predictive analytics part of your business processes" Webinar This session will show how predictive analytics can be used throughout the organization by anyone looking for answers and how organizations can make...
- All Healthcare IT Webcasts