Thank you for Subscribing to Med Tech Business Review Weekly Brief
Medtech Business Review | Monday, August 08, 2022
The new EU Medical Device and IVD Regulations will encourage product designers to create more secure products, and to prevent cyberattacks on digital health systems and devices.
FREMONT, CA: Greater interconnection and increasing digitization have witnessed an escalating number of destructive cyber activities all over the world. The European Commission has introduced new cybersecurity legislation and regulations that will have an impact on the medtech sector in response to these growing threats. The new legislation includes medium and larger entities from industries that are important to the economy and society. Manufacturers of medical devices and in vitro diagnostic instruments are now included in the NIS 2 Directive's expanded scope (IVDs).
Network and Information Systems (NIS 2) segregates businesses into two categories: 'essential' entities and 'important' entities. Medical device and IVD manufacturers are classified as 'important' entities. The Directive also classifies as 'essential' businesses that manufacture medical devices that are considered critical during a public health emergency.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Each of the two categories is subject to a different regulatory regime. "Important" businesses are not required to consistently record their compliance with cybersecurity measures, and the competent authorities will only take action if evidence of a possible violation of the Directive is brought to their attention. Nonetheless, NIS 2 envisions greater proactive oversight for "important" companies, including the need for competent authorities to conduct on-site inspections, off-site supervision, as well as focused security audits and scans.
Further requirements apply to both 'essential' and 'important' entities, including:
• Thorough risk management procedures including companies across the whole supply chain;
• Senior management responsibilities, such as the requirement to supervise the implementation of the risk management procedures for cybersecurity; and
• Reporting cybersecurity incidents in a certain amount of time.
Medtech businesses should be familiar with the Cyber Resilience Act (CRA). IVDs and medical devices are not included in the proposed legislation at this time. However, the European Data Protection Supervisor (EDPS) has pushed for the scope to be broadened to include them under its regulations. In an opinion released in November of last year, the EDPS notes that while the Medical Devices Regulation (MDR) introduces a requirement to establish, implement, document and maintain a risk management system, it is not clear if it will also cover cybersecurity and data protection-related issues. The EDPS also claims that the MDR's security provisions are not always as detailed and concrete as the ones in CRA.
As Europe's medical device industry continues to grow and develop, EU decision-makers are looking to issue new regulations to ensure European patients' safety while preserving the sector's innovation. With the NIS 2 Directive imposing additional cybersecurity measures for the medtech industry in addition to those introduced by the MDR and the upcoming CRA, one thing is clear: policy monitoring and close engagement with decision-makers are now more vital than ever for medtech businesses to ensure they are fully compliant with the law and that legislation is fit for purpose.
More in News