Brian Pate of SoftwareCPR® writes:
In May 2014, FDA offered further guidance to manufacturers regarding premarket submission information identifying cyber-security risks and hazards associated with their medical devices, and the responsibility for engineering appropriate risk controls to address patient safety and assure proper device performance. FDA encouraged manufacturers to report any cyber-security incidents that may occur.
Many manufacturers may be struggling with first steps toward improved cyber-security or what process to use. Since many medical device manufacturers are already familiar with the ISO 14971 risk management process, SoftwareCPR® recommends that cyber-security risks simply be added to the existing risk analysis. Using techniques such as threat modeling, cyber-intrusions can be treated like failure modes that can lead to high level hazards that have been identified for the clinical harms of the medical device. The ISO 14971 process will then guide the evaluation and design of appropriate risk controls for these types of cyber-intrusions.
Device manufacturers and healthcare institutions should also become familiar with a number of Health IT security standards – including the IEC 80001 series – that contain specific recommendations for addressing and assessing cybersecurity risks.
