Lexology June 2, 2023
Going forward, medical device approval will require the device maker to provide cybersecurity information to the FDA. Congress made this change by adding Section 524B to the Federal Food, Drug, and Cosmetic Act (FD&C Act) at the end of 2022, addressing concerns over the cybersecurity of medical devices. Risks from cybersecurity incidents involving medical devices may include “Health Insurance Portability and Accountability Act (HIPAA) violations, improper patient health assessments, miscalculated medication dosages, and other potentially fatal outcomes,” according to Lifesciences Intelligence.
The Food and Drug Administration (FDA) summarizes the rationale for this change as follows:
The FDA provides further information on cybersecurity at this website.
To implement the new law, the FDA on March 29, 2023 issued new guidance about...