The Food and Drug Administration released a “playbook” Monday to help hospitals and other facilities handle potential cyberattacks on medical devices.
The agency announced the playbook on Monday along with two agreements with manufacturers to share information about possible vulnerabilities of medical devices. The playbook and agreements are part of an action plan the agency laid out in April to prevent cyberattacks on devices that could be hacked remotely and shut down.
“The FDA isn’t aware of any reports of an unauthorized user exploiting a cybersecurity vulnerability in a medical device that is in use by a patient,” FDA Commissioner Scott Gottlieb said on Monday in a statement. “But the risk of such an attack persists.”
There have been instances, though, of cybersecurity researchers finding vulnerabilities in medical devices. For instance, researchers have said that older devices like MRI machines or infusion pumps are vulnerable to attacks, such as a lethal dose of a medication from an infusion pump, according to a report in New York magazine.
The FDA's playbook describes the types of “readiness activities” that hospitals and other healthcare facilities can do to prepare for a cyberattack on medical devices, such as developing inventories of devices and conducting training exercises.
Cybersecurity has risen as a top priority for hospitals in recent years, especially after the major WannaCry attacks in May 2017. The worldwide attack targeted computers with Windows and infected them with ransomware, which blocks access to a computer unless a “ransom” is paid.
Hospitals in England were among those targeted by the WannaCry attack.