Cybersecurity

Device industry and cybersecurity lawyers plan to soon unveil an in-depth report describing a pathway for medical device manufacturers and the wider health care sector to protect against cybersecurity threats.

House lawmakers introduced a draft hazard preparedness reauthorization bill that would enhance FDA’s emergency use authorities and direct the agency to work toward developing medical countermeasures with regard to cybersecurity threats.

FDA's device center may ask Congress for authority to require medical device makers build cybersecurity into their upfront product designs and, once a product is marketed, to disclose any vulnerabilities as they are identified.

The American Medical Association is urging HHS to put out a policy that would encourage physicians to embrace a framework for managing cybersecurity risks in exchange for the government agreeing not to conduct surprise audits under the Health Insurance Portability and Accountability Act, which governs the handling and use of medical records and personal patient information.

The Federal Trade Commission's chief of privacy and identity protection is recommending the use of contracts and oversight of vendors to minimize the cybersecurity risks of handling medical information and personal health records.

The former director of the Obama administration's cybersecurity commission is cautioning the health industry about moving too quickly to data-driven innovations and automation without adequate security consideration, advice that comes as the industry faces increased ransomware and other denial of service attacks.

LAS VEGAS -- The National Institute of Standards and Technology within the next few weeks will request industry participation in a proposed project for improved security of patient imaging, archiving and communications systems, as part of a broader NIST effort to assist healthcare providers and device manufactures address the growing threat of cyber attacks.

A coalition of critical industry groups and technology companies is defending HHS' recent decision to establish a cyber-threat information sharing center, arguing the group would augment rather than duplicate info-sharing efforts by the Department of Homeland Security.

HHS is reviewing the regulatory and legal requirements that could prevent hospitals and other healthcare providers from collaborating with the government and among themselves in defending against evolving cyber threats, an issue that was highlighted in the wake of the WannaCry attacks last month, according to HHS officials.