The FDA's Only Interest Is Patient Safety and Effectiveness

The law requires that it applies explicitly only to Internet-connected devices. The FDA is solely interested in patient safety and effectiveness. They're mostly concerned about what cybersecurity has been built into the device. In many cases, a device can have a vulnerability but the manufacturer can prove that when that gets exploited, it doesn't result in a patient safety impact.