Medical devices to get FDA cybersecurity guidance

The US Food and Drug Administration (FDA) has issued draft guidelines on how medical device makers can protect patients from cybersecurity vulnerabilities in their devices

According to Reuters the draft guidance, which is not legally binding, recommends companies take a number of actions, including monitoring and assessing risk, coordinating efforts by companies, government and other groups do disclose vulnerabilities, and taking measures to address cybersecurity risk early.

The FDA said in a statement: "Cybersecurity threats to medical devices are a growing concern. The exploitation of cybersecurity vulnerabilities presents a potential risk to the safety and effectiveness of medical devices."

The guidance covers how companies should monitor devices once they have been cleared for marketing and indicates that companies will be required to report software vulnerabilities that could compromise clinical performance of the device and risk a patient's health.

The proposed guidance will be open for public comment for 90 days, after which the FDA will issue final guidance, Reuters reported.