Cyber security and medical devices: Electronic medical data increases product liability risk for medical device manufacturers

The value of stolen personal health information is ten to twenty times greater than a stolen credit card number.^[1] As the health-care industry continues to rely more and more on the creation and retention of electronic personal health information, health-care cyber security is becoming a significant area of concern for medical device manufacturers and regulators tasked with protecting the public. Medical devices are as vulnerable as other computer systems containing personal health information.

Reports of cyber security attacks, on both medical devices^[2] and health information generally,^[3] are becoming more common in the health-care industry. As noted by our colleagues in a recent article on cyber security,^[4] "cybercriminals frequently avoid prosecution, [while] their corporate victims may find themselves in the legal spotlight." Medical device manufacturers are potential victims, and failure to properly prevent or patch a cyber security risk may result in disapproval of a device, recall, or other regulatory or legal action.

After calls for improvement to the security and privacy of medical devices, the American Food and Drug Administration ("FDA") has recently released a Draft Guidance for the Postmarket Management of Cybersecurity in Medical Devices,^[5] (the "Draft Guidance") emphasizing that premarket controls by manufacturers are insufficient: "Because cyber security risks to medical devices are continually evolving, it is not possible to completely mitigate risks through premarket controls alone."^[6]

Comments and suggestions on this Draft Guidance were due on April 21, 2016.

The FDA Draft Guidance

The FDA has been actively engaging medical device manufacturers in order to protect personal information. The FDA is encouraging manufacturers to address cyber security throughout the product lifecycle, including during the design, development, production, distribution, deployment and maintenance of a device.^[7]

The Draft Guidance sets out recommendations for premarket risk assessments and management plans that consider identification and assessment of assets, threats, and vulnerabilities, determination of risk levels, suitable mitigation strategies, and risk acceptance criteria.^[8]

The Draft Guidance specifically targets both industry and the FDA staff as to recommendations for managing postmarket cyber security vulnerabilities for marketed medical devices. The postmarket considerations that are critical to the FDA include:^[9]

• Monitoring cyber security information sources for identification and detection of cyber security vulnerabilities and risk;
• Understanding, assessing and detecting presence and impact of a vulnerability;
• Establishing and communicating processes for vulnerability intake and handling;
• Clearly defining essential clinical performance to develop mitigations that protect, respond and recover from the cyber security risk;
• Adopting a coordinated vulnerability disclosure policy and practice; and
• Deploying mitigations that address cyber security risk early and prior to exploitation.

The FDA states that sharing of cyber risk information is critical to a proactive approach to cyber security. The FDA promotes collaboration between public and private stakeholders including the IT community, healthcare delivery organizations, the clinical user community, and medical device manufacturers.

The FDA further encourages the development of "Information Sharing Analysis Organizations" to promote such collaboration. This is made pursuant to an executive order of the President of The United States of America.^[10] Companies who voluntarily participate in such an "ISAO" will gain certain protections, including from enforcement of certain reporting requirements from the US Federal Food, Drug, and Cosmetic Act.^[11]

New Challenges for Device Manufacturers

Implementation of the recommended measures may be expensive for medical device manufacturers, and may slow research and development. Increased postmarket monitoring will be required. Rather than outline specific controls, the Draft Guidance instead suggests vague processes that are "tied to a holistic model of risk."^[12] The FDA expects manufacturers to anticipate vulnerabilities, which may be difficult given the speed at which technology, and most importantly hacking technology, changes. There may also be increased reporting requirements, as for some identified vulnerabilities manufacturers would also be required to notify the relevant government agency.^[13]

While the Draft Guidance states explicitly that it does not establish a legally enforceable responsibility, it is possible that any failure to take into consideration the Draft Guidance that results in a breach may be relied upon as failure to maintain the appropriate standard. As such, it is likely best practice to adopt the FDA's recommendations as much as practically possible.

Recommendations to Medical Device Manufacturers in Canada

To minimize the risk associated with marketing of a medical device, manufacturers should consider security, privacy, and the FDA's guidance on cyber security at the pre-approval and postmarket phases. Canadian medical device companies should be aware of obligations for medical devices marketed in the United States and although similar action has not yet been taken by regulatory bodies in Canada, the FDA often serves as a guidepost for future action in the Canadian legal and regulatory environment. We recommend the following:

• Devices should be designed, tested and monitored in a way that data breaches can be prevented and tracked.
• The possibility of device error, employee error, employee intentional acts/misconduct, and sabotage/external intentional data breaches need to be considered.
• Detailed guidance should be given to internal and external stakeholders (health care providers, patients, etc.) to address post-sale security issues that may arise, including both threats to safety and privacy.
• Establish a process for the entire medical device lifecycle that identifies hazards associated with the cyber security of a medical device, estimating and evaluating the associated risks, controlling these risks, and monitoring the effectiveness of the controls.

As medical device technology quickly evolves, so too will the standard of care owed by a medical device manufacturer to prevent product liability and privacy litigation.

Footnotes

[1] Your medical record is worth more to hackers than your credit card, September 24, 2014

[2] See for example:

• Medical Device manufacturers Medtronic, St. Jude Medical and Boston Scientific targeted by hackers, Link to San Francisco Chronicle Article: Hackers break into networks of 3 big medical device makers, February 8, 2014
• On July 31, 2015 the U.S. Food & Drug Administration issued an Alert regarding the Hospira Symbiq Infusion System due to "cyber security vulnerabilities".
• Daniel Halperin, Tadayoshi Kohono, Thomas S. Heydt-Benjamin, Kevin Fu, and William H. Maisel, Security and Privacy for Implantable Medical devices. IEEE Pervasive Computing, 7(1):30-39, 2008.

[3] See for example:

• Rouge Valley Centenary case, where thousands of new mother's information was sold to RESP companies.
• In April and June of 2014 criminal cyber attacks successfully hacked into Tennessee-based US Community Health Systems Inc. The result was likely the largest single health data breach by a publicly traded company, and resulted in the theft of patient-identifying information for 4.5 million individuals who had received services ( including names, addresses, birthdates, telephone numbers, and social security numbers)

[4] Ransomware poses complex legal and reputational risks, April 27, 2016

[5] FDA Postmarket Management of Cybersecurity in Medical Devices, January 22, 2016 ("Draft Guidance")

[6] Draft Guidance at p. 11.

[7] Draft Guidance at p. 4.

[8] Draft Guidance at p. 11.

[9] Draft Guidance at pp. 11-12

[10] Presidential Executive Order "Promoting Private Sector Cybersecurity Information Sharing," February 13, 2015 Link to February 13, 2016 Executive Order

[11] Draft Guidance at p. 7.

[12] Rep. James Langevin (D-RI), co-chairman of the Congressional Cybersecurity Caucus, wrote an open letter to the Food and Drug Administration's (FDA) on Thursday to praise draft guidance that would strengthen the cyber security of medical devices.

[13] Draft Guidance at p. 4.