These threats can be either unintentional, such as  interference from energy generated by other devices or from the  surrounding environment, or intentional, as recently demonstrated by  information security researchers. NIST is a  nonregulatory, federal agency within the Department of Commerce. However, federal officials and information security researchers  said efforts to mitigate these risks could adversely affect devices’  performance. Several of the experts we consulted noted that certain intentional  information security threats were of greater concern than other threats. Information Security Risks Could Adversely Affect the Safety and Effectiveness of Medical Devices

Information security risks resulting from the exploitation of vulnerabilities  by threats could adversely affect the safety and effectiveness of active  implantable medical devices. FDA Considered Information Security Risks Resulting from Certain Threats during Its Review of Two Devices, and Has Plans to Enhance Its Information Security Efforts

For the two medical devices that have known vulnerabilities, FDA  considered information security risks from unintentional threats, but not  risks from intentional threats during its premarket review of the related  supplements. FDA Officials Considered Information Security Risks from Unintentional Threats, but Not from Intentional Threats in Their Review of Two PMA Supplements

In the reviews of two PMA supplements for medical devices with known  vulnerabilities conducted in 2001 and 2006, FDA officials considered  information security risks resulting from unintentional threats, but not from  intentional threats. Specifically, FDA considered information security risks  in four of the eight information security control areas we selected— software testing, verification, and validation; risk assessments; access  control; and contingency planning (see table 6 below and app. However, FDA did not consider risks from unintentional threats for the  four remaining information security control areas—risk management,  patch and vulnerability management, technical audit and accountability,  and security-incident response. For example, FDA  officials would review a scalpel for potential clinical risks resulting from its  intended use in a clinical setting. Additionally, in commenting on a draft of this  report, HHS noted that FDA anticipates completing the review on the  agency’s approach to evaluating software in medical devices in calendar  year 2012. HHS also noted that FDA will include an assessment of  information security risks for medical devices. Despite  having postmarket efforts in place, FDA faces challenges in using them to  identify information security problems. FDA Has Adverse Event Reporting and Other Postmarket Efforts in Place to Identify Problems with Medical Devices, including Those Related to Information Security

FDA has various postmarket efforts in place to identify problems with  medical devices once they have been approved for marketing, including  any problems related to information security. They noted that information security is a relatively new issue area with  respect to its applicability to medical devices, which could make it a  difficult type of problem to understand and report to FDA. Recommendation for Executive Action

To better ensure the safety and effectiveness of active implantable  medical devices, we are recommending that the Secretary of Health and  Human Services direct the Commissioner of FDA to develop and  implement a more comprehensive plan to assist the agency in enhancing  its review and surveillance of medical devices as technology evolves, and  that will incorporate the multiple aspects of information security. This plan  should include, at a minimum, four actions, such as determining how FDA  can  increase its focus on manufacturers’ identification of potential  unintentional and intentional threats, vulnerabilities, the resulting  information security risks, and strategies to mitigate these risks during  its PMA review process; utilize available resources, including those from other entities, such as  leverage its postmarket efforts to identify and investigate information  security problems; and establish specific milestones for completing this review and  implementing these changes. DHS and the Department of Defense did not provide  comments on a draft of this report. In its comments, HHS concurred with our recommendation and described  relevant efforts FDA has initiated. Appendix I: Objectives, Scope, and Methodology

The objectives of our review were to (1) identify the threats,  vulnerabilities, and resulting information security risks associated with  active implantable medical devices; (2) determine the extent to which the  Food and Drug Administration (FDA) considered information security risks  in its premarket approval (PMA) review process for certain active medical  devices with known vulnerabilities; and (3) determine what postmarket  efforts FDA has in place to identify information security problems  involving active implantable medical devices. These publications also included information related to the two  devices that researchers have demonstrated are susceptible to intentional  threats—an implantable cardioverter defibrillator (defibrillator) and an  insulin pump. Adverse event reports are to be submitted to FDA through mandatory and  voluntary sources.
Why GAO Did This Study

Certain medical devices have become increasingly complex, and the growing use of wireless technology in these devices has raised concerns about how protected they are against information security risks that could affect their safety and effectiveness.
FDA, an agency within the Department of Health and Human Services (HHS), is responsible for ensuring the safety and effectiveness of medical devices in the United States. FDA reviews manufacturers applications to market medical devices during its premarket review process and monitors devices, once it has approved them, through its postmarket efforts.
In this report, GAO (1) identifies the threats, vulnerabilities, and resulting information security risks associated with active implantable medical devices, (2) determines the extent to which FDA considered information security during its premarket review of certain devices with known vulnerabilities, and (3) determines what postmarket efforts FDA has in place to identify information security problems. To address these objectives, GAO reviewed relevant documents and interviewed officials from agencies, such as FDA, HHS, the Federal Communications Commission, and the Department of Homeland Security. GAO also interviewed subject-matter experts in information security.

What GAO Found

Several information security threats exist that can exploit vulnerabilities in active implantable medical devices, but experts caution that efforts to mitigate information security risks may adversely affect device performance. Threats to active devicesthat is, devices that rely on a power source to operatethat also have wireless capability can be unintentional, such as interference from electromagnetic energy in the environment, or intentional, such as the unauthorized accessing of a device. Several experts consider certain threats to be of greater concern than others; for example, experts noted less concern about interference from electromagnetic energy than other threats. Incidents resulting from unintentional threats have occurred, such as a malfunction resulting from electromagnetic interference, but have since been addressed. Although researchers have recently demonstrated the potential for incidents resulting from intentional threats in two devicesan implantable cardioverter defibrillator and an insulin pumpno such actual incidents are known to have occurred, according to the Food and Drug Administration (FDA). Medical devices may have several such vulnerabilities that make them susceptible to unintentional and intentional threats, including untested software and firmware and limited battery life. Information security risks resulting from certain threats and vulnerabilities could affect the safety and effectiveness of medical devices. These risks include unauthorized changes of device settings resulting from a lack of appropriate access controls. Federal officials and experts noted that efforts to mitigate information security risks need to be balanced with the potential adverse effects such efforts could have on devices performance, including limiting battery life.
FDA considered information security risks from unintentional threats, but not risks from intentional threats, during its 2001 and 2006 premarket review of two medical devices that have known vulnerabilities. Specifically, FDA considered risks from unintentional threats for four of the eight information security control areas GAO selected for its evaluationsoftware testing, verification, and validation; risk assessments; access control; and contingency planning. However, the agency did not consider risks from intentional threats for these areas, nor did the agency provide evidence of its review for risks from either unintentional or intentional threats for the remaining four information security control areasrisk management, patch and vulnerability management, technical audit and accountability, and security-incident-response activities. According to FDA, it did not consider information security risks from intentional threats as a realistic possibility until recently. In commenting on a draft of this report, FDA said it intends to reassess its approach for evaluating software used in medical devices, including an assessment of information security risks.
FDA has postmarket efforts, such as its adverse event reporting system, in place to identify problems with medical devices, including those related to information security. However, FDA faces challenges in using them to identify information security problems. For example, the agencys adverse event reporting system relies upon reports submitted by entities, such as manufacturers, that are more closely related to clinical risks than to information security risks. Because information security in active implantable medical devices is a relatively new issue, those reporting might not understand the relevance of information security risks.

What GAO Recommends

GAO recommends that FDA develop and implement a plan expanding its focus on information security risks. In comments on a draft of this report, HHS concurred with GAOs recommendation and described relevant efforts FDA has initiated.