Medical Device Cybersecurity Vulnerabilities: New FDA Guidance On Informing Patients

The Center for Devices and Radiological Health of the Food and Drug Administration (FDA) has finalized a set of best practices for informing patients and caregivers about cybersecurity vulnerabilities affecting medical devices (Cybersecurity Best Practices). The publication, designed to help industry stakeholders and federal participants "when designing a communication approach for patients and caregivers about cybersecurity vulnerabilities," is a revised version of a proposal that the FDA released last year to solicit public comments on optimal methods of communicating about such vulnerabilities.¹

Cybersecurity vulnerabilities in medical devices obviously can pose extremely serious risks. As devices evolve to be more interconnected, these risks may multiply: vulnerabilities may affect multiple devices using similar software or components. For example, in March of 2020, the FDA communicated a set of 12 vulnerabilities named "SweynTooth", which impacted a type of