FDA provides guidance on addressing cybersecurity threats to medical devices

The FDA released a draft guidance to notify the industry and FDA staff about its recommendations for dealing with postmarket cybersecurity vulnerabilities for marketed medical devices. The draft guidance, which was announced in an advance release, provides specific recommendations for manufacturers but also encourages them to address cybersecurity issues throughout the entire lifecycles of their products.

Networked devices

An increasing number of medical devices are designed so that they can be networked to assist with patient care. Such networked devices, like any networked computer system, use software that can be vulnerable to cybersecurity threats, which can present a risk to the safety and effectiveness of the devices. Therefore, manufacturers should take a proactive approach to addressing cybersecurity risks in medical devices to reduce the risks to patient safety and public health.

Postmarket recommendations

The draft guidance contains the FDA’s postmarket recommendations and emphasizes that manufactures should monitor and address any cybersecurity vulnerabilities as part of their postmarket management of medical devices. In most cases, the manufacturers will be performing routine updates or patches, which would not require advance notification to the FDA or reporting under 21 C.F.R. part 806. However, for cybersecurity vulnerabilities that could compromise a device’s essential clinical performance and present a probability of serious adverse health consequences or death, the manufacturers would be required to notify the FDA (21 C.F.R. Sec. 806.10).

Proactive approach

The FDA believes that the public and private stakeholders must collaborate to use available resources and tools to assess risks and identify vulnerabilities in medical devices so as to mitigate cybersecurity threats. It recommends that manufacturers take a proactive, risk-based approach for the postmarket phases of medical devices, which includes cybersecurity information sharing, “good cyber hygiene” or routine device cyber maintenance, postmarket information assessments, vulnerability identification, and timely implementation of necessary risk mitigation actions.


The draft guidance applies to medical devices that contain software, including firmware or programmable logic. It also applies to software that is a medical device. However, the guidance does not apply to experimental or investigational medical devices.

Electric shock device to treat mental illness reduced to medium risk

The FDA has proposed reclassification of the electroconvulsive therapy (ECT) device for use in treating severe major depressive episode (MDE) associated with major depressive disorder (MDD) or bipolar disorder (BPD) in patients 18 years of age and older. The proposed use would be limited to patients who are treatment-resistant or who require a rapid response due to the severity of their psychiatric or medical condition.

The ECT device is used to induce a major motor seizure in the patient by applying a brief intense electrical current to the patient’s head. Under the proposed order, the device would be reclassified based on the availability of new clinical literature from Class III (highest risk–premarket approval) to Class II (medium risk) with certain special control requirements. The reclassification, however, would not exempt the device from the necessity of filing a premarket notification (510(k)) submission prior to marketing.

Regulatory background

In 1979, the FDA decided to classify the ECT device into Class III, rather than Class II, after several Neurological Device Classification Panel members expressed doubt that the characteristics of the device had been identified precisely enough such that special controls could be established providing reasonable assurance of safety and effectiveness (44 FR 51776, September 4, 1979).

Clinical evidence

In 2009, the FDA opened a public docket to receive information regarding classification of the device (74 FR 46607, September 10, 2009) and received over 3,000 submissions, with the majority of respondents (80 percent) opposing reclassification. The majority of those opposing reclassification cited adverse events from ECT treatment, such as memory loss, brain damage, and death.

The FDA’s review of new clinical literature submitted was summarized in the Executive Summary to the January 27-28, 2011, Neurological Device Panel meeting to discuss ECT classification. The Panel transcript and other meeting materials are available on FDA’s website. Based on this review, FDA concluded that the ECT device demonstrated effectiveness in the acute phase (less than 3 months after treatment).

Panel members, however, indicated that controlled clinical trials are lacking regarding the effectiveness of ECT beyond the acute phase (e.g. long-term effectiveness), in part, due to the fact that many patients have an initial improvement in the depressive symptoms following an acute course of ECT and are able to return to other treatments for managing depression, such as medications and psychotherapy. The FDA examined the results of over 60 randomized controlled clinical trials comparing ECT with either placebo (sham) or antidepressant therapy. The FDA also examined other conditions, including bipolar mania, schizophrenia, schizoaffective disorder, schizophreniform disorder, and catatonia, but there were insufficient clinical data to support effectiveness for these conditions. The ECT device will remain in Class III to be approved for these uses.

The recommended reclassification is limited to patients 18 years of age and older because data on the use of ECT in children and adolescents is limited. Most of the published literature FDA is aware of and reviewed focused on subject populations that did not receive benefit from prior treatments; therefore, the recommended reclassification is limited to treatment resistant populations as well as those patients who require a rapid response due to the severity of their psychiatric or medical condition. Further, practice guidelines published by the American Psychological Association task force on ECT and the National Institute for Health and Clinical Excellence in the United Kingdom recommend that ECT be considered for primary use (i.e., prior to medications) when there is a need for rapid, definitive response due to the severity of a psychiatric or medical condition.


According to the clinical evidence, while medical and physical risks may occur with ECT, they vary in frequency, with the most severe risks being quite rare. Death associated with ECT appears to occur at a very low rate comparable to that of minor surgical procedures. In fact, recent estimates of the mortality rate associated with ECT treatment are one per 10,000 patients or one per 80,000 treatments.

The risks of greatest concern to clinicians and patients remain cognitive and memory impairment. Both the FDA review of literature and the meta-analyses of the randomized controlled studies indicate that while post-procedure disorientation occurs frequently, it is transient, typically resolving within minutes after the procedure is complete.

Several of the risks associated with ECT, including adverse reaction to anesthetic agents/neuromuscular blocking agents, cardiovascular complications, death, and pulmonary complications, are medical/physical risks related to the use of the device. For these risks, safe use of the device is based on appropriate directions for use. FDA believes that labeling provisions are adequate to mitigate these risks.

Finally, the risks of skin burns can be mitigated by performance testing of the device to demonstrate safe electrical performance, adhesive integrity, and physical and chemical stability of the stimulation electrodes.

Draft guidance

The FDA has also announced the availability of a draft guidance document entitled “Electroconvulsive Therapy (ECT) Devices for Class II Intended Uses,” that, when finalized, would provide recommendations for 510(k) submissions on how to comply with the special controls. Comments on the proposed order and the draft guidance must be submitted by March 28, 2016.

Small, wearable dialysis machine crawls closer to working model

A much easier way to deliver dialysis treatments, and on a continuous basis, was just tested in a small trial. Although this small wearable device needs much more tweaking before it is ready for prime time, Dr. Victor Gura and his colleagues hope that his Wearable Artificial Kidney (WAK) will be available for use within two years. Gura’s efforts to create the WAK began due to his frustration with the lack of advancement in dialysis treatments in decades.

The WAK, in development for several years already, allows blood to be filtered continuously, just like a regular kidney. Currently, dialysis patients must remain hooked up to dialysis machines a few times a week for several hours. In the latest trial (which has not yet been published in a peer-reviewed journal), patients wore the device for 24 hours and were encouraged to eat foods that were banned before. Patients with end-stage kidney disease must avoid foods like bananas, orange juice, and ice cream which can cause vitamins and minerals to build up to dangerous levels.

Unfortunately, two of the machines suffered technical failures and had to be removed before the 24 hours was up. Leslie Spry, a spokesman for the National Kidney Foundation and the medical director for the Dialysis Center of Lincoln, remains skeptical about the device. He believes that the biggest challenge will be reliability, and plans to hold onto his doubts until patients can be stabilized for a week or two at a time. Spry is also concerned about the possibility of infection.

In addition to the technical issues, Gura has assigned himself the task of trying to reduce the weight of the machine by half, from 10 to five pounds. The WAK is worn on a belt and connects to the body through a catheter. Once a week, the WAK would need to be removed from the catheter in order to replace the filter, which separates water, salts, and minerals from the blood. Patients would also be required to add chemicals to the machine once a day to purify the filtered water.

End-stage renal disease and Medicare

End-stage renal disease (ESRD) is permanent kidney failure, requiring patients to undergo dialysis or seek a transplant. ESRD is commonly caused by hypertension or diabetes. As expected, these dialysis treatments are expensive. Many who suffer from this condition are covered by Medicare, and CMS has created specific provisions for coverage of dialysis and related services. For example, sometimes patients require non-emergency, scheduled, repetitive transportation by ambulance to their dialysis appointments. Sometimes, Part B covers self-dialysis training for at-home treatment and self-dialysis equipment and supplies, as well as support services from a local dialysis facility.

All ESRD patients with Part A and/or Part B coverage are eligible. However, patients are responsible for 20 percent of the approved amount for each treatment either in a facility or at home. According to the U.S. Renal Data System’s 2015 Annual Data Report, Medicare fee-for-service (FFS) expenditures on ESRD beneficiaries rose by $500 million between 2012 and 2013. The report pointed out that the amount of ESRD beneficiaries is less than 1 percent of the Medicare population, but spending for these patients accounts for just over 7 percent of FFS costs.

CMS created the ESRD prospective payment system (PPS) effective January 2011 to establish payment for dialysis facilities for up to three treatments per week per patient unless a medical reason justifies the patient’s need for more. CMS updates the base rate annually and accounts for case-mix adjustments, facility-level adjustments, training adjustments, and an outlier payment. The ESRD PPS also created consolidated billing for Part B items and services that are not separately payable when offered by providers other than the dialysis facility.

American Medical Association calling for an end to direct-to-consumer drug advertising

The American Medical Association (AMA) has taken an interesting policy stance in an effort to promote affordable treatment options. In an interim meeting held November 17, 2015, the AMA voted to support a ban on direct consumer advertising of drugs and medical devices. The physicians believe that these advertisements are causing patients to push for more expensive treatments while cheaper, effective alternatives are available.

Consumer advertising

The U.S. is one of two countries in the world that permits direct consumer advertising of drugs, the other being New Zealand. According to the World Health Organization (WHO),  the practice became much more popular in 1997 after the FDA loosened the requirement for manufacturers to provide a list of side-effects in infomercials. Companies attempted to push for more advertising opportunities in Europe, but the European Union countries strongly opposed the section of new legislation that would allow companies to provide more information directly to patients through the internet and specialist publications.

A study published in 2003 compared prescribing decisions in the U.S. with decisions in Canada and how those decisions were impacted by consumer advertising. Patients were surveyed before primary care appointments on how much advertising they had been exposed to, while physicians were surveyed after their appointments to find out how many patients requested an advertised medicine and how many prescriptions were written in response to patient request. The survey also asked physicians to measure their confidence in the treatment choice and whether the physician would have prescribed the same drug to another patient with the same diagnosis. The study’s results indicated that those exposed to more advertising are more likely to request those medications, which leads to more prescriptions written even if the physicians are not confident about the treatment.

A long debate

Despite the fact that advertisements are overseen by the FDA for truth and accuracy, the practice has been debated for years.  In 2008, Time approached the topic after it received some scrutiny in a House of Representatives hearing. The article stated that drug ads often leave viewers confused about the information that they saw. This assertion was supported with notes from a New England Journal of Medicine article that pointed out the ease with which a medical device advertisement glossed over information that is still being debated by specialists. Time analyzed how ads are created, with an emphasis on the drug’s benefits at the beginning and end of a commercial when they are more likely to be remembered with side effect information squeezed in the middle. Ads often speed up the voice over when listing side effects, which caused viewers to be less likely to remember them when tested than for ads that maintained a constant voice over speed.

Why the opposition?

The AMA believes that skyrocketing drug prices are affecting physicians’ ability to properly care for patients, such as when there are limitations on their health insurance plans or out-of-pocket prices are unaffordable. The association points to marketing as one of the reasons for the increase in prices, with pharmaceutical companies spending billions of dollars to advertise their drugs in hopes that patients will request them specifically. The new policy urges federal limitations on anticompetitive behavior among pharmaceutical companies that try to sway business away from generic manufacturers, as well as patent reform. The AMA believes that transparency of prescription drug pricing will benefit patients and physicians.