Consideration of Cybersecurity in the Benefit-Risk Analysis of Medical Devices: A Scoping Review and Recommendations

doi:10.21203/rs.3.rs-4816554/v1

Download PDF

Systematic Review

Consideration of Cybersecurity in the Benefit-Risk Analysis of Medical Devices: A Scoping Review and Recommendations

https://doi.org/10.21203/rs.3.rs-4816554/v1

This work is licensed under a CC BY 4.0 License

Version 1

posted

You are reading this latest preprint version

The integration of connected medical devices (cMDs) in healthcare brings benefits but also introduces new, often challenging-to-assess risks related to cybersecurity. Addressing those risks in the benefit-risk analysis (BRA), an integral step in the approval process, is required by regulations in the EU and US. This scoping review aims to identify current legal frameworks, guidelines, and standards in the US and EU on how cybersecurity-related risks should be considered in the BRA. We identified 21 documents issued by multiple standard organisations and regulatory agencies. While guidelines recognise cybersecurity-related risks, they lack the description of detailed methods. Some standards and technical reports provide methods and examples for a security BRA, while others only loosely describe methods that could be adapted to consider cybersecurity-related risks. Some separate security and safety BRAs, while others call for holistic approaches. To enhance patient safety and device effectiveness, standardised frameworks for cybersecurity-related risks should be developed.

Medical Informatics

Medical Devices

Cybersecurity

Risks

Benefit-Risk Analysis

Connected medical devices (cMDs) have become an integral part of modern healthcare and play a crucial role in diagnosing, monitoring, and treating a wide range of medical conditions¹. These devices have integrated software or are entirely software-based, allowing them to connect to other devices or networks to exchange, transfer, or receive commands and data¹. Examples include smartwatches, implanted devices often referred to as the Internet of Medical Things (IoMT)², and stationary devices like CT scanners^1,3. While their connectivity offers multiple advantages, such as real-time disease and physiology monitoring^1,4,5 along with the potential for remote device management, and over-the-air updating⁶, it also introduces new risks for patients, particularly related to cybersecurity^4,5,7. These risks are not just theoretical but could harm patients^8,9. The term ‘cybersecurity-related risks’ is used as an umbrella term for risks specifically arising from cybersecurity vulnerabilities and measures that could affect a MDs security (a state where its information assets are protected) as well as its safety (absence of unacceptable risks for the patient's health)^10,11. However, those two areas overlap to some degree, since security risks could exist that affect the MD’s safety¹². Thus, cybersecurity-related risks can lead to harm “to people, property, and the environment” ¹¹.

The relevance of cybersecurity-related risks is underscored by a rising number of cyberattacks on healthcare infrastructure^8,13, while at the same time, the U.S. Federal Drug Agency (FDA) reports a significant number of adverse events related to cybersecurity vulnerabilities¹⁴ and even recalled several devices due to them^15,16. Regulatory frameworks, such as the EU Medical Device Regulation (MDR) and the Federal Food, Drug & Cosmetic Act (FD&C Act) in the US, mandate that manufacturers secure cMDs against these vulnerabilities to ensure that the risks for patients are on an acceptable level¹⁷.

According to the MDR, all electronic programmable systems, which includes cMDs, must be developed according to state-of-the-art cybersecurity principles while requiring that the risks associated with their operation are acceptable in order to ensure a high level of health and safety protection¹⁸. This interplay between security and safety is further specified in a guidance document of the Medical Device Coordination Group (MDCG), MDCG 2019-16 rev 1.0 (MDCG 2019-16), where achieving an appropriate balance between benefit and risk, including the risk associated with cybersecurity, is a requirement to achieve an acceptable level of protection for users of such devices¹². In the US, the FD&C Act demands that manufacturers meet certain cybersecurity requirements and that they weigh the benefits of a product against its risks¹⁷. The FDA, as the responsible authority, further defined these requirements in a series of guidelines that add multiple recommendations for the benefit-risk analysis^19–21 and cybersecurity requirements of MDs^22–24.

To assess whether the benefits of a MD outweigh its risks, manufacturers are obligated under current legislation in both the US and EU to carry out a Benefit-Risk-Analysis (BRA)^17,18. This important step in the approval process weighs up all defined benefits of a device with its anticipated risks (including the risk detected for similar devices), considering the device's intended use, to ensure that the product as a whole provides a positive argument for use²⁵. The importance of the consideration of cybersecurity-related risks in BRA is addressed by several guidance documents^12,22–24. However, the guidance fails to provide clear instructions on how to evaluate and incorporate these often challenging-to-assess risks in the BRA^10,11.

To address the existing ambiguities around the BRA and cybersecurity, this review aims to identify the current legal frameworks, guidelines, and standards in the US and EU on how cybersecurity should be considered in the benefit-risk analysis of MDs. Based on those documents, this paper provides recommendations for manufacturers and regulators.

This scoping review was conducted according to the Preferred Reporting Items for Systematic Reviews extension for Scoping Reviews (PRISMA-ScR)²⁶. The completed PRISMA-ScR checklist can be found in Supplementary Information 1.

Search strategy

The literature search was conducted on July 3rd, 2024, in three databases for regulatory guidelines: the FDA guidance database, the International Medical Device Regulators Forum (IMDRF) documents database, and the MDCG documents database. Each database was searched with the search terms ‘cybersecurity’, ‘security’, ‘benefit-risk’, ‘benefit/risk’, and ‘risk-benefit’. Additionally, a reference search in the included guidelines was conducted to identify any other relevant standards or guidelines referenced in the official guidance documents, and two experts for the regulation of cybersecurity in MDs (authors C.R. and P.W.) were asked to provide the most recent guidance documents, which are not yet referenced in the official guidelines. The data of all identified guidelines was exported and gathered in an electronic database.

Inclusion and exclusion criteria

Sources were included in the review if they met the following inclusion criteria: (1) the source is a guideline or standard; (2) the source is in force; (3) the source delivers guidance for the benefit-risk analysis of medical devices or cybersecurity-related risks of medical devices. Sources were excluded when they (1) did not describe medical devices; (2) when they were limited to a specific subclass of medical devices and not generalisable (e.g., digital diabetes devices); (3) when they were about in vitro diagnostic medical devices or investigational devices, (4) when the content of the source was insufficient to undertake a scientific analysis.

Study selection

The titles and summaries of the identified sources were screened by two independent researchers between July 3rd, 2024 and July 10th, 2024 to evaluate whether they met the criteria for inclusion. In the case of disagreements, a third independent reviewer was consulted. After the initial screening, one reviewer screened the full text of the included guidelines for eligibility.

Data Extraction and Analysis

The data extraction and analysis were conducted using MAXQDA 2022. One researcher identified keywords related to the benefit-risk analysis and to cybersecurity-related risks within each document. Thereafter, any guidance and recommendations relating to both topics and to the intersection of both were extracted. The extracted data and the relations between different data sources were then summarised using figures, tables and narrative summaries. Based on these summaries, recommendations were drawn up.

Search Results

The systematic search of the three databases resulted in 41 documents. Of those, ten were included in the review. The reference search retrieved another 13 documents. In total, 21 documents were included in the review. Figure 1 shows the flowchart of the screening process.

Source characteristics

Among the 21 documents included in the study are two regulations, four standards, five technical reports and ten guidance documents. Two documents are applicable only in the EU, nine in the US, and ten internationally. Three documents only describe the concept of BRA without mentioning cybersecurity explicitly, while 18 documents describe the intersection of both. Nine documents provide examples or methods on how to consider cybersecurity-related risks in the BRA. Table 1 provides an overview of the included documents, while Fig. 2 shows a visual representation of the relationship between documents.

Table 1

**Characteristics of included documents.** The table provides the complete name of the sources and the abbreviation used within this paper, if applicable. *International Medical Device Regulators Forum (IMDRF), **Association for the Advancement of Medical Instrumentation (AAMI) *****International Organization for Standardization** (ISO), ****International Electrotechnical Commission (IEC).
Name	Abbreviation	Type	Organisation	Year	Description	Mention of BRA	Mentions Cybersecurity
Federal Food, Drug, and Cosmetic Act¹⁷	FD&C Act	Legislation	US House of Representatives	1938	This is the law that grants the FDA the power to regulate MDs. It establishes high-level rules for MDs and their approval process and defines requirements for many aspects of MDs, including cybersecurity and the BRA²⁸.	Yes	Yes
Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (Text with EEA relevance. )¹⁸	MDR	Legislation	EU Parliament & Council	2017	This is a European regulation that came into force in 2017. It provides high-level rules and requirements for MDs that are or should be put on the European market.	Yes	Yes
Principles and practices for medical device cybersecurity²⁹	IMDRF - MD Cybersecurity	Guidance document	IMDRF*	2020	It provides principles and recommendations regarding the cybersecurity of MDs for all stakeholders and emphasizes the relevance of a risk management process for cybersecurity-related risks.	Yes	Yes
Principles and practices for software bill of material for medical device cybersecurity³⁰	IMDRF - SBOM Cybersecurity	Guidance document	IMDRF*	2023	Outlines principles and recommendations for the implementation of a Software Bill of Materials (SBOM) to enhance cybersecurity for medical devices.	Yes	Yes
Principles and practices for cybersecurity of legacy medical device³¹	IMDRF - LegMD Cybersecurity	Guidance document	IMDRF*	2023	Provides principles and recommendations for maintaining the cybersecurity of legacy medical devices.	Yes	Yes
Cybersecurity in medical devices: quality system considerations and content of premarket submissions²²	FDA - MD Cybersecurity	Guidance document	FDA	2023	Provides guidance for MD manufacturers on addressing cybersecurity in their premarket submissions, emphasizing the importance of integrating robust cybersecurity measures throughout the device's lifecycle to ensure safety and effectiveness.	Yes	Yes
Postmarket Management of Cybersecurity in Medical Devices²³	FDA - MD Cybersecurity_Postmarket	Guidance document	FDA	2016	Provides guidance on managing cybersecurity vulnerabilities in MDs that are already on the market, emphasizing continuous monitoring, identifying, and addressing cybersecurity threats to ensure safety and effectiveness throughout their lifecycle.	Yes	Yes
Select Updates for the Premarket cybersecurity guidance: section 524B of the FD&C Act²⁴	FDA - MD Cybersecurity_Update	Guidance document	FDA	2024 (Draft)	Explains the new cybersecurity requirements for MD manufactures based on the 2022 additions to the FD&C Act.	Yes	Yes
Principles for medical device security - Risk Management; AAMI TIR57:2016/(R)2023³²	AAMI TIR57	Technical Report	AAMI**	2023	Provides guidance on methods for performing cybersecurity risk management for medical devices, incorporating principles from ISO 14971:2019 and IEC 80001-1:2021.	Yes	Yes
MDCG 2019-16 V1.0¹²	MDCG 2019-16	Guidance document	MDCG	2020	Provides guidance for MD manufacturers on how to address the cybersecurity requirements stated by the MDR. It outlines the necessary steps manufacturers should take to ensure their devices are secured against cyber threats throughout the product lifecycle.	Yes	Yes
ISO 14971:2019¹⁰	ISO 14971	Technical Report	ISO***	2019	Describes how the risk management process for MDs should be conducted by MD manufacturers.	Yes	Yes
ISO TR 24971:2020¹¹	ISO TR 24971:2020	International Standard	ISO***	2020	Provides guidance on the application of ISO 14971:2019.	Yes	Yes
Factors to Consider When Making Benefit-Risk Determinations in Medical Device Premarket Approval and De Novo Classifications¹⁹	FDA - BRA	Guidance document	FDA	2019	This document provides guidance on how the FDA conducts the BRA, explaining the factors considered and how they should be applied.	Yes	No
Factors to Consider Regarding BenefitRisk in Medical Device Product Availability, Compliance, and Enforcement Decisions²⁰	FDA - BRA_AC&ED	Guidance document	FDA	2016	This document provides guidance for FDA staff and industry on the factors considered the BRA regarding availability, compliance, and enforcement decisions.	Yes	No
Consideration of Uncertainty in Making Benefit-Risk Determinations in Medical Device Premarket Approvals, De Novo Classifications, and Humanitarian Device Exemptions²¹	FDA - BRA Uncertainty	Guidance document	FDA	2019	This document provides guidance on how the FDA considers uncertainty in MD premarket approvals and De Novo classifications and describes factors influencing this uncertainty.	Yes	No
IEC/TR 80001-2-2:2012³³	IEC/TR 80001-2-2:2012	Technical Report	IEC****	2012	This document provides a framework for disclosing security-related capabilities and risks associated with the risk management of MDs connected IT networks.	No (describes residual risks)	Yes
ISO/TR 80001-2-7:2015³⁴	ISO/TR 80001-2-7:2015	Technical Report	ISO***	2015	This document provides guidance on how to assess their conformity with IEC 80001-1:2021.	Yes	Yes
EC 80001-1:2021³⁵	IIEC 80001-1:2021	International Standard	IEC****	2021	This standard describes the requirements for different stakeholders in the risk management process of MDs connected to a healthcare infrastructure. It covers multiple risk types, including cybersecurity-related risks.	Yes	Yes
IEC/TR 80001-2-1:2012³⁶	IEC/TR 80001-2-1:2012	Technical Report	IEC****	2012	This document provides guidance on how to implement the risk management process described in IEC 80001-1:2021.	Yes	Yes
IEC 81001-5-1:2021³⁷	IEC 81001-5-1:2021	International Standard	IEC****	2021	This standard defines lifecycle requirements for MDs regarding cybersecurity, including best practices and security risk management.	No (describes residual risks)	Yes
ANSI/AAMI SW96:2023³⁸	AAMI SW96	National Standards	AAMI**	2023	This standard applies the framework provided within ISO 14971:2019 to security risk management.	Yes	Yes

Regulations in the EU and the US

The scope and requirements for MD manufacturers in the EU are determined on a high level by the Regulation (EU) 2017/745 of the European Parliament and of the Council on medical devices (MDR)¹⁸ and by the Regulation (EU) 2017/746 of the European Parliament and of the Council on in vitro diagnostic medical devices³⁹. The latter was excluded from this scoping review. The provided rules are further defined by guidance documents, issued by the Medical Device Coordination Group (MDCG), or through referring to existing harmonised standards, developed or adapted from existing international standards by a European standard organisation¹⁸. In the US, the FD&C Act defines foundational requirements for MDs and empowers the FDA to establish detailed rules for MDs and to enforce them¹⁷.

For the EU, the MDR addresses BRA requirements in multiple sections, requiring weighing all known risks of a device against its benefits to the patient¹⁸, without further specifying the types of risks. While not mentioned explicitly, it is generally assumed that cybersecurity-related risks should be considered. Cybersecurity-related risks are not mentioned in detail, instead, the MDR defines two broad requirements, using the terms ‘information security’ and ‘IT security’: MDs that include software or are software must be developed following the state-of-the-art and must have protective measures against unauthorised access¹⁸. This state of the art is not further defined.

For the US, the FD&C Act section 515(a) states that the effectiveness and safety of a MD are determined by “weighing any probable benefit to health from the use of the device against any probable risk of injury or illness from such use”¹⁷. High-level cybersecurity requirements are defined in section 524B of the FD&C Act as to monitor and address postmarket vulnerabilities, ensure device and system security, provide software updates and a software bill of materials (SBOM), and comply with additional regulations for cybersecurity assurance¹⁷. Similar to the EU, the intersection of cybersecurity-related risks and BRA is not mentioned explicitly within the regulation, but the wording in both suggests a consideration.

Guidelines for the BRA and Cybersecurity

We identified ten guidelines currently used within the EU and the US that describe the relevance of the BRA and link it to cybersecurity. Table 2 provides an overview of the identified regulations, guidelines, and standards and their recommendations regarding cybersecurity-related risks in the BRA.

One guideline was issued by the MDCG, expanding and framing the cybersecurity requirements provided in the MDR. In addition to implementing cybersecurity measures, manufacturers must establish a process for managing cybersecurity-related risks that considers the device's safety, security, and effectiveness. The residual security risks (which could include cybersecurity-related ones) should then be considered in a newly named concept called the ‘security benefit-risk analysis’, which should be conducted as part of the overall BRA¹². However, the document does not provide any method or guidance on how this should be conducted.

Three documents were issued by the FDA, providing non-binding but recommended guidance on how to conduct a BRA for MD approval in the US, including practical examples^19–21. The qualitative method described in those guidance documents is known as the FDA’s benefit-risk framework (BRF) and could be adapted for the consideration of cybersecurity-related risks, however, in its current state, it provides no specific guidance on how this can be done. Another three FDA guidelines describe cybersecurity requirements for MDs, mentioning the relevance of cybersecurity-related risks for BRA multiple times^22–24 and partly referring to the FDA’s BRF.

Three guidelines were issued by the International Medical Device Regulators Forum (IMDRF), a joint group of multiple regulatory authorities, including the European Commission and the FDA. While the provided documents are not legally binding, they provide a good overview of regulatory practices and are acknowledged as part of the overall regulatory state-of-the-art by the FDA as well as by EU regulatory bodies^12,22. These three guidelines describe cybersecurity recommendations for MDs, acknowledging the need to conduct a BRA that considers cybersecurity-related risks^29–31.

Standards for the BRA and Cybersecurity

Four standards and five technical reports were identified as relevant for the BRA process, while cybersecurity was taken into account. ISO 14971:2019 explicitly mentions that security risks should be considered in the risk analysis and the BRA¹⁰ since they can lead to harm¹¹. This standard is the FDA requirement for the risk management of MDs and was harmonised for the EU as EN ISO 14971:2019⁴⁰. It also lists basic requirements for the BRA, mandating an evaluation of whether a device’s benefits outweigh its residual risks, and necessary modifications if benefits do not justify the risks¹⁰. ISO TR 24971:2020, a technical report on how to implement ISO 14971:2019, provides examples and detailed guidance on which risks to consider within the security risk management process. In line with ISO 14971:2019, it proposes that the overall residual risk should be viewed from a broad perspective considering all residual risks, ensuring all identified hazardous situations have been evaluated and risks have been reduced to an acceptable level or accepted based on a BRA¹¹.

IEC 80001-1:2021, and the associated technical reports, describe that, if single individual risks cannot be reduced to an acceptable level through mitigation measures in the risk management process, a BRA should be conducted for each of those risks individually³⁵. Additionally, when residual risks remain, the aggregated residual risk should be weighed against the benefits emerging from the deployment of a MD³⁵. IEC 81001-5-1:2021 mandates that handling residual security risks should be done in cooperation with product risk management, without mentioning a BRA explicitly³⁷.

AAMI TIR57 is referred to in multiple cybersecurity-related FDA guidance documents and explains in detail how the information security risk management for MDs should be performed and how the identified risks should be considered in the BRA³². It states that if a security-related residual risk is assessed as unacceptable, a BRA should be performed. Manufacturers should balance the residual risk against the benefits provided by the device’s design capabilities or security controls. This report also provides an example of an unacceptable cybersecurity-related residual risk and how this affects the BRA outcome: an unacceptable risk of exposing personally identifiable information should not be justified solely because the device provides life-saving therapy. Instead, the benefit of storing the information in the device should be weighed against the risk of compromising confidentiality³². The FDA-recognised standard AAMI SW96 applies the risk management framework provided in ISO 14971:2019 to security risks and defines requirements similar to those of AAMI TIR57³⁸. Additionally, it provides an example of how a security benefit could outweigh a security risk and adds an infrastructure view to an overall security BRA: not only the device itself must be considered but the impact of the implementation of the device into the IT infrastructure, intersecting with the requirements defined in IEC 80001-1:2021³⁸.

Table 2

The consideration of cybersecurity-related risks in the BRA as defined in different regulations, guidelines, and standards.
Name	Type	Organisation	Provides a method/example	Intersection between BRA and cybersecurity
FD&C Act	Legislation	US House of Representatives	No	The FD&C Act addresses the BRA and cybersecurity independently. However, the broadly defined risks in the BRA include safety risks that could be caused by cybersecurity vulnerabilities, ensuring comprehensive risk management without explicitly mentioning cybersecurity.
MDR	Legislation	EU Parliament & Council	No	The MDR addresses the BRA and cybersecurity independently. However, the broadly defined risks in the BRA include safety risks that could be caused by security vulnerabilities, ensuring comprehensive risk management without explicitly mentioning cybersecurity.
IMDRF - MD Cybersecurity	Guidance document	IMDRF	No	This guidance document emphasises the need to assess the impact of security risk mitigation measures on the impact of other risks, e.g., considering the benefits and risks associated with deploying updates. Healthcare providers are encouraged to conduct benefit-risk assessments of manufacturers’ proposed mitigations before implementing them. According to this document, a cybersecurity-informed BRA is an ongoing process.
IMDRF - SBOM Cybersecurity	Guidance document	IMDRF	No	This guidance document highlights that providing a Software Bill of Materials (SBOM) enables regulators to perform a more comprehensive benefit-risk assessment. It aids in estimating and addressing the impact of threats, vulnerabilities, and exploits, thereby enhancing overall risk management.
IMDRF - LegMD Cybersecurity	Guidance document	IMDRF	No	This guidance document advises HCPs and MD manufacturers to monitor the risk profile of devices throughout their lifecycle. HCPs should perform regular clinical benefit-risk analyses, comparing the risks of the use of legacy devices beyond their end-of-service (EOS) date with acquiring new or upgraded devices.
FDA - MD Cybersecurity	Guidance document	FDA	No	This guidance document emphasizes the unpredictable nature of cybersecurity risks, which cannot be easily assessed or quantified using historical data or modelling. Thus, qualitative methods could also be used, which is similarly acknowledged in the most recent version of ISO 14971:2019. It also acknowledges the interconnected yet distinct nature of safety and security risk management. Manufacturers should assess identified risks based on the level of risk posed by the device and its operational system, with continuous risk identification throughout the device lifecycle. Cybersecurity should be integrated into the device from the beginning. Responses to security events should consider the BRA to determine the appropriateness of actions, given that updates may limit device availability. Additionally, it recognises the challenges in updating devices already on the market.
FDA - MD Cybersecurity_Postmarket	Guidance document	FDA	No	This guidance document advises manufacturers to monitor, identify, and address cybersecurity vulnerabilities and exploits as part of their postmarket management of MDs. It also recommends evaluating residual risks, the results of the BRA, and any risks introduced by remediation efforts as part of the Postmarket Cybersecurity Program after detecting a vulnerability.
FDA - MD Cybersecurity_ Update	Guidance document	FDA	No	This document provides several updates to the existing medical device cybersecurity guidance. It specifies that when cybersecurity-related risks cannot be mitigated or managed, all residual risks should be assessed within the risk management process and included in the BRA, in line with ISO 14971:2019.
AAMI TIR57	Technical Report	AAMI	Yes	This technical report advises that if a security-related residual risk is deemed unacceptable, a BRA should be performed. Manufacturers should balance the residual security risk against the benefits provided by the device’s design capabilities or security controls. It warns against using “security by obscurity” as a risk reduction strategy. Security risks impacting safety must be evaluated in the safety risk assessment following ISO 14971:2019. Effective communication with patients and healthcare providers is crucial, ensuring they understand how to manage residual risk without providing attackers with a blueprint. Manufacturers should also balance usability, device safety, and security to ensure appropriate security controls for intended users and connected systems.
MDCG 2019-16	Guidance document	MDCG	Yes	This guidance document emphasises the need to consider the relationship between safety and security in the context of risk. It highlights that security-related risks can be caused by both weak and restrictive security measures. Rather than conducting a BRA for each individual security risk, an overall BRA should be executed based on the device’s intended use and the potential safety and performance impacts, using the safety risk assessment, which includes security-related hazard categories. Additionally, the original Security BRA should be updated with post-market surveillance (PMS) data.
ISO 14971:2019	Technical Report	ISO	Yes (not specifically designed for cybersecurity)	ISO 14971:2019 acknowledges that quantitative data is often unavailable for cybersecurity risks, allowing for qualitative risk estimation. The standard specifically includes risks related to data and systems security within its scope. It highlights that breaches in data and systems security can lead to harm, such as loss of data, uncontrolled access to data, corruption or loss of diagnostic information, or software corruption resulting in device malfunction. If a residual risk is deemed unacceptable based on the risk management plan’s criteria and further risk control is impracticable, manufacturers may review data and literature to determine if the benefits of the intended use outweigh this residual risk. Additionally, a general BRA of all residual risks should be conducted by weighing them against the overall benefits provided by the MD's intended use. This overall residual risk could be stronger than each individual risk.
ISO TR 24971:2020	International Standard	ISO	Yes (not specifically designed for cybersecurity)	This technical report provides examples of cybersecurity-related safety risks and emphasizes the importance of evaluating security risks by considering confidentiality, integrity, and availability in the context of the device’s intended use. It states that the BRA is used to determine if an individual residual risk is outweighed by the expected benefits of the device’s intended use. Manufacturers are encouraged to consider technical, regulatory, economic, and sociological contexts in their risk management decisions, acknowledging that implementing risk control measures might introduce new risks or exacerbate existing ones. The report emphasizes the complexity of directly comparing benefits and risks and suggests that the overall residual risk should be viewed from a broad perspective, ensuring all identified hazardous situations have been evaluated and risks have been reduced to an acceptable level or accepted based on a BRA.
FDA - BRA	Guidance document	FDA	Yes (not specifically designed for cybersecurity)	This guidance document states that the BRA can be conducted using both clinical and non-clinical data, recognizing that some MD's attributes cannot be tested using clinical methods. It emphasizes that clinical benefits are usually measured directly through factors such as magnitude, probability, and duration. In the BRA, all risks must be considered and weighed against the clinical benefits, both based on the totality of the evidence. The document also highlights the importance of incorporating patient perspectives and accounting for uncertainty. It provides a checklist-like assessment tool and examples, and notes that the BRA is an essential step that should always be conducted following the risk assessment and management processes that are outlined in ISO 14971:2019.
FDA - BRA_AC&ED	Guidance document	FDA	Yes (not specifically designed for cybersecurity)	This document supplements the FDA’s BRA framework by incorporating additional benefits and risks. It specifically describes the impact of availability, compliance, and enforcement decisions on the BRA.
FDA - BRA Uncertainty	Guidance document	FDA	No	This guidance document addresses the inherent uncertainty in MDs' premarket decision-making regarding their benefits and risks. It outlines the need to consider this uncertainty in the BRA and recommends collecting post-market data to address and reduce this uncertainty over the MD's life cycle.
IEC/TR 80001-2-2:2012	Technical Report	IEC	No	This technical report emphasises that residual cybersecurity risks should be considered in the BRA.
ISO/TR 80001-2-7:2015	Technical Report	ISO	No	This technical report specifies that individual and overall residual risks should be assessed for acceptability. If the required risk reduction is impracticable, the responsible organisation must conduct and document a BRA of the residual risk. Additionally, when the residual risk remains unacceptable, a BRA should be conducted to weigh the overall residual risk against the health benefits emerging from incorporating the medical device into the IT network.
IEC 80001-1:2021	International Standard	IEC	Yes	This standard specifies that if risks cannot be reduced to an acceptable level through risk management, BRA should be conducted. When no suitable risk control measures are possible, a holistic BRA should be performed, weighing the overall residual risk against the system benefit. The analysis should involve judgment by experienced and knowledgeable individuals, considering technical, clinical, regulatory, economic, sociological, and political contexts. It also recommends conducting a general BRA, summing all unaccepted risks against the net clinical benefit of deployment, aligning with the guidance in ISO TR 24971:2020.
IEC/TR 80001-2-1:2012	Technical Report	IEC	No	This technical report specifies that if risks cannot be reduced to an acceptable level through the risk management process, the device should be changed or the risk should be outweighed by the expected benefits, determined in a BRA.
IEC 81001-5-1:2021	International Standard	IEC	No	This standard mandates that handling residual security risks should be done in cooperation with product risk management. It also requires considering the impacts on safety caused by the degradation of security over time.
ANSI/AAMI SW96:2023	National Standard	AAMI	Yes	If a security-related residual risk is deemed unacceptable, a BRA should be performed. Manufacturers should balance the residual security risk against the benefits provided by the device’s design capabilities or security controls. The overall BRA, which should consider all security residual risks as well as the impact of the implementation of the device into the IT-infrastructure, intersecting with the requirements defined in IEC 80001-1:2021.

Principal Results

The goal of this scoping review was to identify the current legal frameworks, guidelines, and standards in the US and EU on how cybersecurity should be considered in the benefit-risk analysis of MDs, and to provide recommendations for manufacturers. We identified two regulations (MDR and FD&C Act), four standards, issued by ISO, IEC, and AAMI, five technical documents, and ten guidelines, issued by the FDA, MDCG, and IMDRF.

The regulations in both the US and EU provide high-level requirements for the BRA, but do not explicitly address the intersection of cybersecurity and BRA. On the guidelines level, MDCG 2019-16 provides an overview of cybersecurity requirements for the EU and acknowledges that cybersecurity-related risks should influence the BRA. For the US, FDA guidelines underscore the relevance of the BRA without detailing methods for the consideration of cybersecurity-related risks.

Multiple standards and technical reports describing the intersection of cybersecurity and the BRA, mandate the execution of a BRA only when residual risks, including cybersecurity-related ones, cannot be reduced to an acceptable level through risk management^10,32,35. Some of these documents provide methods and examples explicitly for a security BRA^32,35,38, while others only loosely describe methods that could be adapted to consider cybersecurity-related risks without providing more details^10,11.

Benefit-Risk Analysis and Cybersecurity

In our scoping review, we identified a notable gap between the acknowledgement of the relevance of cybersecurity-related risks for the BRA and the actual guidance on how to consider these risks within it. Existing guidelines from both the EU and the US mention cybersecurity-related risks as relevant for MDs, since they could affect a MDs safety and security. Yet, they do not provide detailed methods on how cybersecurity should or could influence the BRA^12,29–31, or only reference generic methods^22–24. Thus, and through the lack of concrete examples, there remains some amount of uncertainty within those guidelines on how and when to conduct a BRA in general, and on how to conduct a security BRA. For the EU, this is reinforced by the fact that currently, two interpretations of the MDCG guidance are possible: the BRA could be divided into sub-categories identified in the risk assessment (e.g., cybersecurity-related risks, electromagnetic risks, usability risk), or all risks, including cybersecurity-related ones may be considered within the overall BRA¹².

Many of the included documents consider BRA an explicit requirement, necessitating the description and coverage of all safety risks, including those caused by cybersecurity threats^{10–12,17–20}. Some of the included documents provide sophisticated overviews of cybersecurity-related risks and the security risk management process, but they do not go into detail regarding the BRA, or, again, refer to generic methods^35,37. Others provide methods that could be adapted to consider cybersecurity while not containing specific information about the relationship between cybersecurity-related risks and the BRA^{10,11,19–21}.

Three guidance documents separate security and safety risk management into two processes^12,32,38. While the intersection of both processes is acknowledged, they include separate BRAs: one for safety risk management, which considers all residual risks, including security-related ones, comparing them to the clinical benefits to patients and to the health system, and another one for security alone^12,32,38. While a lot of guidance exists for the identification of security risks, it remains unclear how security benefits are defined and how they influence the security BRA as well as the safety BRA. AAMI TIR57 states that manufacturers should appropriately balance the residual security risk against the benefit gained by the design capability or security control³². SW96:2023 provides a brief example here, where the benefit of accurate patient identification outweighs the residual risk of storing patient data³⁸. However, this approach somewhat contradicts the understanding of a BRA described in other documents, which mandate a more holistic approach, weighing the clinical benefits of the device against the residual cybersecurity-related risks, and conducting an additional general BRA that considers all residual risks^{10,11,19–21,35}. These risks, in combination, could be more significant than the individual ones¹⁰.

Some standards and official guidance documents differ in their description of when a BRA must be carried out. One only calls for a BRA if residual risks remain unacceptable³⁷, which contradicts the requirements of the MDCG guidance and FDA. These two organisations, as the official bodies that are tasked with providing guidance to manufacturers on how to interpret and apply the applicable laws, see the BRA as a final step in deciding whether an MD should be put on the market^12,17–21. A middle ground position is provided by multiple documents that require a separate BRA for any individual residual risk that is not judged acceptable, while an overall BRA should be conducted to evaluate the overall residual risk, which should consider cybersecurity-related residual risks^{10,11,32,35,38}.

Traditionally, BRA is often seen as primarily a premarket process in the MD development and approval process. However, multiple guidelines clarify that BRA is an ongoing process^{12,19,20,22,23,31}, and especially when initial data is limited, post-market surveillance (PMS) should be used to further define the risk profile of a device and update the BRA accordingly²⁰. This ongoing process includes BRA by the healthcare provider and the MD manufacturer before deploying updates and after the end of service (EOS) of devices^22,29,31.

In the included documents, multiple issues were identified that bring particular technical challenges to the process of conducting a BRA. Firstly, cybersecurity-related risks could be difficult to assess, especially in a quantitative manner, due to the unpredictable nature of vulnerabilities^{10,22–24,37}. Those vulnerabilities appear over time, e.g., through proactive attacks targeting specific aspects of devices or, more commonly, through bugs in standard software libraries or components⁴¹, and zero-day exploits (unknown vulnerabilities that can be exploited before they are publicly known and mitigated⁴²). ISO TR 24971:2020 acknowledges the existence of such hard-to-quantifiable risks which could also be connected to other new technologies such as artificial intelligence^43–45, gamification⁴⁶, or virtual reality^47,48, but considers them still as relevant for the BRA¹¹. Secondly, updating devices could also lead to harm primarily regarding the availability of products during the update phase, which needs to be considered within the BRA^20,22,23,29. Thirdly, the end of service (EOS) of a device needs to be considered: devices that no longer receive updates and security patches (post-EOS) become susceptible to cybersecurity threats³¹. Fourthly, there is the need to balance security measures, since both too weak and overly restrictive security measures could pose risks¹²: Weak measures do not provide adequate protection, e.g., for personal data, while overly restrictive measures hinder device usability. Additionally, implementing a risk control measure to reduce one risk can introduce new risks, e.g., when adding a higher authentication standard (e.g., two-factor authentication) to address the risk of the disclosure of patient data could limit the accessibility of the device in case of an emergency¹¹. Lastly, for cMDs, the whole IT infrastructure needs to be considered when assessing cybersecurity-related risks^35,38, i.e., with a network-level risk assessment, since cMDs usually exchange data with multiple other devices and services, some of which are MDs, while some are not. Additionally, the implementation of a new device into an existing infrastructure might introduce vulnerabilities for the whole system.

Recommendations and Future Research

Based on our findings, we propose several recommendations for MD manufacturers on what should be considered when assessing cybersecurity-related risks in a BRA. Table 3 provides an overview of those recommendations. Manufacturers should create an SBOM to facilitate the BRA for regulators. A holistic BRA should always be conducted as part of the overall risk management process, and not only if unacceptable residual risks remain since a combination of risks could have a higher impact than each individual risk. Instead of conducting a BRA only for cybersecurity-related risks and benefits, a holistic BRA should be conducted, considering the overall residual risks including cybersecurity-related ones in the context of clinical benefits^12,19–21. In the BRA not only the cybersecurity-related risks for the individual device must be considered, but the impact of the implementation of the device into the IT infrastructure since the device might introduce new vulnerabilities that influence all other devices in the network. If residual risks remain, manufacturers should maintain good communication with patients and healthcare providers describing those risks without delivering a blueprint for an attacker³². The response to security events and the deployment of updates should be guided by a BRA since both could cause new risks for patients^20,22,23,29. Since previously unknown vulnerabilities could emerge in cMDs³⁷ that can change the benefit-risk ratio, the BRA must be conducted regularly. For devices after the EOS, the BRA, conducted by the healthcare provider, should consider the benefits and risks of using old devices versus acquiring new ones.

Table 3

**Recommendations on how to conduct a BRA that considers cybersecurity-related risks.** Besides the recommendation and its description, the phase of the MD lifecycle in which a recommendation is relevant for the BRA is provided.
Recommendation	Description	Phase
Prepare a Software Bill of Materials (SBOM).	Manufacturers should create an SBOM to facilitate the BRA for regulators.	Pre-market
Always conduct a BRA	The BRA should always be conducted as part of the overall risk management process and not only if unacceptable residual risks remain, as a combination of risks could have a higher impact than each individual risk.	Pre-market
Conduct a holistic BRA.	Instead of conducting a BRA for each cybersecurity-related risk individually, a holistic BRA should be conducted, considering the overall residual risks including cybersecurity-related ones, in the context of clinical benefits^12,19–21.	Pre-market and Post-market
Consider the whole IT-infrastructure.	In the BRA not only the cybersecurity-related risks for the individual device must be considered, but the impact of the implementation of the device into the IT-infrastructure since the device might introduce new vulnerabilities that influence all other devices in the network.	Pre-market and Post-market
Effective communication of residual risks.	If residual risks remain, manufacturers should maintain good communication with patients and healthcare providers describing those risks without delivering a blueprint for an attacker³².	Post-market
Guiding security event responses and updates by a BRA.	The response to security events and the deployment of updates should be guided by a BRA since both could cause new risks for patients^20,22,23,29.	Post-market
Conduct the cybersecurity BRA regularly.	Since previously unknown vulnerabilities could emerge in cMDs³⁷ that can change the benefit-risk ratio, the BRA must be conducted regularly.	Post-market
Consider a device’s EOS.	For devices after the EOS, the BRA conducted by the healthcare provider should consider the benefits and risks of using old devices versus acquiring new ones.	Post-market

While this review and the recommendations laid the groundwork for a better understanding of how to consider cybersecurity in the BRA, further development of methods for the assessment of cybersecurity-related risks and the incorporation of these risks in the BRA process is necessary. The absence of standardised frameworks for the BRA in general and for the evaluation of cybersecurity-related risks likely contributes to the current discrepancies between existing standards, technical documents, and guidance on these themes.

Additionally, the interaction between clinical benefits, cybersecurity-related risks, safety, and security should be explored further. The limitations of current guidance are demonstrated by the following example: A ‘traditional’ pre-digital laser device for surgical interventions at the eyes without any software running on the device and without any interfaces poses only safety risks. However, when adding a digital component, e.g., for a cloud connection, new security and safety risks, partly related to cybersecurity, arise. At this time, it remains unclear how those new risks would impact the security BRA as well as the overall BRA.

Understanding how these elements influence each other will help to develop more effective risk management strategies and a better understanding of what risks are tolerable in innovative MDs. As the technology develops, new attack vectors will emerge, e.g., through quantum computing, artificial intelligence, or previously undetected dormant faults. Research is needed to identify these potential threats and develop innovative mitigation strategies to counter and proactively approach them. This research should not only focus on single devices but should also consider whole infrastructures since MDs and non-MDs often exist in the same system.

Limitations

The results of this scoping review could be limited by several factors. First, our review focused exclusively on the EU and the US. This geographic limitation may reduce the applicability of our findings to other regions. Second, this scoping review has an analysis limited to MD-specific guidance documents and standards. This could have led to relevant principles described in standards from other areas not being considered. This has no limitation on the validity of the review of the current state-of-the-art for medical device cybersecurity risk assessment and BRA, but it could have limited the ability to suggest future directions for the further developments of standards.

Today, cybersecurity vulnerabilities in cMDs pose a growing risk to patients and healthcare providers^4,5,7,13,49. Therefore, the consideration of these risks in the BRA is essential to decide whether a MD is safe, secure, and should be made available on the market. While the recognition of cybersecurity risks in cMDs has increased^{10–12,22,23,37}, there is a significant gap between this acknowledgement and the practical implementation. Current regulations and guidelines in the US and EU, including those from the FDA, MDCG, and standards organisations, mandate the consideration of cybersecurity-related risks but lack detailed methods for incorporating them into the BRA.

To bridge this gap, it is essential for manufacturers and regulators to develop standardised frameworks that provide clear guidance on evaluating the impact of cybersecurity-related risks on the device's safety and security. Until such frameworks are developed, and the interaction between clinical benefits and cybersecurity risks are further explored and added to guidance and standards, we provide a set of recommendations for manufacturers and regulators, which we have been created by considering and integrating best practices from all the included documents in this review. These recommendations include a holistic approach to risk management and the BRA, assessing all residual risks in the context of clinical benefits, the constant update of the BRA due to new risks over the lifecycle of the MD, and the consideration of the infrastructure in which a MD operates. By adhering to these recommendations, stakeholders can better assess and balance the benefits and risks of cMDs, ultimately enhancing patient safety and device effectiveness.

Data availability

Data collected and used in this scoping review are available within the paper and its supplementary information files.

Acknowledgments

Funding

This work was supported by the European Commission under the Horizon Europe Program, as part of the project CYMEDSEC (101094218). Views and opinions expressed are, however, those of the author(s) only and do not necessarily reflect those of the European Union. Neither the European Union, nor the granting authorities, can be held responsible for them. Responsibility for the information and views expressed therein lies entirely with the authors.

Acknowledgement of AI Use

During the preparation of this work the author(s) used DeepL, Grammarly, and ChatGPT (in versions GPT-3.5, GPT-4, GPT-4o) in order to improve grammar, spelling, and readability of the manuscript. After using this tool/service, the author(s) reviewed and edited the content as needed and take(s) full responsibility for the content of the publication.

Author contributions

Contributions

O.F., and S.G. developed the design of the study. F.J., M.O., and O.F. conducted the screening. O.F., conducted the data extraction. F.J., M.O., and O.F., conducted the analysis. O.F. wrote the first draft of the manuscript. F.J., O.F., M.O., C.R., P.W., and S.G. contributed to the writing, interpretation of the content, and editing of the manuscript, revising it critically for important intellectual content. All authors had final approval of the completed version and take accountability for all aspects of the work in ensuring that questions related to the accuracy or integrity of any part of the work are appropriately investigated and resolved.

Corresponding author

Correspondence to: [email protected], TUD Dresden University of Technology, Else Kröner Fresenius Center for Digital Health, Fetscherstr. 74, 01307 Dresden

Competing interests

S.G. is an Advisory Group member of the EY-coordinated ‘Study on Regulatory Governance and Innovation in the field of Medical Devices’ conducted on behalf of the DG SANTE of the European Commission. Authors declare the following competing interests: S.G. has or has had consulting relationships with Una Health GmbH, Lindus Health Ltd., Flo Ltd, Thymia Ltd., FORUM Institut für Management GmbH, High-Tech Gründerfonds Management GmbH, Ada Health GmbH, and he holds share options in Ada Health GmbH. O.F. has worked as a freelance doctor for CRS Clinical Research Services Berlin GmbH, and has a leadership role and holds stock in WhalesDontFly GmbH. C.R. is an employee of Johner Institut GmbH and works and worked as a consultant for multiple medical device manufacturers. P.W. works as a regulatory consultant at regulatory.me and declares no competing interests associated with this research. F.J., and M.O. declare no competing interests.

Machal ML (2023) An Overview About Connected Medical Devices and Their Risks. Stud Health Technol Inf 305:119–122
Huang C, Wang J, Wang S, Zhang Y (2023) Internet of medical things: A systematic review. Neurocomputing 557:126719
Haghi Kashani M, Madanipour M, Nikravan M, Asghari P, Mahdipour E (2021) A systematic review of IoT in healthcare: Applications, techniques, and trends. J Netw Comput Appl 192:103164
Dwivedi R, Mehrotra D, Chandra S (2022) Potential of Internet of Medical Things (IoMT) applications in building a smart healthcare system: A systematic review. J Oral Biol Craniofac Res 12:302–318
Perakslis E, Ginsburg GS (2021) Digital Health—The Need to Assess Benefits, Risks, and Value. JAMA 325:127–128
Bauwens J, Ruckebusch P, Giannoulis S, Moerman I, Poorter ED (2020) Over-the-Air Software Updates in the Internet of Things: An Overview of Key Principles. IEEE Commun Mag 58:35–41
Bracciale L, Loreti P, Bianchi G (2023) Cybersecurity vulnerability analysis of medical devices purchased by national health services. Sci Rep 13:19509
Munoz Cornejo G, Lee J, Russell BA (2024) A thematic analysis of ransomware incidents among United States hospitals, 2016–2022. Health Technol. 10.1007/s12553-024-00890-3
Ralston W (2020) The untold story of a cyberattack, a hospital and a dying woman. Wired
International Organization for Standardization. ISO 14971:2019 (2019)
International Organization for Standardization. ISO/TR 24971:2020 (2020)
Medical Device Coordination Group (MDCG). MDCG 2019-16 Guidance on Cybersecurity for medical devices (2020)
Neprash HT et al (2022) Trends in Ransomware Attacks on US Hospitals, Clinics, and Other Health Care Delivery Organizations, 2016–2021. JAMA Health Forum 3:e224873
U.S. Food and Drug Administration (FDA) Manufacturer and User Facility Device Experience (MAUDE) Database. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfmaude/search.cfm
Klonoff D, Han J (2019) The First Recall of a Diabetes Device Because of Cybersecurity Risks. J Diabetes Sci Technol 13:817–820
U.S. Food and Drug Administration (FDA) Medical Device Recalls. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfres/res.cfm
Congress US (1938) United States Code: Federal Food, Drug, and Cosmetic Act
Parliament E, European Council (2017). Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on Medical Devices, Amending Directive 2001/83/EC, Regulation (EC) No 178/2002 and Regulation (EC) No 1223/2009 and Repealing Council Directives 90/385/EEC and 93/42/EEC (Text with EEA Relevance)Text with EEA Relevance
U.S. Food and Drug Administration (FDA). Factors to Consider When Making Benefit-Risk Determinations in Medical Device Premarket Approval and De Novo Classifications (2019)
U.S. Food and Drug Administration (FDA) (2016) Factors to Consider Regarding Benefit-Risk in Medical Device Product Availability, Compliance, and Enforcement Decisions -. Guidance for Industry and Food and Drug Administration Staff
Food US, and Drug Administration (FDA) (2019). Consideration of Uncertainty in Making Benefit-Risk Determinations in Medical Device Premarket Approvals, De Novo Classifications,Humanitarian Device Exemptions - Guidance for IndustryFoodDrug Administration Staff
U.S. Food and Drug Administration (FDA). Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions. (2023)
U.S. Food and Drug Administration (FDA). Postmarket Management of Cybersecurity in Medical Devices - Guidance for Industry and Food and Drug Administration Staff (2016)
U.S. Food and Drug Administration (FDA). Select Updates for the Premarket Cybersecurity Guidance: Section 524B of the FD&C Act. (2024)
Su G, Deng D (2023) Regulatory requirements and optimization of multiple criteria decision analysis to quantify the benefit-risk assessment of medical devices. Expert Rev Med Devices 20:273–281
Tricco AC et al (2018) PRISMA Extension for Scoping Reviews (PRISMA-ScR): Checklist and Explanation. Ann Intern Med 169:467–473
Page MJ et al (2021) The PRISMA 2020 statement: an updated guideline for reporting systematic reviews. BMJ 372:n71
Zuckerman DM, Brown P, Nissen SE (2011) Medical Device Recalls and the FDA Approval Process. Arch Intern Med 171:1006–1011
International Medical Device Regulators Forum (IMDRF). Principles and Practices for Medical Device Cybersecurity (2020)
International Medical Device Regulators Forum (IMDRF). Principles and Practices for Software Bill of Materials for Medical Device Cybersecurity (2023)
International Medical Device Regulators Forum (IMDRF). Principles and Practices for the Cybersecurity of Legacy Medical Devices (2023)
Association for the Advancement of Medical Instrumentation (AAMI). AAMI TIR57:2016 (R2023) (2023)
International Electrotechnical Commission (IEC). IEC/TR 80001-2-2:2012 (2012)
International Organization for Standardization. ISO/TR 80001-2-7:2015 (2015)
International Electrotechnical Commission (IEC). IEC 80001-1:2021 (2021)
International Electrotechnical Commission (IEC). IEC/TR 80001-2-1:2012 (2012)
International Electrotechnical Commission (IEC). IEC 81001-5-1:2021 (2021)
Association for the Advancement of Medical Instrumentation (AAMI). ANSI/AAMI SW96:2023 (2023) 10.2345/9781570208621.ch1
Parliament E, European Council (2017). Regulation (EU) 2017/746 of the European Parliament and of the Council of 5 April 2017 on in Vitro Diagnostic Medical Devices and Repealing Directive 98/79/EC and Commission Decision 2010/227/EU (Text with EEA Relevance). OJ L
Deutsches Institut für Normung DIN EN ISO 14971:2022–2004. 10.31030/3319146
Lins M, Mayrhofer R, Roland M, Hofer D, Schwaighofer M (2024) On the critical path to implant backdoors and the effectiveness of potential mitigation techniques: Early learnings from XZ. Preprint at https://doi.org/10.48550/arXiv.2404.08987
Bilge L, Dumitraş T (2012) Before we knew it: an empirical study of zero-day attacks in the real world. in Proceedings of the ACM conference on Computer and communications security 833–844 (Association for Computing Machinery, New York, NY, USA, 2012). 10.1145/2382196.2382284
Meskó B, Topol EJ (2023) The imperative for regulatory oversight of large language models (or generative AI) in healthcare. Npj Digit Med 6:1–6
Gilbert S, Harvey H, Melvin T, Vollebregt E, Wicks P (2023) Large language model AI chatbots require approval as medical devices. Nat Med 29:2396–2398
Freyer O, Wiest I, Kather JN, Gilbert S A future role for large language model health applications depends on regulators being brave enough to enforce safety standards (In Press). Lancet Digit. Health
Gilbert S, Freyer O, Wondra K (2024) The regulatory status of health apps that employ serious games and gamification. 10.21203/rs.3.rs-3731773/v1. Preprint at https://doi.org/
Freyer O, Gilbert S (2023) Bridging between hype and implementation in medical extended reality. Npj Digit Med 6:1–3
Souchet AD, Lourdeaux D, Pagani A, Rebenitsch L (2023) A narrative review of immersive virtual reality’s ergonomics and risks at the workplace: cybersickness, visual fatigue, muscular fatigue, acute stress, and mental overload. Virtual Real 27:19–50
He Y, Aliyu A, Evans M, Luo C (2021) Health Care Cybersecurity Challenges and Solutions Under the Climate of COVID-19: Scoping Review. J Med Internet Res 23:e21747

The authors declare potential competing interests as follows: S.G. is an Advisory Group member of the EY-coordinated ‘Study on Regulatory Governance and Innovation in the field of Medical Devices’ conducted on behalf of the DG SANTE of the European Commission. Authors declare the following competing interests: S.G. has or has had consulting relationships with Una Health GmbH, Lindus Health Ltd., Flo Ltd, Thymia Ltd., FORUM Institut für Management GmbH, High-Tech Gründerfonds Management GmbH, Ada Health GmbH, and he holds share options in Ada Health GmbH. O.F. has worked as a freelance doctor for CRS Clinical Research Services Berlin GmbH, and has a leadership role and holds stock in WhalesDontFly GmbH. C.R. is an employee of Johner Institut GmbH and works and worked as a consultant for multiple medical device manufacturers. P.W. works as a regulatory consultant at regulatory.me and declares no competing interests associated with this research. F.J., and M.O. declare no competing interests.

SupplementaryInformation1PRISMAScrChecklist.pdf

Download PDF

Version 1

posted

You are reading this latest preprint version

Consideration of Cybersecurity in the Benefit-Risk Analysis of Medical Devices: A Scoping Review and Recommendations

Status:

Version 1

Abstract

Figures

Introduction

Methods

Search strategy

Inclusion and exclusion criteria

Study selection

Data Extraction and Analysis

Results

Search Results

Source characteristics

Regulations in the EU and the US

Guidelines for the BRA and Cybersecurity

Standards for the BRA and Cybersecurity

Discussion

Principal Results

Benefit-Risk Analysis and Cybersecurity

Recommendations and Future Research

Limitations

Conclusion

Declarations

Data availability

Acknowledgments

Funding

Acknowledgement of AI Use

Author contributions

Contributions

Corresponding author

Competing interests

References

Additional Declarations

Supplementary Files

Status:

Version 1