Medical Device Industry Update March 2023

The Impact That the Biden-⁠Harris Administration’s National Cybersecurity Strategy Will Have on Healthcare Cybersecurity 

On March the 2nd, the Biden-Harris Administration released its much anticipated National Cybersecurity Strategy, defining the government’s approach to cybersecurity. You can read the strategy in full here, or you can take a look at this fact sheet provided by the White House Briefing Room. 

The National Cybersecurity Strategy focuses on five key pillars: 

1. 1. 1. 1. 1. 1. 1. 1. 1. 1. 1. Defend Critical Infrastructure 
                              2. Disrupt and Dismantle Threat Actors
                              3. Shape Market Forces to Drive Security and Resilience
                              4. Invest in a Resilient Future
                              5. Forge International Partnerships to Pursue Shared Goals 

Each pillar has significant implications for critical infrastructure entities which, as mentioned above, include those in the healthcare sector. When it comes to critical infrastructure some of the key directives include: 

• • • • • • • • • • • “Expanding the use of minimum cybersecurity requirements in critical sectors to ensure national security and public safety and harmonizing regulations to reduce the burden of compliance”; 

• • • • • • • • • • • “Enabling public-private collaboration at the speed and scale necessary to defend critical infrastructure and essential services”; 
                    • “Defending and modernizing Federal networks and updating Federal incident response policy”; 
                    • “Using federal grants and other incentives to make investments in critical infrastructure cybersecurity effort”; 
                    • “Investing in federal cybersecurity research and development in areas such as AI, cloud infrastructure, telecommunications and data analytics used in critical infrastructure”. 

The National Cybersecurity Strategy has been met with widespread support across the political spectrum. If the policies are taken into law, it could fundamentally change how healthcare organizations receive support from Federal entities and how the organizations themselves overcome today’s most complicated cybersecurity challenges. 

HSCC Launches New ‘Managing Legacy Technology Security’ Guide Aimed at Healthcare Providers and Medical Device Manufacturers 

On the same day that the Biden-Harris Administration released its much-anticipated National Cybersecurity Strategy, the Healthcare and Public Health Sector Coordinating Council (HSCC) and Cybersecurity Working Group (CWG) launched a new guide centered around aging legacy systems. The strategy guide ‘Health Industry Cybersecurity – Managing Legacy Technology Security (HIC-MaLTS) recommends cybersecurity strategies that manufacturers and health providers can implement for legacy medical technology.  

The guide outlines some of the best practices and recommendations for medical device manufacturers, healthcare providers and other technology providers whose products are used in healthcare environments. 

This document details four “core” practices that effective legacy technology cybersecurity programs should incorporate: 

1. 1. 1. 1. 1. 1. 1. 1. 1. 1. 1. Governance: “Governance of medical technologies across design, development, production, deployment, and utilization are critical to monitoring and sustaining their performance, safety, and security. Governance determines how organizations identify, protect, detect, respond, and recover from cyber incidents.” 
                              2. Communication: “In a successful cybersecurity program, successfully managing cybersecurity risk requires robust, ongoing, and comprehensive communications between stakeholders. To ensure this occurs, the policies and procedures for ongoing communications between stakeholders need to be identified upfront (i.e., at technology procurement) and supported during the lifecycle of the technology.” 
                              3. Risk management: “Performing cybersecurity risk management for legacy technologies presents three main challenges: 1) the volume of current legacy technologies to assess, 2) the lack of information available on their security controls, and 3) the risks associated with “future” legacy technologies that must be appropriately managed, and actions that should be taken to ensure that these technologies do not become legacy unexpectedly.” 
                              4. Futureproofing. “The reality of continued technical advancements in the delivery of care, and in the simultaneous evolution of cyber threats, means that all technologies will one day be “legacy.” Because all technologies age, all technologies will eventually become “legacy” and organizations must act accordingly.  

The guide can be viewed in full here.