Lexology February 24, 2023
On December 29, 2022, President Biden signed a new statute that will significantly impact medical device cybersecurity regulation. Section 3305 of the Consolidated Appropriations Act of 2023 (“Section 3305”) authorizes the Food and Drug Administration (FDA) to establish cybersecurity standards for medical devices.
Background
The proliferation of the internet of things (IoT) into healthcare has had profound benefits for patient care, but it has also presented unique cybersecurity challenges for device manufacturers, healthcare providers, third-party device servicers, and patients. Last year, the Federal Bureau of Investigation’s (FBI) Cyber Division warned that cybersecurity vulnerabilities in medical devices have the potential to impact patient safety, healthcare facility operations, data confidentiality, and data integrity. In fact, concerns with medical devices such as IV...