That ever awkward moment that someone asks you what you do for a living on a first date. Your heart sinks, because your job is nowhere as sexy as as “Silicone Valley Software Programmer”, “Digital Marketing Strategist”, “Influencer”, “Blogger”, or “Cybersecurity. Analyst” Well maybe not, sw programmer and cybersecurity anal, but you get my point. How the heck do you explain Quality and Regulatory of Medical devices, and does anyone really care? I guess John Oliver does! And this 20 minute video on the boringness of my job may finally answer why I do this, why I choose to consult, and why everyone needs big pharma and med device to back off - show us the data, charge appropriately and not price gouge us, and get out of not be d with our legislature. Enjoy!
Cybersecurity in Medical Devices and FDA
In the world of medical devices being in the cloud and applications on the interwebs, FDA has stepped up requirements for cybersecurity. It's not just banking, your identity being hacked with your credits cards or tax retunrs, St. Jude and Medtronic were both hacked in 2014 (https://www.meddeviceonline.com/doc/hacked-medtronic-boston-scientific-st-jude-networks-suffer-cybersecurity-breaches-0001).
I think I first saw this way back in 2005 while I worked at pacemaker/defibrillator company being joked at in a cartoon showing Dick Cheney and his defibrillator being hacked forcing an arrhythmia. It showed Dick Cheney signing a document in normal sinus rhythm and them bam - tachycardia. And this was also an episode of Homeland (https//www.telegraph.co.uk/news/science/science-news/11212777/Terrorists-could-hack-pacemakers-like-in-Homeland-say-security-experts.html).
FDA and ISO are now highly depending on assessment of risk, and cybersecurity is not an exception. FDA has released numerous guidance documents listed below where identifying your assets and assessing the threat risk and vulnerability of your systems is first and foremost.
If you interface with the internet in anyway, be aware that you must address this in your premarket submissions or you for sure get a deficiency.
- Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices
- Guidance to Industry: Cybersecurity for Networked Medical Devices Containing Off-the-Shelf (OTS) Software
And don't forget post-marketing requirements: - https://www.fda.gov/ucm/groups/fdagov-public/@fdagov-meddev-gen/documents/document/ucm482022.pdf