Cybersecurity (Not Devices) Triggers FDA Panel Meeting

It’s been more than a year and a half since the FDA’s Orthopaedic and Rehabilitation Devices Panel met. That was the panel meeting to consider the premarket approval application (PMA) for the Barricaid Annular Closure Device by Intrinsic Therapeutics. The device was approved.

There are no ortho panel meetings scheduled for the rest of 2019.

However, the agency announced in June 27, 2019 that it is convening the Patient Engagement Advisory Committee on September 10, 2019 to discuss and make recommendations on the topic “Cybersecurity in Medical Devices: Communication That Empowers Patients.”

The agency notes that medical devices are increasingly connected to the internet, hospital networks, and other medical devices.

The announcement came on the same day that Medtronic said it was recalling certain MiniMed insulin pumps due to “potential security vulnerabilities.”

This isn’t the first time this has been on the FDA’s radar. The agency, according to fdalawblog.com, has issued at least six other Safety Communications since 2015 about specific medical device cybersecurity issues, including issues related to other Medtronic devices.

Agency leaders will seek recommendations to “address which factors should be considered by FDA and industry when communicating cybersecurity risks to patients and to the public, including but not limited to the content, phrasing, the methods used to disseminate the message and the timing of that communication. The recommendations will also address concerns patients have about changes to their devices to reduce cybersecurity risks as well as the role of other stakeholders such as healthcare providers in communicating cybersecurity risks to patients.”

Back in October 2018, we reported on the FDA’s release of a cybersecurity “playbook” for health care organizations that outlines steps organizations can take to be better prepared for a cyberattack that involves medical devices.

As an example, the playbook cites how the global ransomware event known as WannaCry, which targeted healthcare organizations, demonstrated how the performance of vulnerable medical devices, “may be compromised by an exploit, whether it intentionally targets the healthcare system or is purely opportunistic.”

“Similarly, other attacks such as Petya/NotPetya have highlighted key challenges in preparedness and response across the healthcare and public health critical infrastructure sector.”

Public comments will be scheduled between approximately 10:45 a.m. to 12:15 p.m. on September 10, 2019. Those interested in making formal oral presentations should notify the contact person and submit a brief statement of the general nature of the evidence or arguments they wish to present.

You can contact Letise Williams, Center for Devices and Radiological Health, Food and Drug Administration, 10903 New Hampshire Ave., Bldg. 66, Rm. 5441, Silver Spring, MD 20993-0002, letise.williams@fda.hhs.gov, 301-796-8398, or FDA Advisory Committee Information Line, 1-800-741-8138 (301-443-0572 in the Washington, D.C. area), for more information.