What You Need to Know About the New Cybersecurity Regulations for Medical Device with Milton Yarberry
Nov 14, 2023
auto_awesome
Milton Yarberry, Director of Project Management at Integrated Computer Solutions, discusses the impact of the Patch Act by the FDA on medical device cybersecurity. The podcast covers software affected, key takeaways, impact on legacy devices, and how medical device companies will be affected. It also explores challenges in implementing cybersecurity regulations, the importance of usability in medical devices, lack of regulation for software in healthcare settings, challenges of incorporating late information in development, and the importance of marketing in medical device development.
The Protecting and Transforming Cyber Health Care (PATCH) Act, implemented by the FDA, aims to regulate cybersecurity in medical devices and ensure that all medical devices with software prioritize cybersecurity.
Software in medical devices, whether software as a medical device (SaMD) or software in a medical device (SiMD), must meet specific regulatory requirements, including having a vulnerability plan, a software bill of materials, and protocols for responding to potential cyberattacks.
Deep dives
Importance of Software in the Medical Device Industry
Software plays a crucial role in delivering quality and efficient medical care. While safety has always been a priority in the medical device industry, software presents different challenges due to its faster pace and unique requirements. Regulatory bodies are addressing these challenges by implementing regulations like the Protecting and Transforming Cyber Health Care (PATCH) Act. This act aims to ensure cybersecurity in all medical devices with software, whether software as a medical device or software in a medical device.
Differences between Software and Hardware Development
Software development in the medical device industry differs from hardware development in several ways. While there are similarities in the process of defining, building, and testing products, there are additional complexities in software development like defining requirements, ensuring traceability, and addressing regulatory compliance. Unlike commercial software development, medical software must prioritize safety and efficacy due to the potential consequences of errors or vulnerabilities.
Understanding Software as a Medical Device (SaMD) and Software in a Medical Device (SiMD)
In the medical device industry, software can be categorized as software as a medical device (SaMD) or software in a medical device (SiMD). SaMD refers to software that runs on generic hardware like laptops or phones, while SiMD refers to software that is used alongside customized hardware. The distinction is important because SiMD requires considerations of the hardware's performance and integration with the software. Regulatory bodies have provided guidance, including the PATCH Act, to address the regulation of software in medical devices.
Overview of the PATCH Act for Cybersecurity in Medical Devices
The PATCH Act, implemented by the FDA, aims to regulate cybersecurity in medical devices and ensure that all medical devices with software prioritize cybersecurity. The act applies to both software as a medical device and software in a medical device. It introduces requirements like having a vulnerability plan, a software bill of materials, and protocols for responding to potential cyberattacks. The act expands the scope beyond devices connected to the internet by including devices that have software and can potentially be connected to the internet in the future.
Milton Yarberry is Director of Project Management at Integrated Computer Solutions. Milton has developed or managed software development for Motorola, Lucent, Cognex, Inktomi, and FEI, before moving into the medical software sector in 2006 with Foliage, Ivenix and now ICS. In this episode he shares about the Protecting and Transforming Cyber Health Care, or Patch Act, which FDA implemented in October 2023, including what software is impacted, the key take-aways from this regulation, if this effects legacy devices, and how medical device companies will be impacted.