The U.S. Food and Drug Administration (FDA) is recommending that medical device manufacturers and health care facilities take steps to assure that appropriate safeguards are in place to reduce the risk of failure due to cyber attack, which could be initiated by the introduction of malware into the medical equipment or unauthorized access to configuration settings in medical devices and hospital networks.
According to the FDA, many medical devices contain configurable embedded computer systems that can be vulnerable to cybersecurity breaches. In addition, as medical devices are increasingly interconnected, via the Internet, hospital networks, other medical device, and smart phones, there is an increased risk of cybersecurity breaches, which could affect how a medical device operates.
Recently, the FDA has become aware of cybersecurity vulnerabilities and incidents that could directly impact medical devices or hospital network operations. A new FDA Safety Communication has recommendations for both device manufacturers as well as health care facilities.
In evaluating network security, hospitals and health care facilities should consider:
- Restricting unauthorized access to the network and networked medical devices.
- Making certain appropriate antivirus software and firewalls are up-to-date.
- Monitoring network activity for unauthorized use.
- Protecting individual network components through routine and periodic evaluation, including updating security patches and disabling all unnecessary ports and services.
- Contacting the specific device manufacturer if there is suspicion of a cyber security problem related to a medical device. If unable to determine the manufacturer or cannot contact the manufacturer, the FDA and DHS ICS-CERT may be able to assist in vulnerability reporting and resolution.
- Developing and evaluating strategies to maintain critical functionality during adverse conditions.
What is the state of cybersecurity in your organization? You need to be certain that you have comprehensive policies and procedures that address the protection of your IT networks and software including:
- Maintenance of Computer Software Programs
- Workforce Clearance and Network Access Authorization
- Network Access Establishment and Modification
- Protection from Malicious Software
- Security Incident Procedure – Response and Reporting
- Data Backup Plan
This week MCN Healthcare’s StayAlert Compliance Alert Product published a review of the FDA Safety Communication and included example policies like the ones above. Do you need help getting the most up-to-date policies in place? Consider a free trial of StayAlert today!Tweet