FDA moves to require patching in connected medical devices

secure chip (Virgiliu Obada/ 

The Food and Drug Administration is looking to mitigate serious cybersecurity threats to connected medical devices, especially attacks that could disrupt the operation of critical monitors and drug delivery equipment.

As part of a plan announced on April 17, the FDA wants software and firmware in devices directly linked to patient safety like insulin pumps and cardiac pacemakers to be able to be patched on an ongoing basis.

The FDA is also considering new requirements covering the disclosure of vulnerabilities and updated guidance to guard against ransomware attacks as well as major risks to patient safety.

"Our aim is to make sure that the new advances in technology that are enabling better capabilities and benefits are also harnessed to bring added assurances of safety, so that more patients can benefit from new devices and address unmet needs," FDA Commissioner Scott Gottlieb said.

The FDA is also looking at launching a public-private safety board to provide analysis and field expertise to device manufacturers and the FDA in a range of technological and clinical subject areas. The new entity, dubbed the CyberMed Safety (Expert) Analysis Board, would address a key "gap" in medical device cybersecurity response. The board would include a "go team" to investigate and offer mediation on cybersecurity incidents at the request of FDA or industry.  Funding for the board is included in the FDA's 2019 budget request.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at or follow him on Twitter at @MRockwell4.


  • Defense
    Ryan D. McCarthy being sworn in as Army Secretary Oct. 10, 2019. (Photo credit: Sgt. Dana Clarke/U.S. Army)

    Army wants to spend nearly $1B on cloud, data by 2025

    Army Secretary Ryan McCarthy said lack of funding or a potential delay in the JEDI cloud bid "strikes to the heart of our concern."

  • Congress
    Rep. Jim Langevin (D-R.I.) at the Hack the Capitol conference Sept. 20, 2018

    Jim Langevin's view from the Hill

    As chairman of of the Intelligence and Emerging Threats and Capabilities subcommittee of the House Armed Services Committe and a member of the House Homeland Security Committee, Rhode Island Democrat Jim Langevin is one of the most influential voices on cybersecurity in Congress.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.