Changes to the International Regulatory Environment

While computer-related failures are known to play a significant role in deaths and injuries involving medical devices reported to the U.S. Food and Drug Administration (FDA),1 there is no similar reporting system that meaningfully captures security-related failures in medical devices.Medical device software must satisfy system properties, including safety, security, reliability, resilience, and robustness, among others. This column focuses on the challenges to satisfying a security property for medical devices: post-market surveillance, integrity and availability, and regulation and standards.Medical devices depend on software for patient care ranging from radiation therapy planning to pharmaceutical compounding to automated diagnosis of disease with mobile medical apps. Meanwhile, the medical community has observed an uptick in reported security vulnerabilities in medical device software—raising doubts of cybersecurity preparedness. It should come as little surprise that security risks in medical devices "could lead to patient harm" as recently explained by the chief scientist at the FDA Center for Devices and Radiological Health.2 Device manufacturers and healthcare providers ought to more carefully and deliberately consider security hazards during the phases from design to use of medical devices.Between years 2006 and 2011, 5,294 recalls and approximately 1.2 million adverse events of medical devices were reported to the FDA's Manufacturer and User Facility Device Experience (MAUDE) database.1 Almost 23% of these recalls were due to computer-related failures, of which approximately 94% presented medium to high risk of severe health consequences (such as serious injury or death) to patients.1 For security incidents on medical devices, no systematic national reporting system exists.3 Yet, individual hospitals know of hundreds of security incidents on medical devices.2For instance, the FDA MAUDE does not capture adverse events such as lack of or impaired availability of function when malware infects a medical device's operating system. FDA's own disclaimer explains that the MAUDE database is qualitative rather than quantitative. MAUDE is incomplete with underreporting and reporting bias.Imagine the reaction of a clinician using a high-risk pregnancy monitor that begins to perform more slowly because of a Conficker infection. Would the clinician report a malware infection? Likely not. Admitting to playing a role in accidentally infecting a medical device-would likely lead to consequences ranging from disciplinary action to loss of reputation. Thus, the actual incidence of security failures leading to healthcare delivery failures may be significantly greater than the available statistics suggest. To have a better understanding of medical device security, the bad-news diode must be shorted. Reporting must be incentivized rather than penalized.If you watch television crime dramas, you may be duped into thinking that hacking of medical devices is the number-one risk for public health today. You would be wrong. The most pressing risks are much less sexy: the unavailability of patient care and the lack of health data integrity. Here, we highlight a few examples that illustrate the consequences of unavailability and lack of integrity.Interventional radiology suites and cardiac catheterization labs contain a number of computer systems to perform time-sensitive cardiac procedures, such as angioplasty, to open blocked arteries for improved outcomes in patients suffering acute heart attacks or strokes.According to The Wall Street Journal,2 a Department of Veterans Affairs (VA) catheterization laboratory in New Jersey was temporarily closed in January 2010. Malware had infected the computer systems. The consequence? Patients do not receive the safe and effective care they deserve when malware causes unavailability of care. The VA has experienced hundreds of malware infections in medical devices such as X-ray machines and lab equipment made by well-known, reputable companies.Conficker was detected on 104 devices at the James A. Haley Veterans Hospital in Tampa.2 The affected devices included an X-ray machine, mammography, and a gamma camera for nuclear medicine studies. Conficker is a relatively old piece of malware with well-known mitigation strategies. Why does old malware persist on medical devices?We observe that one of the cultural challenges to improved cybersecurity and t herefore safety and effectiveness is a lifecycle mismatch. For instance, operating system software with production lifecycles measured in months does not match well with a medical device having production lifecycles measured in years or decades. The equivalent of a transformer for impedance matching does not yet exist for safely connecting these different production cultures.Risks of depending on unsupported software has parallels to depending on a device where parts are no longer manufactured or repaired. Medical devices still rely on the original versions of Windows XP (circa 2001). In October 2012, the Beth Israel Deaconess Medical Center in Boston reported to the NIST Information Security and Privacy Advisory Board that the hospital depends on 664 Windows-based medical devices primarily because of supply chain issues. Of the 664 computers, 600 devices run the original version of Windows XP. There are no Service Pack 1 (SP1) machines, but there are 15 SP2 machines and 1 SP3 machine. One MRI machine still runs Windows 95. Security support for SP1, SP2, and SP3 ended on October 10, 2006, July 13, 2010, and April 14, 2014, respectively. In many cases, a medical device manufacturer does not provide an effective way for hospitals to upgrade to supported versions of operating systems. Today, healthcare providers are told to maintain a secure system from insecure devices.4A medical device infected with malware can stray from its expected behavior. For instance, malware can cause a device to slow down and miss critical interrupts. When this happened on a high-risk pregnancy monitor, healthcare professionals could no longer trust the integrity of the sensor readings and depended on backup methods.5Antivirus software can help mitigate certain cybersecurity risks, but they also introduce their own risks. On April 21, 2010, a third of the hospitals in Rhode Island were forced to "postpone elective surgeries and stop treating patients without traumas in emergency rooms" because an automated antivirus software update had accidentally misclassified a critical Windows DLL as malicious. The problem with antivirus software is that by definition, antivirus software is a postmarket afterthought to make up for design flaws in the device. Antivirus software does not remove the need to incorporate security into the early design of medical devices.According to the FDA mission statement, the agency holds responsibility for protecting public health by assuring the safety, efficacy, and security of medical devices. In June of this year, the FDA issued draft guidance on cybersecurity6 and gave examples of what FDA reviewers would expect to see during premarket review. The draft guidance intentionally does not prescribe any particular approach or technology but instead recommends that manufacturers consider cybersecurity starting at the concept phase of the medical device.The FDA recommends that manufacturers provide:Standards bodies are taking actions to improve medical device cybersecurity. For instance, the Association for the Advancement of Medical Instrumentation (AAMI) recently formed a working group on medical device security that includes engineers from manufacturing and regulators. AAMI has already released standards specific to network-related cybersecurity risks (ANSI/AAMI/IEC-80001). International harmonization of cybersecurity guidance is likely on the horizon, given that phrases such as "security patches" appear in proposals from the International Medical Device Regulators Forum.Modern healthcare delivery depends on medical device software to help patients lead more normal and healthy lives. Medical device security problems are real, but the focus on hacking goes only skin deep. Consequences of diminished integrity and availability caused by untargeted malware include the inability to deliver timely and effective patient care. By addressing security and privacy risks at the concept phase, medical devices can remain safe and effective despite the cybersecurity threats endemic to computing. Security of medical devices is more than just a potential problem on the horizon.This work was supported in part by NFS CNS-1331652 and HHS 90TR0003/01. Any opinions, findings, and conclusions expressed in this material are those of the authors and do not necessarily reflect the views of NSF or HHS.

Cybersecurity vulnerabilities of cardiac implantable electronic devices: Communication strategies for clinicians—Proceedings of the Heart Rhythm Society's Leadership Summit

Ethics committee approval processes in development of medical devices begin with request to obtain CE certificate of medical devices that are classified under the Medical Device Directive. In accordance with the Medical Devices Clinical Research Directive, it is necessary to obtain the approval to test on volunteers with medical devices, which is non-CE marked or similar devices that are not found in international market, from the Turkish Medicines and Medical Devices Agency. In this study, in order to obtain the ethics committee approval from the authorized institution, the required documents on ethics committee submission process have been described in bullets and also explained the contents of these documents by importance. It is intended to be a tutorial guide for medical device developers.

Artificial intelligence (AI) and machine-learning (ML) technologies are increasingly being incorporated into orthopaedic medical devices, offering the potential to enhance surgical planning, intraoperative precision, and personalized care. The incorporation of AI into medical devices introduces unique risks and challenges that traditional regulatory pathways in the United States and European Union (EU) were not designed to address. Although the EU Artificial Intelligence Act is currently being implemented to provide a specific framework for AI medical device assessment, no equivalent directive exists in the United States. In consideration of these evolving regulatory contexts, this study sought to address the following questions related to FDA-approved, AI/ML-enabled orthopaedic devices: (1) How often are FDA-approved, AI/ML-enabled orthopaedic devices also approved under the EU Medical Device Regulation (MDR)? (2) How often are AI/ML-enabled orthopaedic devices approved through the FDA 510(k) pathway using non-AI predicate devices? (3) How often do approved AI/ML-enabled orthopaedic devices have independent, peer-reviewed evidence supporting their use? (4) How often are the details of the training and validation datasets of these devices disclosed in publicly available regulatory documents? A total of 37 AI/ML-enabled orthopaedic device approvals were identified from the FDA's list of 1017 AI/ML-enabled medical devices as of May 2025. Regulatory documents were analyzed to identify training and validation data sets and predicate devices. A predicate device is an existing legally marketed device that the FDA has previously approved; a manufacturer may claim that a new device is "substantially equivalent" to this approved device to obtain clearance through the 510(k) pathway. The availability of devices in the EU was assessed through the publicly available European Database on Medical Devices (EUDAMED) database and manufacturer websites. A systematic review of PubMed and manufacturer websites identified peer-reviewed evidence for each device. Our results showed that 38% (14 of 37) of AI/ML-enabled orthopaedic devices were approved for use in the EU, and devices were more frequently available in the United States first. All AI/ML-enabled orthopaedic devices approved by the FDA received regulatory clearance through the 510(k) pathway; most devices (62% [23 of 37]) were approved based on substantial equivalence to non-AI enabled devices. Independent peer-reviewed evidence was identified for 30% (11 of 37) of devices, with 67% (34 of 51) of published studies reporting manufacturer involvement. Information on training and validation datasets was disclosed in 57% (21 of 37) of 510(k) summaries, with dataset sizes ranging from 21 to 150,000 for training and 20 to 29,991 for validation. AI/ML-enabled orthopaedic devices have entered the market under existing regulatory frameworks in the United States and, at a slower pace, in the EU. Reliance on non-AI comparators and limited postmarket evaluation raises concerns regarding their long-term clinical reliability. As the level of patient risk under the current regulatory pathways remains uncertain, future research should compare AI/ML-enabled device recall rates across jurisdictions to assess whether AI-specific regulatory frameworks improve patient safety and device reliability.

IN THE MIDST OF A RANCOROUS ELECTION YEAR, BIPARTIsan accord in Congress is infrequent. A notable exception is the broad agreement on the US Food and Drug Administration (FDA) Safety and Innovation Act, approved by overwhelming majorities in the House of Representatives and the Senate, and signed into law by President Barack Obama in July 2012. Effective October 1, 2012, the legislation reauthorizes for 5 years the collection of user fees from industry for the reviews of prescription drugs and medical devices and establishes new user fee programs for generic drugs and “biosimilar” biological products. For years, the FDA has been a lightning rod for strong criticism from across the political and ideological spectrums, from members of Congress, industry officials, advocacy groups, the news media, and even its own employees. But the legislation was not a battlefield for settling these scores. The broad support reflects a wide recognition of the importance of the reviews of drugs, medical devices, and other products that represent the foundation of the nation’s regulatory system. Neither patient and consumer groups nor industry believe that the funding of product reviews through user fees is the best approach for the agency. The budget reality, however, is that if the FDA is to have sufficient resources to fulfill its public health and regulatory missions, it will require revenue from user fees indefinitely. Every 5 years, Congress reauthorizes the collection of user fees for drugs and medical devices, and considers additional provisions that might be included in the legislation. The FDA’s budget for fiscal year (FY) 2013, which started on October 1, 2012, is not yet known. Regardless of the final budget, fees from industry will represent a substantial and increasing share of all FDA spending. In FY 2012, Congress appropriated about $2.5 billion for the FDA. In FY 2013, the agency is expected to collect approximately an additional $1.7 billion in fees from industry, not just for the review of drugs and medical devices, but also for the regulation of food, tobacco, and additional products as authorized in other legislation (TABLE). If Congress were to appropriate the same amount for the FDA in FY 2013 as it did in FY 2012, then fees from industry would account for nearly 40% of the agency’s approximately $4.2 billion of spending. Congress first authorized the collection of prescription drug user fees in 1992 and has reauthorized the collection of these fees 4 times. During the last 2 decades, the number of scientific staff at the agency has increased, and the median approval times for drug applications have decreased markedly. Approval times for drugs the FDA views as priority have decreased from an average of 2 years to 1.1 years. Medical device user fees were first authorized in 2002 and have been reauthorized twice since then. Under the 2012 act, medical device user fees will increase and more companies will have to pay them, allowing the FDA to hire additional scientists and decrease review times. In 2011, approximately 4 of every 5 outpatient prescriptions in the United States were filled with generic drugs. The new user fees for generic drugs will provide the agency with the resources to eliminate a backlog of more than 2500 applications for drug approvals. The FDA will also be able to inspect foreign generic drug manufacturing facilities more often, so that they can be held to the same standards and inspection frequencies as domestic facilities. Other provisions of the act will broadly affect the FDA’s work in protecting the safety and quality of the drug supply chain, preventing drug shortages, encouraging the development of innovative antibiotics for serious or lifethreatening infections, and additional areas. The agency will gain authorities to register, regulate, and conduct riskbased inspections of foreign drug manufacturing facilities, where the majority of medications sold in the United States are produced. Authorities over foreign facilities that manufacture medical devices will be similarly strengthened. The FDA will have more authority to require companies to notify it about anticipated drug shortages and will gain the authority to mandate reporting of shortages of biological products. As an incentive for the development of innovative antibiotics, the FDA will be able to grant manufacturers of new qualified infectious disease products an additional 5 years of market exclusivity. By July 2014, the act also requires the FDA to issue longawaited guidance on Internet promotion of FDA-regulated medical products, including the use of social media. The Best Pharmaceuticals for Children Act and the Pediatric Research Equity Act have improved the agency’s ability to meet the medical needs of children. The acts, which had been subject to reauthorization every 5 years, are made permanent.

Making sense of the Food and Drug Administration

Human factors in the design of medical devices – Approaches to meeting international standards in the European Union and USA

This chapter focuses on emerging opportunities and related challenges associated with medical device development. In a rapidly changing healthcare environment and related support structure, it has become essential to develop products and technologies that are not only innovative and affordable, but at the same time, safe and reliable for long-term performance stability. With the advancement of efficient computational platforms and artificial intelligence, newer opportunities in the form of software-driven medical devices and robotic minimally invasive surgical systems have emerged as key thrust areas in medical device manufacturing sector. A lot of research outcomes are being reported worldwide for development of haptic feedback-based robotic manipulators for complex surgical procedures. Leading industry manufacturers are focusing on transdisciplinary synergetic research for faster product development and subsequent market deployment. However, such medical cyber-physical systems have also brought out the need for ensuring product safety and data security for uncompromised privacy and process integrity. There are other challenges related to validation, certification and regulations of healthcare-related mobile applications and software-driven diagnostic and therapeutic tools which need to be handled with highest priority for patient safety. The chapter focuses on the AI-powered and software-driven medical devices as well as various technologies of robotic surgery and the associated research opportunities and challenges in these domains.KeywordsSoftware-driven medical devicesRoboticsMedical regulationsMedical cyber-physical systemsValidation

Stimulated by regulations and standards as well as commercial imperatives, medical device manufacturers are striving to make medical devices safer by decreasing the potential for harmful use errors. Accordingly, manufacturers are observing and interviewing intended users about their interactions with devices en route to developing user interface requirements; applying human factors engineering (HFE) principles when designing user interfaces; and conducting formative and summative usability tests to improve and validate their devices’ interactive quality. This has represented significant work for manufacturers, particularly the majority who started with little HFE knowledge and experience. Today, the “awakening” to HFE in medical device development is essentially over—an established manufacturer who is just now discovering HFE has been out of touch. After all, the U.S. Food and Drug Administration (FDA) and AAMI conducted their first joint conference on HFE in 1995 when they previewed HFE expectations related to recent changes in quality system regulation (QSR). So, it has been 17 years since HFE entered the medical industry’s zeitgeist. HFE specialists working in the medical industry used to focus on making devices more usable (i.e., user friendly). Since the QSR change, use safety has become the primary focus, resulting in user interfaces that are less vulnerable to harmful use errors. It is rather obvious how HFE affects the safety of some medical devices. In the design of a surgical instrument, for example, HFE’s aim would be to reduce the chance of cutting anything other than the intended target. This goal could be accomplished by including a blade guard and a mechanical interlock that requires more than one deliberate action to enable cutting.

This paper outlines how the goals, practices and capability levels for the configuration management (CM) process area within a software process improvement (SPI) framework have been developed. This framework addresses an opportunity to integrate the regulatory issues and SPI mechanisms so as to achieve improvements that are critical to the development of software for medical devices [1]. Software is becoming an increasingly important aspect of medical devices and medical device regulation. Medical devices can only be marketed if compliance and approval from the appropriate regulatory bodies of the Food and Drug Administration (FDA) [2] (US requirement), and the European Commission under its Medical Device Directives (MDD) [3] (CE marking requirement) is achieved. Integrated into the design process of medical devices, is the requirement of the production and maintenance of a device technical file, incorporating a design history file. Design history illustrates the well documented, defined and controlled processes and outputs, undertaken in the development of medical devices and for our particular consideration with this framework - the software components.

Chapter 9 - Regulatory Perspectives for 3D Printing in Hospitals

Continual learning in medical devices: FDA's action plan and beyond

Demand for health products in Indonesia is increasing, with an estimated annual growth of 11.9% until 2024. This is driven by population growth and public awareness of the importance of health. Indonesian government believes developing medical devices industry is essential in supporting health resilience in Indonesia. The development and marketing of medical devices does not only focus on the benefits of a product but requires planning and control so that the product can be safe and effective for users, such as by paying attention to quality standardization, patient safety, regulation, and market licensing. This exploratory qualitative research approach yields results in the form of patterns that can increase the availability of safe and quality medical devices, namely 1) research and development of medical devices, 2) regulation of medical devices, 3) assessment of medical devices (health technology evaluation), and 4) management of medical devices (health technology management). The results of this trial will provide valuable information on the process of developing medical device products to choose an approach that suits your needs and conditions.

The development of medical devices currently faces several challenges, like the urgent need for new products in a pandemic situation and the release of a new regulatory framework for medical devices in the European Union, which shall ensure the safety and effectiveness of newly developed medical devices. At the same time, the desire for smart, user-friendly products is growing. These can be realized through agile and flexible process models. Based on agile values and the integration of customer feedback, this need can be achieved in iterative development cycles. What at first sight does not seem to be combinable, however, be well integrated into the regulated area of medical technology through the targeted use of agile processes and the adaptation of individual steps. This paper presents a framework for the integration of Scrum into the regulated design control process for medical devices. This framework facilitates flexible product development of smart medical devices.

Background: The integration of medical devices with artificial intelligence (AI) software is rapidly advancing as technology progresses. AI machine learning can be used in commercial medical services to generate practical data; there is evidence that it can be integrated into newly developed devices. However, such devices must undergo approval, regulation, and supervision. The Food and Drug Administration approves regulations for numerous machine-learning medical devices and shares open lists with the public. In this article, we examine recent medical AI devices in different fields, including the diagnosis of colorectal polyps.Current Concepts: Currently, in the field of gastroenterology, there has been a significant amount of research aimed at enhancing adenoma detection rates using tools powered by AI, such as the EndoScreener and GI Genius. Various such devices have also been developed for other fields; examples include the 23andMe Personal Genome Service for DNA detection, Spectral MD’s DeepView platform for wound imaging in surgery, Gili Pro BioSensor for monitoring vital signs, DreaMed Advisor Pro for diabetes, Minuteful for urinary analysis, BrainScope TBI for cerebral diagnosis, Compumedics Sleep Monitoring System for sleep disorders, Idx-DR v2.3 for ophthalmology, and EarliPoint system for pediatrics.Discussion and Conclusion: By the time this article is published, it is likely that even more AI medical devices will have been approved and commercialized. The development of such devices should be strongly encouraged. Additionally, we anticipate greater involvement from practitioners in the development and validation of diverse medical AI devices in Korea.