The Current State of Cybersecurity in Medical Devices Medmarcs - - PowerPoint PPT Presentation

▶
the current state of cybersecurity in medical devices
SMART_READER_LITE
LIVE PREVIEW

The Current State of Cybersecurity in Medical Devices Medmarcs - - PowerPoint PPT Presentation

Oct 30, 2023 205 likes •618 views

The Current State of Cybersecurity in Medical Devices Medmarcs Webinar Series August 22, 2019 Vulnerable Devices Pacemakers / implantable defibrillators Insulin pumps Infusion pumps Mobile health technologies (mHealth

slide-1
SLIDE 1

The Current State of Cybersecurity in Medical Devices

Medmarc’s Webinar Series August 22, 2019

slide-2
SLIDE 2

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Vulnerable Devices

  • Pacemakers / implantable defibrillators
  • Insulin pumps
  • Infusion pumps
  • Mobile health technologies (mHealth Technology)
  • Patient monitors
  • Patient portals
  • Telemedicine
  • Ventilators / Life supporting devices
  • Imaging modalities
  • Hearing aids
slide-3
SLIDE 3

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Potential Loss Scenarios

  • Malware attacks
  • Software vulnerabilities
  • Faulty networks
  • Computer technology (IT services)
  • Hacking
  • Steal patient data
  • Commandeer medical devices for denial of service
  • Distributed denial of service
  • Cyber Extortion
  • Medical device vulnerabilities
slide-4
SLIDE 4

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Fundamental challenges

  • New features take priority over security
  • More commoditized hardware/software
  • Remote interface
  • Regulators are always playing catch up
slide-5
SLIDE 5

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Cyber security is

  • Confidentiality
  • Integrity
  • Availability
slide-6
SLIDE 6

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

slide-7
SLIDE 7

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Medical device risks

  • Software defect
  • Incorrect network configuration
  • Security and privacy issues
  • Lack of data protection
  • Disposal or loss of the device
  • Malware, criminals
slide-8
SLIDE 8

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Cyber related design considerations

  • System testing
  • Secure IT systems
  • Regulatory compliance
  • Account for upgrades and unknowns
  • Design security into the product
  • -Make products as updatable and adaptable

as the internet itself.

slide-9
SLIDE 9

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Malicious tampering What: Add or remove cancers from CT and MRI Why: Ransom in exchange for correction Create chaos and mistrust Missed diagnosis, failure to treat Insurance fraud

slide-10
SLIDE 10

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

slide-11
SLIDE 11

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

How is this possible?

  • PACS not encrypted
  • Health care industry focused on privacy

rather than security

  • Physical or network access
  • Direct connection to internet or to hospital

network

slide-12
SLIDE 12

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Prevention

  • End to end encryption
  • Digital signatures
slide-13
SLIDE 13

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Medtronic Implantable Cardiac Devices

  • FDA safety communication re wireless

telemetry technology

  • Conexus uses wireless RF without

encryption

slide-14
SLIDE 14

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Safety features as designed

  • Can only be activated by a health care

provider at a clinic

  • Activation times vary
  • Hacker would have to be nearby when

active

  • Replacement is not recommended at

this time.

slide-15
SLIDE 15

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Review the data lifecycle

  • Where is the data stored?
  • How is the data protected?
  • Who processes the data?
  • Who is responsible?
  • Who can access?
slide-16
SLIDE 16

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

California Consumer Privacy Act

Who?

  • Doing business in CA; revenue over $25

million; buy, sell, receive personal information of 50,000 or more devices or consumers or 50% plus revenue selling personal information What?

  • Right to access data, have data deleted,

prevent data from being sold

slide-17
SLIDE 17

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

California IoT Statute

Reasonable security features appropriate to the nature and function of the device and information it collects, stores,

  • r transmits.
slide-18
SLIDE 18

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Man anufac acturer O Obli ligatio ions

Premarket and Postmarket Reporting

slide-19
SLIDE 19

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers: Premarket Reporting

  • FDA Guidance – Guidance for the Content of Premarket

Submissions for Software Contained in Medical Devices

  • http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument

s/u cm089543.htm

  • FDA Guidance to Industry - Cybersecurity for Networked Medical

Devices Containing Off-the-Shelf (OTS) Software

  • http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocument

s/u cm077812.htm

  • FDA Guidance for Industry and Food & Drug Administration Staff –

Content of Premarket Submissions for Management of Cybersecurity in Medical Devices

  • http://www.fda.gov/BiologicsBloodVaccines/GuidanceComplianceRegulatoryInform

ation/default.htm

slide-20
SLIDE 20

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers – Premarket Reporting

  • Effective cybersecurity management in premarket submissions
  • To reduce risk to patients
  • From compromise of device functionality by inadequate

cybersecurity

  • Guidance covers premarket submissions for devices that contain

software (including firmware) or programmable logic as well as software that is a medical device

slide-21
SLIDE 21

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers – Premarket Obligations

  • Manufacturers should:
  • develop a set of cybersecurity controls to assure medical

device cybersecurity and maintain medical device functionality and safety.

  • address cybersecurity during the design and development of

the medical device, as this can result in more robust and efficient mitigation of patient risks.

  • establish design inputs for their device related to

cybersecurity, and establish a cybersecurity vulnerability and management approach as part of the software validation and risk analysis that is required by 21 CFR 820.30(g).

slide-22
SLIDE 22

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers – Premarket Obligations

  • Identify
  • Protect
  • Detect
  • Respond
  • Recover
slide-23
SLIDE 23

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers – Postmarket Obligations

  • Formal and informal reporting obligations
  • 21 CFR § 806.1: requires manufacturers to report to FDA

certain product corrections and removals

  • Risk-based framework for determining when a reportable

change to a medical device for cybersecurity vulnerability has occurred

  • Routine updates and patches

versus

  • Correction of cybersecurity vulnerability that poses risk to

health

slide-24
SLIDE 24

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers – Postmarket Obligations

  • Reporting requirements (continued)
  • 21 CFR § 803.10

(1) Reports of individual adverse events – 30 calendar days after becoming aware of a reportable death, serious injury, or malfunction (2) Reports of individual adverse events - 5 work days after becoming aware of: (i) Reportable event that requires remedial action to prevent an unreasonable risk of substantial harm to the public health, or (ii) A reportable event for which FDA made a written request.

slide-25
SLIDE 25

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers – Postmarket Obligations

  • FDA encourages:
  • The use and adoption of

“Framework for Improving Critical Infrastructure Cybersecurity”

https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurit y-framework021214.pdf

  • Information Sharing

Executive Order 13691 – Promoting Private Sector Cybersecurity Information Sharing

  • Information Sharing Analysis Organizations
  • EO 13691; https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-

promoting 7 - private-sector-cybersecurity-information-sharing)

slide-26
SLIDE 26

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

FDA’s Role

  • Works with DHS, manufacturers, health care

providers, and end users

  • QSRs
  • Pre- and post-market cybersecurity

guidance

slide-27
SLIDE 27

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

MEDICAL DEVICE CYBERSECURITY Regional Incident Preparedness and Response Playbook

slide-28
SLIDE 28

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Playbook - Stakeholders

  • FDA
  • Medical Device Manufacturers
  • Health Delivery Organizations (HDO’s)
  • Large and small hospitals, hospital systems, providers
slide-29
SLIDE 29

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Purpose of Medical Device Cybersecurity Playbook

  • Provide baseline medical device cybersecurity information that can

be incorporated into an HDO’s emergency preparedness and response framework;

  • Outline roles and responsibilities for responders internal and external

to the HDO to clarify lines of communication and concept of

  • perations (CONOPs) across HDOs, medical device manufacturers

(MDMs), state and local governments, and the federal government;

  • Describe a standardized approach to response efforts that would

enable a unified response within HDOs and across regions as appropriate;

slide-30
SLIDE 30

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Purpose of Medical Device Cybersecurity Playbook

  • Serve as a basis for enhanced coordination activities among medical

device cybersecurity stakeholders, including mutual aid across HDOs;

  • Inform decision making and the need to escalate response;
  • Identify resources HDOs may leverage as a part of preparedness and

response activities; and

  • Serve as a customizable regional preparedness and response tool for

medical device cyber resiliency that could be broadly implemented.

slide-31
SLIDE 31

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Focus of Playbook

  • THREATS OR VULNERABILITIES THAT ARE:
  • Large scale
  • Multi-patient impact
  • Raise patient safety concerns
  • CYBER SECURITY IS A “TEAM SPORT”
  • Encourage information sharing
  • Regions: geographic and/or organizational
  • Mitigate emerging cyber risks
  • PROVIDE TOOLS
  • For HDO’s to respond to device cybersecurity incidents
slide-32
SLIDE 32

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

slide-33
SLIDE 33

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Preparedness

Assess and bolster cyber defensive measures Develop incident handling procedures

slide-34
SLIDE 34

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Identify that an incident has occurred Validate - Is it real? Prioritize Report (if required) Document

slide-35
SLIDE 35

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Halt the incident Fix the damage Restore services Monitor and record suspected criminal activity

slide-36
SLIDE 36

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Assess lessons learned Forensic examination Update plan

slide-37
SLIDE 37

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

*In the absence of incident information, HDOs may contact FDA for support at CyberMed@fda.hhs.gov.

Notification of aberrant device behavior; request for device help/info

Manufacturer

Device advisories, alerts, mitigations

  • Incident notification
  • Device adverse event reporting (when

applicable)

  • Voluntary recalls
  • Information gathering
  • Benefit-risk analysis of MDM

proposed mitigations

HDO* FDA

Incident communication

slide-38
SLIDE 38

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Manufacturers

  • Collaborate in cybersecurity exercises
  • Point of contact
  • Monitor and assess
  • Proactively disclose vulnerabilities and

mitigation

slide-39
SLIDE 39

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

FDA w worksh shop, J January 2 2019: Content ent o

  • f P

Prem emarket et S Submissions ns f for Mana nagem ement ent o

  • f C

Cyber ersec ecur urity i in M Medi dical D Devices es

Handouts, presentations, and webcast recordings available:

https://www.fda.gov/medical-devices/workshops-conferences- medical-devices/public-workshop-content-premarket-submissions- management-cybersecurity-medical-devices-january-29-30

slide-40
SLIDE 40

LORANCE CE THOM OMPSON ON A PROFESSIONAL CORPORATION

Questions?

Robert G. Smith, Jr. Lorance Thompson PC 2900 North Loop West, Suite 500 Houston, Texas 77092 Office: 713.868.5560 Mobile: 713.857.8281 rgs@lorancethompson.com Sharon Stuart Christian & Small LLP 505 North 20th Street Financial Center, Suite 1800 Birmingham, AL 35203 Office: 205.795.6588 sdstuart@csattorneys.com