Industry lobbyists say FDA's recommendation for companies to join Information Sharing and Analysis Organizations is ambiguous and could have serious legal ramifications. Besides asking for clarification about what constitutes an ISAO, industry groups are calling for the agency to give companies more leeway to deal with potential cybersecurity vulnerabilities.

The comments come in response to FDA's postmarket cybersecurity draft guidance issued earlier this year. (See [A#01160125004].) It is intended to complement a premarket cybersecurity guidance finalized in 2014. (See [A#01141006014].) According to the agency, it has received at least 54 comments in response to the postmarket draft guidance from a wide range of stakeholders, including device industry lobbyists, who have focused attention on ISAOs and the agency's use of the term "essential clinical performance," among a handful of other issues.

FDA says in the draft guidance that, for the most part, it does not intend to enforce urgent reporting of potential cybersecurity vulnerabilities if the manufacturer meets certain requirements, including participation in an ISAO.

FDA puts a lot of emphasis on forming Information Sharing and Analysis Organizations in its guidance, but does not define the organizations well enough, industry says.

"For a small subset of cybersecurity vulnerabilities and exploits that may compromise the essential clinical performance of a device and present a reasonable probability of serious adverse health consequences or death, the FDA would require medical device manufacturers to notify the agency," the draft guidance states.

Detail On ISAOs Lacking

According to FDA, ISAOs are intended to bring together the necessary expertise to tackle cybersecurity threats. ISAO members should have the ability to react to potential vulnerabilities, ideally in real time, and be able to share "protected critical infrastructure information" so it is exempt from certain legal transparency tools such as Freedom of Information Act requests and "sunshine" laws.

But industry groups including AdvaMed say ISAO's are not defined well enough in the agency's guidance.

"Additional information would also be helpful with respect to how FDA intends to: (1) Participate in an ISAO, (2) determine that a particular ISAO is acceptable for participation by a medical device manufacturer, and (3) the role of the ISAO and its responsibilities," the lobby group said in comments to FDA.

AdvaMed said ISAOs also should not be the only type of organizations FDA deems capable of bringing together stakeholders to deal with medical device cybersecurity risks. Similar organizations that "provide comparable benefits" should also be acceptable to the agency, the group noted.

The Medical Imaging & Technology Alliance said FDA should reconsider the requirements for when the agency does not intend to enforce urgent reporting of potential cybersecurity vulnerabilities, including the need to join ISAOs. The groups says there are still a lot of unanswered questions surrounding the organizations with regards to how they will be established, what criteria they will use to report findings, who has access to the reported information, what legal protections members have and other matters. MITA also noted that other countries have similar organizations to ISAOs, and asked FDA if membership in those organizations would be sufficient to meet its requirement.

The 510(k) Coalition, another industry group, also raised concerns with ISAOs and urged FDA to consider holding the organizations accountable via a process where they may be endorsed, certified or required to undergo a security audit program.

"We strongly recommend that the FDA establish clear minimum criteria, governance systems and voluntary standards or guidelines for the creation and functioning of ISAOs, clarification on how the Agency intends ISAO members to collaborate, and ensure that manufacturer information shared is appropriately safeguarded," said the group. "Members of the Coalition and other industry stakeholders are happy to work with the FDA toward establishing reasonable criteria, standards, and/or guidelines for ISAOs."

On the other side of the issue, some stakeholders are concerned ISAOs could give manufacturers too much cover from transparency and accountability.

Plaintiffs' attorneys say FDA's ISAO policy could shield manufacturers in civil litigations where patients who may have been harmed by a medical device's cybersecurity flaw could not obtain the information needed to use in court.

The American Association for Justice, the advocacy group for plaintiffs' attorneys, is concerned that FDA's guidance merely provides suggestions for manufacturers, but doesn't have the teeth to hold them accountable. ISAOs are of "particular concern," AAJ says.

"While ISAOs are intended to be transparent, the information gathered is shielded from any release required by the Freedom of Information Act (FOIA), state sunshine laws, regulatory use and use in civil litigation," the group said. "Indeed, some restrictions on the disclosure of information, like proprietary information or confidential patient data, shared among participants may be appropriate. However, the scope of the protection afforded by the guidance is highly vulnerable to abuse."

The group says FDA's policy could shield manufacturers in civil litigations where patients who may have been harmed by a device's cybersecurity flaw could not obtain the information needed to use in court.

Eliminating 'Essential Clinical Performance'

Manufacturers are also especially concerned with FDA's use of the term "essential clinical performance" as the standard by which the need for notifications to the agency on cybersecurity issues will be judged. Groups argued that the term essentially creates a new regulatory requirement that is already covered by established safety regulations.

AdvaMed and the 510(k) Coalition asked FDA to eliminate the term "essential clinical performance."

Both groups state FDA has not used the term in the past and its use now could cause confusion among its members. Instead, they recommend that the guidance focus on maintaining device functionality and safety, consistent with the premarket medical device cybersecurity guidance.

"The concept of 'essential clinical performance' is much easier to define in a simple case, such as a medical device with one intended use and minimal connectivity; however, it does not work in more complex situations and environments, such as an in vitro diagnostic analyzer that may run 300 or 400 different assays or a device with multiple intended uses," the 510(k) Coalition states. "Defining essential clinical performance in that situation would be incredibly difficult, and could lead to unintended consequences (such as reporting of all vulnerabilities, regardless of risk)."

MITA, however, does not ask FDA to remove the "essential clinical performance" phrase outright from the guidance, but instead urges the agency to further clarify the terms so that manufacturers understand how it aligns with the previously established definition for safety risk management regulations under IEC 60601-1.

IEC 60601-1 is one of the International Electrotechnical Commission's family of standards for medical electrical equipment safety and performance.

"The IEC definition is clearly linked to safety risk management per ISO 14971 to determine those characteristics required for safe and effective use," said the group. "The new and slightly different definition in the draft guidance could cause confusion, appearing to require the establishment of a new safety risk management process in parallel with existing processes. We request that the link between these documents and the draft guidance be clarified."

A standard from the International Organization for Standardization, ISO 14971 aids firms in setting up a risk management program.

AdvaMed echoed MITA's thoughts, stating if FDA keeps the phrase "essential clinical performance," the agency should revise the definition so it is consistent with IEC 60601-1.

*Follow Ferdous Al-Faruque @alfaruque

Companies Nervous About 'Sharing' Organizations Touted In FDA Cyber Guidance

More from Legal & IP

More from Policy & Regulation