Medical device cybersecurity
Requirements placed on makers of connected medical devices to prevent, detect and fix vulnerabilities, now a condition of market access in the United States since 2023 and in the EU under the 2017 regulation.
Infusion pumps, pacemakers, imaging machines and patient monitors are now connected to hospital networks and sometimes to the internet. A vulnerability can allow their operation to be altered, health data to be extracted, or the device to be used as a gateway into a hospital's entire information system. For a long time, the IT security of these devices remained secondary, their operating systems aging without patches through years of use. Regulators have tightened the framework. In the United States, a provision added in 2022 to the federal food, drug and cosmetic law, section 524B, has required since March 2023 that manufacturers submit, for any new authorization, a plan to monitor and fix vulnerabilities, a software bill of materials and evidence of secure design. In the European Union, the 2017 medical devices regulation includes IT security among the general safety and performance requirements. For insurance, the subject bears on manufacturers' product liability, which extends to software security defects, product recalls triggered by a vulnerability, and the cyber insurance of healthcare providers, whose fleet of old, unpatchable devices weighs on pricing.
Textbook case: a manufacturer finds that a vulnerability in its infusion pumps allows the delivered flow rate to be changed remotely. It releases a patch and recalls the devices that cannot receive it. Its product recall insurer covers the cost of the operation; its liability insurer remains exposed if a patient was harmed before the patch.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.