EMERGO SUMMARY OF KEY POINTS: European regulators have published high-level cybersecurity recommendations for industries including medical devices involved in the Internet of Things (IoT) paradigm. The recommendations are partially intended to help companies meet upcoming European data privacy requirements under the General Data Protection Regulation, or GDPR. The European report cites US FDA guidance regarding medical device cybersecurity principles and recommendations.

EMERGO SUMMARY OF KEY POINTS: US FDA has issued three new guidances focused on digital health technology regulations. The guidances stem from 21 st Century Cures Act requirements for timelier registration processes for digital medical technologies.

EMERGO SUMMARY OF KEY POINTS: Pressure from US regulators and healthcare purchasing organizations for medical devices to demonstrate adequate encryption capabilities is increasing. Compliance with the Federal Information Publications Standard (FIPS) 140-2 standard enables manufacturers to demonstrate adequate encryption tools for their devices. FIPS 140-2 compliance is best addressed early in the medical device design phase.

EMERGO SUMMARY OF KEY POINTS: New legislation introduced in the US House of Representatives would launch a working group headed by the FDA to develop strategies for mitigating cybersecurity risks in medical technology. The proposed legislation builds on recommendations issued by the Health Care Industry Cybersecurity Task Force earlier in 2017. If passed by the full Congress, the legislation would require the FDA-led working group to report on its efforts within 18 months.

EMERGO SUMMARY OF KEY POINTS The US FDA has identified nine participants in its digital health technology and software precertification pilot program. FDA Pre-Cert pilot participants include firms such as Apple, Samsung, Fitbit and Johnson & Johnson. The FDA will provide periodic Pre-Cert pilot updates as well as a public workshop in early 2018.

EMERGO SUMMARY OF KEY POINTS: The Singapore Health Sciences Authority (HSA) has issued new clarification and an FAQ regarding how telehealth products and mobile medical apps are regulated in the country. HSA plans an immediate market access pathway for mobile medical apps that have already registered in the US, Canada, Australia, Europe and/or Japan. Singapore’s general regulatory approach to telehealth resembles that of the US FDA.

EMERGO SUMMARY OF KEY POINTS: The US FDA has now officially recognized the UL 2900 cybersecurity standard for medical devices. UL 2900-1 covers general cybersecurity requirements for network-connectable devices. FDA medical device applicants may now declare conformity to UL 2900-1 in order to address cybersecurity requirements as part of their US market registration.

EMERGO SUMMARY OF KEY POINTS: The US FDA will begin its Pre-Certification for Software (Pre-Cert) pilot program for digital health technologies considered medical devices in September 2017. Eligibility requirements for Pre-Cert participation as well as frequently asked questions have been published. As of now, US regulators have not set a deadline for applying to participate in the Pre-Cert program.

EMERGO SUMMARY OF KEY POINTS: A medical device and healthcare networking cybersecurity standard from UL is being recognized by the US Food and Drug Administration. The UL 2900 set of standards will enable US medical device market registrants to assemble evidence to demonstrate proper cybersecurity features for their products. Tools to demonstrate compliance with FDA cybersecurity requirements should help device manufacturers and medical software developers in both pre- and post-market environments.