Bradley Merrill Thompson, Member of the Firm in the Health Care & Life Sciences practice, in the firm’s Washington, DC, office, was quoted in MedTech Dive, in “Industry Balks at FDA’s Cybersecurity Plans,” by Meg Bryant.
Following is an excerpt:
As cyberattacks on healthcare organizations ramp up, the FDA is boosting efforts to protect the security of connected medical devices with an ambitious plan to reduce vulnerabilities throughout a product’s lifecycle.
The Medical Device Safety Action Plan calls for new authorities to require manufacturers to build security updates and patch capabilities into products beginning at the design stage and to have formal policies and procedures for swift coordinated disclosure of vulnerabilities discovered after products hit the market.
The plan also calls for creation of a CyberMed Safety (Expert) Analysis Board, or CYMSAB, a public-private partnership to assess vulnerabilities, patient risks and advise on mitigation.
Industry, which has largely supported the agency’s cybersecurity efforts, including guidance on premarket and postmarket cybersecurity considerations, fears this latest salvo of preemptive controls could strap manufacturers with burdensome obligations that cannot be sustained in the long run and will do little to improve the safety of connected technologies.
“Addressing the cybersecurity of medical devices is nowhere found in the [FD&C] statute,” says Bradley Merrill Thompson, a device attorney with Epstein Becker & Green. “Any intrusion into cybersecurity has to be predicated on actual evidence of safety issues, not science fiction fears.”
