Medical Device Industry Update December 2022

MITRE Publishes Updated Medical Device Cybersecurity Incident Preparedness and Response Playbook 

In November, FDA and MITRE released an updated version of their ‘Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook’. The playbook helps healthcare organizations to prepare for security incidents involving medical devices. It includes tools, techniques, and resources that allows companies to ready themselves for cyber breaches and respond in a suitable fashion.   

“The playbook outlines how hospitals and other HDOs can develop a cybersecurity preparedness and response framework. It supplements existing HDO emergency management and/or incident response capabilities with regional preparedness and response recommendations for medical device cybersecurity incidents. The revised version includes more explicit alignment with the Hospital Incident Command System for managing complex incidents, considerations for the widespread impacts and extended downtimes that are common during cyber incidents, and an appendix of resources.” 

The initial version of this playbook was published in 2018. Since then, cyberattacks have continued to impact the healthcare and public health (HPH) sector. MITRE said that from mid-2020 through 2021, 82% of healthcare systems reported a cyber incident, 34% of which were related to ransomware. 

Updates to the playbook include: 

• • • • • • • • • • Emphasizing the need to have a diverse team participating in cybersecurity preparedness and response exercises. This includes clinicians, healthcare technology management professionals, IT, emergency response, risk management and facilities staff. 
                  • Highlighting considerations for widespread impacts and extended downtimes during cybersecurity incidents which benefit from the use of regional response models and partners.  
                  • Adding a resource appendix that makes it easier to find tools, references and other resources to help health care organizations prepare for and respond to medical device cybersecurity incidents. 

Virginia Senator Proposes Cybersecurity Mandates for Improving Cybersecurity Across the Healthcare Industry 

In early November Virginia Senator and Chairman of the Senate Select Committee on Intelligence, Mark Warner, released a whitepaper that describes a series of potential regulatory requirements aimed at improving cybersecurity across the healthcare industry. The paper, which is titled ‘Cybersecurity is Patient Safety’, outlines current cybersecurity threats facing healthcare providers along with a series of policy solutions that would improve cybersecurity across the industry. 

The paper states that cybersecurity can no longer be treated as a secondary concern and must become incorporated into every organization’s core business model.  

“Unfortunately, the health care sector is uniquely vulnerable to cyberattacks and the transition to better cybersecurity has been painfully slow and inadequate. The federal government and the health sector must find a balanced approach to meet the dire threats, as partners with shared responsibilities,” wrote Sen. Warner. 

Divided in three parts, the whitepaper is organized as follows: 

• • • • • • • • • • Chapter 1 covers areas that the federal government needs to address to improve our national risk posture when it comes to cybersecurity in the healthcare sector.  
                  • Chapter 2 covers ways in which the federal government can help the private sector meet this threat through a combination of potential mandates and voluntary incentives to adopt best practices. 
                  • Chapter 3 covers policies that could help healthcare providers respond to attacks in the event of a cybersecurity failure. Specifically, it notes ways institutions can recover following successful cyberattacks, and how to limit the resulting impact on patients and systems. 

 A full copy of the paper can be found here.