CFDA is aiming the guidance at Class II and III devices that feature network connectivity to enable electronic data exchange or remote control — be it via Wi-Fi or wired connection — or the means to store data for transfer later. The agency, like other regulators, fears security problems with such devices could compromise patient privacy and lead to users being injured or killed. CFDA wants medical device developers to take steps to mitigate these risks before filing to register a connected product.
These steps start with an assessment of the security of the device in the context in which it will be used. CFDA wants developers to identify assets related to the device that could have value to an individual or organization, potential threats to security and the ways the product is vulnerable to attack. This review should encompass the life cycle of the device, from production through to maintenance. Armed with this knowledge, developers can take risk-control measures commensurate with the threats posed to their devices.
Part of the challenge is to ensure devices remain secure when used in the real world. The guidance acknowledges device developers partly cede control once a product is in use, but requires them to remain involved in security throughout the life cycle. Applicants are responsible for ensuring their devices, interfaces with other equipment and the network security are sufficient for the safe and effective operation of the product.
Having established this grounding of who is responsible for what, the guidance delves into some of the details that go into ensuring the security of connected medical devices. The document covers the technical features developers can use to enhance security, such as encryption and firewalls, and the management of security updates. Other topics include the need to develop a plan for maintaining the device and declare certain information when seeking registration of a product.
The guidance is set to come into force at the start of next year.
More Information On CFDA Notice