Consideration of Cybersecurity in the Benefit-Risk Analysis of Medical Devices: A Scoping Review and Recommendations

Abstract

The integration of connected medical devices (cMDs) in healthcare brings benefits but also introduces new, often challenging-to-assess risks related to cybersecurity. Addressing those risks in the benefit-risk analysis (BRA), an integral step in the approval process, is required by regulations in the EU and US. This scoping review aims to identify current legal frameworks, guidelines, and standards in the US and EU on how cybersecurity-related risks should be considered in the BRA. We identified 21 documents issued by multiple standard organisations and regulatory agencies. While guidelines recognise cybersecurity-related risks, they lack the description of detailed methods. Some standards and technical reports provide methods and examples for a security BRA, while others only loosely describe methods that could be adapted to consider cybersecurity-related risks. Some separate security and safety BRAs, while others call for holistic approaches. To enhance patient safety and device effectiveness, standardised frameworks for cybersecurity-related risks should be developed.