FDA moves to require patching in connected medical devices

secure chip (Virgiliu Obada/ 

The Food and Drug Administration is looking to mitigate serious cybersecurity threats to connected medical devices, especially attacks that could disrupt the operation of critical monitors and drug delivery equipment.

As part of a plan announced on April 17, the FDA wants software and firmware in devices directly linked to patient safety like insulin pumps and cardiac pacemakers to be able to be patched on an ongoing basis.

The FDA is also considering new requirements covering the disclosure of vulnerabilities and updated guidance to guard against ransomware attacks as well as major risks to patient safety.

"Our aim is to make sure that the new advances in technology that are enabling better capabilities and benefits are also harnessed to bring added assurances of safety, so that more patients can benefit from new devices and address unmet needs," FDA Commissioner Scott Gottlieb said.

The FDA is also looking at launching a public-private safety board to provide analysis and field expertise to device manufacturers and the FDA in a range of technological and clinical subject areas. The new entity, dubbed the CyberMed Safety (Expert) Analysis Board, would address a key "gap" in medical device cybersecurity response. The board would include a "go team" to investigate and offer mediation on cybersecurity incidents at the request of FDA or industry.  Funding for the board is included in the FDA's 2019 budget request.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at [email protected] or follow him on Twitter at @MRockwell4.


  • Cybersecurity
    Boy looks under voting booth at Ventura Polling Station for California primary Ventura County, California. Joseph Sohm /

    FBI breach notice rules lauded by states, but some want more

    A recent policy change by the FBI would notify states when their local election systems are hacked, but some state officials and lawmakers want the feds to inform a broader range of stakeholders in the election ecosystem.

  • paths (cybrain/

    Does strategic planning help organizations?

    Steve Kelman notes growing support for strategic planning efforts -- and the steps agencies take to keep those plans relevant.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.