FDA Updates Cybersecurity Playbook for Health Care Organizations

The healthcare sector knows how to prepare for and respond to natural disasters. It is less prepared, however, to handle cybersecurity incidents, particularly those involving medical devices.  With healthcare-related cyber incidents growing in size and scope, preparedness before a cyber event takes place with a strong, well-exercised, support infrastructure in place is foundational to executing a rapid, comprehensive and robust response.  Through planning and practice, as well as support from and collaboration with manufacturers and regional and national partners, HDOs can be well positioned to manage medical device cyber incidents.

As the landscape for health care technology continues to grow and change, the U.S. Food and Drug Administration (FDA) collaborated with MITRE to update the Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook, a resource to help health care delivery organizations prepare for cybersecurity incidents. The playbook focuses on preparedness and response for medical device cybersecurity issues that impact the functionality of a medical device.

The playbook outlines how hospitals and other HDOs can develop a cybersecurity preparedness and response framework. It supplements existing HDO emergency management and/or incident response capabilities with regional preparedness and response recommendations for medical device cybersecurity incidents. The revised version includes more explicit alignment with the Hospital Incident Command System for managing complex incidents, considerations for the widespread impacts and extended downtimes that are common during cyber incidents, and an appendix of resources.

Download the “Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook“

Download the “Medical Device Cybersecurity Regional Incident Preparedness and Response Playbook Quick Start Companion Guide”

Back in July 2022, we commented on the new IEC 81001-5-1, a lifecycle process standard.  Read more:  New Cybersecurity Standard