Examining the information security risks of certain active medical devices, especially with respect to intentional threats, is a relatively new field for federal regulators and information security researchers. However, information security risks have long been previously considered in other contexts, such as federal information systems and the nation’s critical infrastructure. Two commonly used active medical devices that incorporate electronics and wireless communications are defibrillators, including the wands and programmers used to set and adjust the defibrillators, and insulin pumps. A defibrillator is an active medical device that is implanted in a person’s chest or abdomen. The defibrillator monitors a person’s heart rhythm and delivers an electric pulse to the heart muscle to reestablish a normal heart rhythm when an abnormal heart rhythm is detected. A wand is an external device that connects to a programmer—a specialized computer used to transmit data and to check the defibrillator’s functionality and usage. The wand, also called a programmer head, is held within inches of the defibrillator. The wand facilitates the wireless communication between the programmer and the defibrillator to, for example, make adjustments to the device (see fig. 1). An insulin pump is an active medical device used in the treatment of diabetes. It replaces the need for periodic injections by delivering rapid-acting insulin using tubing that is partially implanted into the body, such as in the abdomen. Certain types of insulin pumps can work in tandem with a continuous glucose monitoring system, which regularly measures glucose levels in the blood. This monitoring system consists of a sensor inserted under the skin and an external monitor, which can be carried or attached to a person’s belt. For insulin pumps working with a monitoring system, glucose measurements are wirelessly transmitted from the sensor to the monitor or from the sensor to the insulin pump (see fig. 2). Addressing information security involves the consideration of threats, vulnerabilities, and the resulting risks. Information security threats are any circumstances or events with the potential to adversely affect operations, assets, or individuals by means of unauthorized access, destruction, disclosure, modification of information, denial of service, or a combination of these. These threats can be either unintentional, such as interference from energy generated by other devices or from the surrounding environment, or intentional, as recently demonstrated by information security researchers. Vulnerabilities are weaknesses in security procedures, internal controls, or implementation that could be exploited or triggered by a threat. Risk is a measure of the extent to which an entity is threatened by a potential circumstance or event, and is typically a function of the adverse effects that would arise if the circumstance or event occurs and the likelihood of occurrence. Medical devices that use electronics, wireless communications, and other features are exposed to a greater number of threats, vulnerabilities, and resulting information security risks. FDA is the federal agency primarily responsible for evaluating the safety and effectiveness of medical devices through its premarket and postmarket efforts. FDA’s regulation of medical devices is intended to provide the public with reasonable assurance that medical devices are safe and effective and do not pose a threat to the public’s health. FDA reviews thousands of submissions for new devices filed each year, a small subset of which are subject to FDA’s PMA review process.PMA review process is the most stringent type of FDA device review and The requires manufacturers to submit evidence providing reasonable assurance that a new device is safe and effective. A PMA submission should contain administrative, scientific, and technical elements including, among other things, a description of the device model and components, documentation of clinical and nonclinical studies, and a reference to performance standards. If FDA approves a PMA submission, the manufacturer receives a PMA approval order. A multidisciplinary team of FDA officials, which includes relevant subject-matter experts, reviews these submissions. Additionally, FDA officials can consult with staff from its Office of Science and Engineering Laboratories who specialize in electronics, software engineering, and systems engineering. FDA can also consult with external experts, such as relevant advisory committees, which include experts in engineering and physical sciences and industry representatives. As relevant to the wireless medical devices discussed in this report, FDA may contact FCC, as needed, on certain specific, scientific or technical issues. FCC reviews certain medical devices sold in the United States to ensure that these devices meet its regulations for safe human exposure to radiofrequency energy and to ensure that requirements intended to avoid harmful interference between devices using radio waves are met. The defibrillator and insulin pump we included in our evaluation were reviewed under FDA’s PMA review process. FDA’s postmarket responsibilities include monitoring the safety of thousands of medical devices already on the market and identifying, analyzing, and acting on potential risks the devices might pose to the public. One of FDA’s postmarket efforts is its adverse event reporting system, called the Manufacturer and User Facility Device Experience Database (MAUDE). FDA requires user facilities (e.g., hospitals) and medical device manufacturers to submit reports to the agency for serious injuries or deaths that were caused or contributed to by their devices. In addition, FDA may require that a manufacturer conduct a study on its device to gather and report additional information on the device’s performance after it is available on the market.additional information on FDA’s adverse event reporting systems. DHS and NIST also have responsibilities related to mitigating information security risks, which could include those affecting medical devices. DHS’s responsibilities include collaborating with public and private entities to analyze and reduce information security threats and vulnerabilities. DHS also coordinates preparedness activities across 18 critical- infrastructure sectors—one of which is health care—and the response efforts to information security incidents. It does this through several activities, including a reporting and alerting system of information security risks, which can include medical devices, and research and forensic activities. For example, DHS has a program where an individual or organization that becomes aware of a vulnerability can share this potentially sensitive information with the agency, which will then coordinate a response in a protected manner with vendors, customers, and other interested parties. For vulnerability information that is publicly released, DHS also supports the efforts of NIST to maintain a National Vulnerability Database that allows users to search for information security vulnerabilities pertaining to specific products or technologies. NIST is a nonregulatory, federal agency within the Department of Commerce. Under the Federal Information Security Management Act, NIST is responsible for developing standards and guidelines to assist federal agencies in providing adequate information security for federal information and information systems. These guidelines, while targeted at federal agencies, can also be used to assess and mitigate security risks for other types of information systems and electronic devices. In addition to NIST, other organizations, such as the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), have developed and published Similar to NIST various standards related to information security.guidelines, these standards describe information security control areas and related criteria that could be applied to certain types of medical devices to assess and mitigate information security risks. Additionally, for the past 30 years, FDA has issued guidance documents related to information security risks to medical devices resulting from unintentional threats, such as electromagnetic interference. More recently, FDA has issued draft guidance documents on using wireless technology and software in medical devices, which reference for example, the integrity and availability aspects of information security. recommends that manufacturers consult its guidance documents when designing and developing medical devices and preparing their submissions for review. FDA’s guidance documents also reference national guidelines and international standards developed by external organizations. FDA recommends, though does not require, that manufacturers consult these other guidelines and standards that might be relevant to the design and development of their medical devices. For example, FDA’s guidance document on general principles of software validation cites several NIST special publications on information technology as references for both staff and manufacturers. FDA, Draft Guidance for Industry and FDA Staff: Radio Frequency Wireless Technology in Medical Devices (Rockville, Md.: Jan. 3, 2007), Guidance for Industry and FDA Staff: Guidance for the Content of Premarket Submissions for Software Contained in Medical Devices (Rockville, Md.: May 11, 2005), and Draft Guidance for Industry and FDA Staff: Total Product Life Cycle: Infusion Pump – Premarket Notification Submissions (Rockville, Md.: Apr. 23, 2010). National guidelines and international standards identify information security control areas to consider when identifying, assessing, and mitigating information security risks. Full implementation of all information security controls may not be necessary or appropriate for the mitigation of information security risks. Rather, control areas should be considered to determine what benefits should be implemented to obtain an acceptable level of information security risk. Table 1 includes a list of key information security control areas we determined were important to consider for medical devices. Within each information security control area, multiple controls, safeguards, or countermeasures can be selected to protect a system. Implementation of a risk-based approach to information security involves selecting, implementing, and monitoring appropriate controls within each control area. In cases where it is not feasible to implement a particular control, an organization can either implement compensating controls in other areas or accept a certain level of uncertainty regarding the risk as part of a formal authorization process that balances identified risks with the operational needs of a system. Several information security threats have the potential to exploit different vulnerabilities in active implantable medical devices. These threats could be unintentional or intentional in nature. Vulnerabilities can include those related to, for example, the design of the device, such as limited battery capacity. The information security risks resulting from these threats and vulnerabilities could compromise the safety and effectiveness of medical devices. However, federal officials and information security researchers said efforts to mitigate these risks could adversely affect devices’ performance. Information security threats with the potential to exploit vulnerabilities can result from unintentional sources. Table 2 identifies and describes key unintentional threats to active implantable medical devices that could affect their functionality. Threats can also result from intentional sources such as those identified and described below in table 3. These key threats could also affect the functionality of active implantable medical devices. Several of the experts we consulted noted that certain intentional information security threats were of greater concern than other threats. For example, approximately half of the nine experts expressed greater concern regarding the threats of unauthorized access or denial-of-service attacks, with two experts citing their own research related to unauthorized access in controlled settings. Additionally, experts made distinctions among intentional threats and the likelihood of their occurring. For example, one expert cited malware as one of the greatest threats to active implantable medical devices because his work demonstrated the device could accept unauthentic firmware updates. However, other experts considered malware as less of a concern because, according to these experts, certain devices are currently designed so that it would be difficult to install and propagate malware. Experts expressed less concern with unintentional threats to medical devices. For example, some of the experts that commented on our list of key threats considered unintentional interference, such as from electromagnetic signals in the environment, as less of a concern than other threats, in part, because FCC regulates radio use so as to avoid harmful interference. Additionally, FDA regulates the potential effects such interference could have on medical devices’ performance, and manufacturers have focused on this type of unintentional threat for over 10 years. Various potential vulnerabilities in active implantable medical devices are susceptible to exploitation by the unintentional and intentional threats described above. Table 4 below identifies and describes key potential vulnerabilities in these medical devices. The experts we consulted also noted that addressing these vulnerabilities in active implantable devices could create additional challenges. For example, several of the experts with whom we spoke noted that one way in which medical devices are vulnerable is that they have limited or nonexistent authorization and authentication capabilities; that is, the devices do not distinguish between communications from authorized and unauthorized users. However, several experts also noted that implementing typical protocols to ensure appropriate authorization creates potential access and safety challenges. These challenges could arise if enhanced authorization procedures hindered health professionals’ ability to provide care to patients in emergency situations. For example, a physician in the emergency room might not be able to make life-saving modifications to a patient’s pacemaker if the physician does not have the appropriate authorization to access the device. Information security risks resulting from the exploitation of vulnerabilities by threats could adversely affect the safety and effectiveness of active implantable medical devices. As technology evolves and medical devices become more complex in design and functionality, the potential for these risks occurring is also likely to increase. According to DHS, in order for medical devices to be considered safe, they must also be secure. Key information security risks to these medical devices and related examples are described in table 5. Several federal officials and information security researchers noted that some information security risks to active implantable medical devices have long been considered by FDA and manufacturers, such as device failures resulting from different sources of unintentional interference. For example, in the late 1960s, concerns were raised regarding the interference of electromagnetic energy on implanted pacemakers, potentially resulting in the device not working properly. These concerns prompted FDA to release guidance on electromagnetic energy and medical devices. In the late 1990s, FDA became aware of interference between electromagnetic energy generated from antitheft systems and metal detectors with other implanted devices, such as neurostimulators, potentially resulting in an inappropriate jolt or shock (see fig. 3). FDA and manufacturers now recommend that those with neurostimulators avoid lingering near or leaning against such systems and metal detectors. In contrast, federal officials and information security researchers noted that, to date, there have been no documented information security incidents resulting from the exploitation of vulnerabilities in these types of medical devices by intentional threats in real-world settings. However, there have been four separate demonstrations in controlled settings, showing that the intentional exploitation of vulnerabilities in certain medical devices is possible. Each of these demonstrations involved laboratory tests and did not result in patient harm or death. The first demonstration occurred in 2008, when a team of academic researchers, working in a controlled setting, showed that they could remotely exploit a defibrillator by delivering a command, using the associated wand and programmer. A second demonstration occurred in 2010, when a team of academic researchers remotely exploited an insulin pump, preventing it from operating properly. Two additional demonstrations occurred in 2011, when two security experts, also working in controlled settings, showed on separate occasions that they could also remotely exploit an insulin pump. Both of these experts demonstrated they could manipulate the amount of insulin dispensed by the device. These demonstrations occurred at varying distances. For example, one demonstration occurred at a distance of 100 feet, while another occurred at approximately 300 feet. Figure 4 below depicts an example of a demonstration of the exploitation of a medical device’s vulnerability. According to manufacturer officials, medical devices undergo testing for vulnerabilities that could be exploited. The identified vulnerabilities are then addressed. However, these officials acknowledged that recent incidents have increased their awareness of potential information security risks resulting from intentional threats and have resulted in changes in testing procedures. For example, according to officials from one manufacturer, information security risks resulting from malicious intent are now being considered, and officials are incorporating enhanced security procedures into the design of their medical devices. These officials also stressed that these demonstrations by information security researchers, while informative, should not overshadow the clinical benefits offered by medical devices. Federal officials and information security researchers we spoke with noted that some mitigation strategies could adversely affect certain medical devices’ performance. For example, a pacemaker cannot be immune to all electrical signals because the device needs to be able to detect the electrical signals naturally generated by the patient’s heart to determine if the pulses are irregular. Similarly, for the information security risk associated with using older versions of software, a potential mitigation strategy would be to have these medical devices operate using newer versions. However, according to FDA officials, software in implanted medical devices, such as pacemakers, typically is not frequently updated; rather, the software is updated on an as-needed basis. As with any device that uses software, such updates or other modifications could introduce unanticipated software problems that could adversely affect the functionality of a device, particularly if the software had not been properly tested prior to being used. According to FDA, the majority of software-related medical device problems occur because devices are using software that has been revised since the medical device was reviewed by FDA. FDA officials explained that manufacturers choose to rely on older software because its vulnerabilities are better understood by both manufacturers and regulators. Federal officials and other experts also noted that addressing information security risks for certain medical devices involves additional safety considerations that are not typically necessary for other types of products. For example, incorporating encryption into the medical device could mitigate the information security risk of unauthorized changes to the settings of the device. However, experts we spoke with said adding encryption to a device could drain its battery more quickly, making it necessary to change the battery more frequently. Changing the battery for active implantable devices, such as a pacemaker, involves undergoing a surgical procedure, which has its own potential health risks. In contrast, two information security researchers we spoke with said that, in their opinion, technology has advanced such that encryption can be added to a medical device without using as much energy as before. However, manufacturers have chosen not to take advantage of this newer technology, in part, because of the potential for increased costs in producing the device, according to other experts. FDA officials and other experts also noted that information security risks could vary for different devices because each device has unique vulnerabilities and a device’s susceptibility to threats is based on factors such as its design. For example, FDA officials noted that the wireless capabilities between a defibrillator and the associated wand and programmer are different than those used by certain insulin pumps. These differences not only affect how these respective devices operate, but also the susceptibility to information security threats. An increasing awareness of intentional and unintentional information security threats, vulnerabilities, and resulting risks to medical devices now exists. Addressing these risks requires a comprehensive approach that balances mitigating potential information security risks and maintaining a device’s safety and effectiveness. For the two medical devices that have known vulnerabilities, FDA considered information security risks from unintentional threats, but not risks from intentional threats during its premarket review of the related supplements. FDA stated that it did not generally consider intentional information security threats in its review process at the time these devices were reviewed. FDA officials also told us the agency intends to enhance its information security efforts by reviewing how it approaches the evaluation of software used in medical devices. However, the agency has not yet defined specific, information security-related areas it will examine as part of this review, nor has it established specific milestones for completing it. In the reviews of two PMA supplements for medical devices with known vulnerabilities conducted in 2001 and 2006, FDA officials considered information security risks resulting from unintentional threats, but not from intentional threats. Specifically, FDA considered information security risks in four of the eight information security control areas we selected— software testing, verification, and validation; risk assessments; access control; and contingency planning (see table 6 below and app. IV for more details on our evaluation). We reviewed the PMA supplements and supporting documentation for a defibrillator and its associated wand and programmer, and for a specific wireless insulin pump system that incorporates a continuous glucose monitor. For example, FDA reviewed the manufacturer’s strategy to mitigate information security risks associated with software testing, verification, and validation resulting from unintentional threats to the wand and insulin pump from radio frequency and electromagnetic energy. Additionally, FDA officials told us that the manufacturer addressed access control for the defibrillator, wand, and programmer by requiring that they be used collectively in order to make adjustments. In order to have its settings changed, the defibrillator must communicate with the programmer. The wand, which facilitates the communication between the defibrillator and the programmer, is designed to be used within inches of the defibrillator. All three of these devices are designed to be used together in a health care setting. However, FDA did not consider risks from unintentional threats for the four remaining information security control areas—risk management, patch and vulnerability management, technical audit and accountability, and security-incident response. Additionally, FDA did not consider information security risks resulting from intentional threats for any of the eight information security control areas. Specifically, on the basis of the support the agency provided for these two PMA supplements, FDA did not demonstrate that it had considered the potential benefits of mitigation strategies to protect devices against information security risks from certain unintentional or intentional threats in light of the appropriate level of acceptable risk for medical devices with known vulnerabilities. FDA officials told us that since the agency reviewed these PMA supplements in 2001 and 2006, respectively, their consideration of information security has changed. To support this, FDA provided additional examples from an original PMA application for a defibrillator reviewed in 2012. This additional evidence showed that the agency had generally enhanced its consideration of information security during its PMA review for those four information security control areas previously identified—software testing, verification, and validation; risk assessments; access control; and contingency planning. For example, FDA conducted a more comprehensive review of the manufacturer’s software verification and validation documentation, and included software-testing documentation, electromagnetic-compatibility testing, electromagnetic- interference testing, and frequency testing. FDA also provided evidence of its consideration of a fifth information security control area—risk management—in this newer PMA application. However, FDA did not provide any evidence showing its consideration of security-specific tests. For example, FDA did not provide evidence showing testing of attempts to enter incorrect or invalid data in the device or the use of fuzzing, an information security-related testing technique that uses random data to discover software errors and security flaws. FDA also did not demonstrate its consideration of information security risks resulting from unintentional threats related to the remaining three information security controls we selected, including patch and vulnerability management, despite guidelines from NIST and other sources on the importance of these issues. Additionally, when reviewing the manufacturer’s risk management plan, FDA did not consider information security risks resulting from intentional threats. Thus, while it continues to consider some information security risks resulting from unintentional threats, such as interference, FDA has not begun to consider risks resulting from intentional threats. FDA officials acknowledged the limitations of their review process for information security issues. They explained that, as part of the agency’s PMA review process, they consider various risks with a focus on the most relevant risks that could result in harm to patients. According to officials, they tend to consider the most relevant risks to be clinical risks, such as an increased risk of heart failure from having an implanted defibrillator, and not information security risks, such as the reprogramming of a device by a malicious actor. FDA officials said they also consider the intended use of the device and the type of setting in which the device will be used, both of which are determined by the manufacturer. For example, FDA officials would review a scalpel for potential clinical risks resulting from its intended use in a clinical setting. However, the agency cannot control how devices are used in other settings, or if devices are misused. They noted that a scalpel could become a dangerous weapon if misused by a malicious actor. FDA officials also noted that they consider information security risks in the context of a clinical situation. For example, officials said they have long considered information security risks resulting from unintentional threats, such as from interference or from defective software. However, they acknowledged they have only recently considered information security risks resulting from intentional threats because they did not previously consider such threats as reasonable and likely at the time of their earlier reviews in 2001 and 2006. They noted that, although conducted in controlled settings, researchers’ recent demonstrations of vulnerabilities in two medical devices support the possibility that incidents caused by information security risks resulting from intentional threats could occur. FDA officials said that in the future the agency intends to enhance its efforts related to information security. For example, officials said the agency will consider information security risks resulting from intentional threats when reviewing manufacturers’ submissions for new devices. Officials said that they will consider whether the manufacturer identified the appropriate information security risks resulting from intentional threats and, if applicable, what proposed mitigation strategies the manufacturer included. FDA officials also told us that the agency is currently planning to review its approach to evaluating software used in medical devices. Officials said the review of its approach will be conducted by a contractor and will involve an analysis of how the agency considers software in medical devices during premarket reviews. This review is to include an examination of FDA’s resources and evaluative tools. It will also include a comparison of FDA’s approach to reviewing software in medical devices to the approaches of other sectors that also make or use high-risk and complex software products, such as the aviation and nuclear industries. According to officials, this effort is also intended to identify external resources the agency can draw upon for evaluating information security risks, such as those supported by other federal agencies. For example, FDA officials said they currently do not utilize information security resources available from DHS and NIST, such as the National Vulnerability Database, but acknowledged that such a database could be a useful tool in identifying vulnerabilities relevant to medical devices. According to the agency’s preliminary planning information, the FDA review does not explicitly mention information security issues such as malware, patching and vulnerability management, or the use of security- related testing techniques. Additionally, in commenting on a draft of this report, HHS noted that FDA anticipates completing the review on the agency’s approach to evaluating software in medical devices in calendar year 2012. HHS also noted that FDA will include an assessment of information security risks for medical devices. However, HHS did not provide any milestones, including for when any changes might be implemented, or any description for how this review would address specific aspects of information security. By not identifying which specific aspects of information security the agency intends to consider in its review or establishing a specific schedule to demonstrate that it is addressing the emerging issue of intentional threats, FDA may miss an opportunity to more fully consider information security issues in its medical device review process. FDA has various postmarket efforts in place to identify problems with medical devices, including those related to information security. Despite having postmarket efforts in place, FDA faces challenges in using them to identify information security problems. FDA has various postmarket efforts in place to identify problems with medical devices once they have been approved for marketing, including any problems related to information security. One of these efforts is its adverse event reporting system, MAUDE. MAUDE stores adverse event reports submitted by reporters, which include manufacturers, user facilities (e.g., hospitals), and voluntary reporters. FDA requires manufacturers and user facilities to submit information regarding adverse events involving medical devices and submit reports on these events to FDA. However, FDA does not have these same requirements for other medical device users, including consumers and health care providers. Regardless of whether reporters are required to submit adverse event reports, FDA must wait for reporters to recognize and submit information on suspected adverse events before the agency can become aware of and identify device problems through this system. For those adverse events that are reported, FDA stated that it is able to conduct systematic reviews and searches of these reports. According to FDA, it systematically reviews all information that it receives in the MAUDE database and follows up with reporters when the agency believes that such follow-up is necessary or would provide additional, useful information. Additionally, FDA can search within MAUDE to determine if any of the reporters cited information security issues when submitting details about the adverse events. Searches can be conducted using categories of codes that FDA has developed. These codes are used by reporters to describe types of adverse events. These codes include device-problem codes that are used to describe details such as the reason behind a device’s failure. According to FDA officials, there are 10 codes in MAUDE that reporters primarily could select when reporting an adverse event to indicate—and allow FDA to subsequently identify—that an information security problem had occurred. For example, 3 of these codes are used to describe adverse events that resulted from (1) an application issue, (2) the unauthorized access to a computer system, or (3) a computer-security issue. Using these 10 codes, FDA had not identified any information security problems involving active implantable medical devices, as of April 2012. In addition to these 10 codes, we identified additional codes that could indicate an information security problem had occurred due to an unintentional threat. Using these additional codes, FDA has identified potential information security problems involving active implantable medical devices. For example, one adverse event involved a pacemaker and a computer-software issue. Specifically, the pacemaker’s programmer was slow to start and experienced some errors, but no patient involvement or complications were reported and the programmer was returned for repair. Thus, although FDA does not categorize its codes as specifically related to information security problems, it has codes in place that could potentially identify information security problems resulting from both unintentional and intentional threats. A second postmarket effort that FDA has in place to identify problems is its process for requiring manufacturers to conduct postmarket surveillance studies. Manufacturers may be required to conduct postmarket surveillance studies to continue to systematically evaluate device performance while the device is in commercial distribution. For example, FDA officials could order a postmarket surveillance study for a defibrillator because its failure would have serious adverse health effects for a patient. It is possible these studies could identify vulnerabilities or unintentional threats that might adversely affect medical devices, but postmarket surveillance studies typically focus on clinical outcomes that might affect patients. At the time of our review, FDA officials said that, while they could require manufacturers to conduct postmarket studies to focus on information security risks, they did not currently have plans to request that any manufacturers do so. FDA officials explained that these studies are intended to address residual questions from clinical trials for a medical device. These lingering questions typically relate to the medical device’s clinical risks to patients, such as whether the use of a particular device is appropriate for a specific patient population, rather than to its information security risks. A third postmarket effort is FDA’s requirement for manufacturers to prepare annual PMA postapproval reports (annual reports). Among the issues manufacturers must include in these reports are the rationales for any changes they made to the medical device during the preceding year, including changes made because of an adverse event. For example, these annual reports could potentially include information related to a problem due to an information security risk if the problem led the manufacturer to change the device, such as a modification to the device’s software. Manufacturers are also required to include any information about defects related to their medical devices that have been identified in scientific literature—including published reports on clinical studies of similar devices or unpublished reports of data from clinical investigations involving their devices—that are known or that reasonably should be known to them. We reviewed the annual reports for the two active medical devices with known vulnerabilities to determine if the manufacturer had noted the research conducted by information security researchers demonstrating the devices’ susceptibility to intentional threats. For the defibrillator, we found references to other published reports discussing adverse events resulting from unintentional threats, such as from the adverse effect electromagnetic interference had on the defibrillator’s functionality. However, no potential information security problems due to intentional information security threats were included in these reports, including any references to the 2008 exploitation by researchers. Additionally, no potential information security problems were included in the annual reports we reviewed for the insulin pump exploited by researchers in 2010. Despite having postmarket efforts in place, FDA faces challenges with identifying information security problems, should they occur. We have previously reported on some challenges associated with adverse event reporting, such as the inherent weaknesses associated with passive surveillance systems. For example, MAUDE is a passive system and FDA relies upon reporters to recognize and submit information on suspected adverse events. According to FDA, because of this dependence upon reporters, significant underreporting occurs. This underreporting affects FDA’s ability to estimate the magnitude of a problem because the number of reports submitted might not be representative of the total number of patients that experienced the adverse event. Underreporting can also occur because individuals are either unfamiliar with reporting requirements for devices or because reporting can be time- consuming. Additionally, FDA and other experts told us that underreporting of information security problems in medical devices could result from a lack of understanding or awareness among adverse event reporters about how information security problems apply to these devices. They noted that information security is a relatively new issue area with respect to its applicability to medical devices, which could make it a difficult type of problem to understand and report to FDA. Some health care providers might not fully understand, and therefore may not report, information security problems whether resulting from unintentional or intentional threats, as providers have instead been trained to focus on clinical problems associated with medical devices. FDA officials said that they were uncertain if reporters would recognize that an information security problem was relevant or even had occurred. For example, an adverse event report could note that a patient complained of chest pains and experienced an increase in heart rate, but the report might not include any indication that a possible information security issue was a factor; that is, the reporter might not note that the patient’s device had recently been programmed because the health care provider did not consider this information relevant or necessary. Besides underreporting, another weakness inherent in MAUDE is FDA’s inability to establish causality because reporters might submit insufficient or inadequate information about an adverse event. For example, a reporter might fail to include specific details about an adverse event— such as that the event occurred while a medical device was being reprogrammed. Because the manufacturer generally conducts any follow- up investigation, if FDA wanted more information about an adverse event, FDA could notify manufacturers in writing that the agency required additional information about manufacturers’ reports. However, FDA officials told us that the more time passes from the time an adverse event occurred to the actual investigation, the more difficult it is to obtain detailed information. Also, officials request additional information from manufacturers on a case-by-case basis. In addition to the challenge of establishing causality, FDA officials told us it would also be difficult to determine the motivation behind an adverse event, such as if it was caused by a malicious actor. Without such details and contextual information related to the cause of and motivation behind an adverse event, FDA would be limited in its ability to later identify the problem as related to information security and determine if it resulted from an intentional threat. Because of these inherent weaknesses associated with MAUDE as a passive surveillance system, it is possible that information security problems involving medical devices could have occurred but not have been reported to FDA or have not been identified as information security problems by the agency. FDA has two planned initiatives that are intended to improve its postmarket efforts in order to more accurately identify and analyze problems associated with medical devices. According to FDA, these initiatives are not specifically intended to improve FDA’s ability to identify information security problems; however, these initiatives might strengthen FDA’s ability to do so by providing the agency with additional information. One initiative is the Unique Device Identification effort for the postmarket surveillance of devices, which, according to FDA, will allow the agency to aggregate adverse event reports in order to more accurately analyze them when conducting signal analyses. The initiative will also allow FDA to identify specific devices included in adverse event reports, allowing for more rapid and effective corrective actions that can focus on specific devices, according to one agency official.us that although this effort was not specifically designed to help FDA identify information security problems involving medical devices, it will help FDA identify specific device models that could encounter information security problems. Once operational, this new system will replace MAUDE as FDA’s passive surveillance system for devices and will be compatible with FDA’s drug and vaccine adverse event reporting systems to allow for cross-center communication within the agency. Such communication may be useful in handling drug-device or biologic-device issues that may be found in combination products. the capacity or complexity of medical device adverse event information that exists today. FDA expects the new system—the FDA Adverse Event Reporting System—to perform similar functions as MAUDE but also allow for greater capacity for storing adverse events and enhanced search capability compared to MAUDE. However, according to FDA, transitioning from MAUDE to this new system will not automatically make it easier to identify information security problems because, like MAUDE, the system is designed to collect information that indicates that a medical device has caused or contributed to a serious injury or death, which is more closely associated with clinical risks than information security risks. Because this new system will also be a passive surveillance system, FDA will still rely on reporters to recognize and submit information on information security problems involving medical devices before the agency can search for and subsequently identify them. Still, FDA officials told us that this new system will also include the 10 codes that reporters currently can use to indicate that an information security problem has occurred. If FDA is able to conduct more complex searches under this new system, the search results might strengthen the agency’s ability to identify information security problems involving medical devices. As active implantable medical devices increasingly use newer technologies, such as wireless capabilities, their susceptibility to various information security risks also increases. Although the risks resulting from unintentional threats have long been known, information security risks resulting from intentional threats have only recently been confirmed. While FDA has considered some information security risks associated with unintentional threats during its PMA review process, such as interference, it has not considered others, such as patch and vulnerability management. Additionally, FDA has not considered information security risks resulting from intentional threats. FDA has also not utilized available resources, such as the National Vulnerabilities Database sponsored and maintained by DHS and NIST. Also, FDA’s postmarket efforts have several limitations, and it is unclear if the agency could successfully identify information security problems with active implantable medical devices were they to occur. Although FDA intends to review its evaluation of software used in medical devices, according to the agency’s preliminary planning information, the review does not explicitly mention information security issues such as malware, patching and vulnerability management, or the use of security-related testing techniques. Furthermore FDA has not established specific milestones, including for when it will implement any changes, for the review. To better ensure the safety and effectiveness of active implantable medical devices, we are recommending that the Secretary of Health and Human Services direct the Commissioner of FDA to develop and implement a more comprehensive plan to assist the agency in enhancing its review and surveillance of medical devices as technology evolves, and that will incorporate the multiple aspects of information security. This plan should include, at a minimum, four actions, such as determining how FDA can increase its focus on manufacturers’ identification of potential unintentional and intentional threats, vulnerabilities, the resulting information security risks, and strategies to mitigate these risks during its PMA review process; utilize available resources, including those from other entities, such as leverage its postmarket efforts to identify and investigate information security problems; and establish specific milestones for completing this review and implementing these changes. HHS, FCC, NIST (within the Department of Commerce), DHS, and the Departments of Defense and of Veterans Affairs reviewed a draft of this report. HHS provided written comments, which we have reprinted in Appendix V. HHS, FCC, NIST, and the Department of Veterans Affairs provided technical comments, which we have incorporated as appropriate. DHS and the Department of Defense did not provide comments on a draft of this report. A third party also reviewed relevant sections of this report and provided technical comments, which we have incorporated as appropriate. In its comments, HHS concurred with our recommendation and described relevant efforts FDA has initiated. HHS described FDA’s efforts to identify and address information security concerns to ensure the safety of medical devices. For example, HHS noted that FDA is establishing collaborative relationships with DHS, NIST, and the Department of Defense, and is engaging other stakeholders to consider the potential applicability of standards from other sectors, such as industrial control, to medical devices. HHS also noted FDA’s postmarket efforts to address information security, including evaluating and enhancing surveillance tools to identify and investigate information security problems. For example, HHS said FDA is in the process of releasing its “National Postmarket Surveillance Plan” designed to enhance national coordination of information sharing for adverse events related to medical devices. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies of this report to the Chairman of the FCC and the Secretaries of Commerce, Defense, Health and Human Services, Homeland Security, and Veterans Affairs and to other interested parties. The report will also be available at no charge on the GAO website at http://www.gao.gov. If you or your staff have any questions about this report, please contact Marcia Crosse at (202) 512-7114 or crossem@gao.gov or Gregory Wilshusen at (202) 512-6244 or wilshuseng@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made major contributions to this report are listed in appendix VI. The objectives of our review were to (1) identify the threats, vulnerabilities, and resulting information security risks associated with active implantable medical devices; (2) determine the extent to which the Food and Drug Administration (FDA) considered information security risks in its premarket approval (PMA) review process for certain active medical devices with known vulnerabilities; and (3) determine what postmarket efforts FDA has in place to identify information security problems involving active implantable medical devices. To identify the threats, vulnerabilities, and resulting information security risks associated with active implantable medical devices, we reviewed available publications, such as white papers published by information security researchers and peer-reviewed journal articles. We reviewed these publications to identify an initial list of threats, vulnerabilities, and resulting information security risks associated with these types of medical devices. These publications also included information related to the two devices that researchers have demonstrated are susceptible to intentional threats—an implantable cardioverter defibrillator (defibrillator) and an insulin pump. We also obtained relevant information through interviews with officials from federal agencies, including from FDA, the Department of Health and Human Services (HHS), the National Institute of Standards and Technology (NIST) within the Department of Commerce, the Department of Defense, the Department of Homeland Security (DHS), the Department of Veterans Affairs, and the Federal Communications Commission (FCC). We also interviewed manufacturer officials and subject-matter experts, including information security researchers and authors of standards related to information security. After developing these initial lists of threats, vulnerabilities, and information security risks, we sent them to experts to obtain their concurrence and comments. We selected these experts on the basis of their knowledge and familiarity with the information security of medical devices. Of the 15 experts to whom we sent our tables, 9 provided us with responses. We then analyzed these responses to validate our identified threats, vulnerabilities, and resulting information security risks associated with these medical devices. We did not include implantable medical devices lacking active components, such as hip implants. We limited our identification of threats, vulnerabilities, and information security risks to those associated with medical devices that deliver medicine, monitor body functions, or provide support to organs and tissues. Additionally, we limited our scope to the integrity and availability aspects of information security—which generally relate to the safety and effectiveness of medical devices—and not confidentiality, which generally relates to privacy. We focused on the potential effect that information security risks could have on the functionality of FDA-regulated devices and not on their ability to store or exchange personally identifiable information. NIST, Creating a Patch and Vulnerability Management Program, SP 800-40 Version 2.0 (Gaithersburg, Md.: November 2005). IEC 62304: 2006, Medical Device Software—Software Life Cycle Processes; IEC 60601-1: 2005, Medical Electrical Equipment—Part 1: General Requirements for Basic Safety and Essential Performance; IEC Standard 80001-1: 2010, Application of Risk Management for IT Networks Incorporating Medical Devices—Part 1: Roles, Responsibilities and Activities; ISO, International Standard 14971: 2007, Medical Devices— Application of Risk Management to Medical Devices; DHS, Recommended Practice for Patch Management of Control PCI Security Standards Council, Payment Card Industry Data Security various FDA guidance documents. These documents varied in detail from providing general rules at a high level to specific activities related to information security. From these documents, we determined the key information security controls and associated criteria that could be used to assess and mitigate information security risks for certain active medical devices. We did not conduct an extensive analysis of all information security controls that could be used in the evaluation of information security issues for these medical devices. Instead, we focused on eight key information security control areas that included a range of criteria that would be applicable when evaluating FDA’s review of information security risks in its PMA review process. The specific areas we selected were (1) software testing, verification, and validation; (2) risk assessments; (3) risk management; (4) access control; (5) patch and vulnerability management; (6) security-incident response; (7) contingency planning; and (8) technical audit and accountability. For each of these information security control areas, we selected the criteria that illustrated the range of activities that could be considered by FDA during its PMA review process. We then used these key information security control areas and associated criteria to develop a questionnaire for FDA to complete on the basis of its prior review of two PMA supplement applications (supplements). that have recently identified vulnerabilities, such as those devices that information security researchers have exploited in controlled settings, and discussions with FDA. We reviewed the PMA supplements rather than the original PMA applications in order to capture the most recent information related to these two devices. After an original PMA application is approved, a manufacturer can submit a supplement to the original PMA application to FDA for approval of changes, such as changes to the device or the manufacturing process used in its production. In general, subsequent changes that affect the safety or effectiveness of the device must undergo FDA’s PMA review process and manufacturers must submit a supplement to their original application for approval. We evaluated FDA’s responses to this questionnaire and supporting documentation, such as FDA’s review memorandums and other documents submitted by the manufacturer. FDA provided responses for one supplement related to the defibrillator exploited by information security researchers and responses and documentation for the programming wand (wand) and the programmer used with the defibrillator. FDA also provided responses and documentation for a second supplement related to the exploited insulin pump. The particular defibrillator and insulin pump we considered in our evaluation are the only two devices we identified that have been intentionally exploited by researchers. Although the defibrillator-related supplement was reviewed in 2001 and the insulin pump supplement was reviewed in 2006, FDA identified these supplements as being the most recent ones related to the devices involving potential information security issues and the most appropriate for our evaluation. We also evaluated additional documentation for another defibrillator reviewed by FDA in 2012 that has not been intentionally exploited by researchers to obtain a more current perspective on FDA’s review process for information security issues. Because we evaluated documentation for only three devices, our results are not generalizable. We also interviewed FDA officials about the agency’s current efforts to address information security risks in medical devices during its premarket review. To determine what postmarket efforts FDA has in place to identify information security problems involving active implantable medical devices, we obtained and reviewed FDA guidance documents related to different postmarket efforts, including Medical Device Reporting for Manufacturers, Draft Guidance for Industry and FDA Staff: Annual Reports for Approved Premarket Approval Applications (PMA), and Guidance for Industry and FDA Staff: Procedures for Handling Post- Approval Studies Imposed by PMA Order.information related to its adverse event reporting system, including the different codes FDA uses to characterize different types of adverse events. We requested that FDA search its adverse event reporting system for any potential information security problems involving these medical devices using 10 codes that FDA had stated could potentially indicate an information security problem had occurred. We then reviewed FDA’s other codes on its website to determine whether there were any additional codes that could be used to identify information security problems. We identified these codes using key words or phrases that we considered possibly related to information security. We then asked FDA to search its adverse event reporting system using the additional codes that we identified as possibly related to information security. We did not independently verify FDA’s results for any of its searches. We obtained and reviewed the manufacturer’s annual reports for the defibrillator for the years 2008 through 2011, after researchers demonstrated the intentional exploitation of the device in controlled settings in 2008. We also reviewed manufacturer’s annual reports for the insulin pump for 2010 and 2011, after researchers demonstrated the intentional exploitation of the device in controlled settings in 2010. We reviewed these reports to determine whether they included any indication of these demonstrations. Additionally, we interviewed FDA officials in its Office of Surveillance and Biometrics and Office of Device Evaluation, among others, on the agency’s different postmarket efforts, including its adverse event reporting system and postmarket studies, to determine how FDA has identified or might identify information security problems through these and other efforts. We also interviewed officials from relevant industry associations, including the Medical Device Manufacturers Association and Advanced Medical Technology Association, and officials from other agencies, including DHS and FCC, about challenges associated with identifying information security problems, including those specific to the issue of information security and those inherent to FDA and its adverse event reporting system. We also reviewed FDA We conducted this performance audit from August 2011 to August 2012, in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The submission of adverse event reports is intended to enable the Food and Drug Administration (FDA) to collect information regarding reportable issues with medical devices. FDA seeks to use reports submitted by manufacturers and user facilities, among others, to assess the underlying cause and seriousness of an adverse event. FDA also uses adverse event data to identify issues with medical devices that may require additional investigation. According to FDA, adverse event reports are best used for two purposes. First, they are used to capture qualitative snapshots of adverse events for a particular device or device type, such as the types of malfunctions or clinical events or both associated with the device. Second, they are used in signal detection, such as for identifying unexpected events associated with a particular device or device type. Adverse event reports are to be submitted to FDA through mandatory and voluntary sources. Mandatory adverse event reporting by manufacturers and user facilities enables FDA to obtain specific safety data related to medical devices from these reporters. Since 1984, the Medical Device Reporting regulations have required manufacturers and user facilities who have received complaints of device-related deaths, serious injuries, and malfunctions, such as instances where patients required admission to the (See table 7 for hospital or became permanently disabled, to notify FDA. summaries of these reporting requirements.) These mandatory adverse event reports are entered into FDA’s Manufacturer and User Facility Device Experience Database (MAUDE). FDA also collects data obtained through voluntary adverse event reporting. 21 C.F.R. pt. 803. Also, serious injuries are defined as life-threatening events, events that result in permanent impairment of a body function or permanent damage to a body structure, and events that require medical or surgical intervention to preclude permanent impairment or damage. Malfunctions are defined as the failure of a device to meet its performance specifications or otherwise not perform as intended. Device-related means that the event was or may have been attributable to a medical device, or that a device was, or may have been, a factor in an event including those occurring as a result of device failure, malfunction, improper or inadequate design, poor manufacture, inadequate labeling, or use-related error. A user facility is a hospital, ambulatory surgical facility, nursing home, outpatient diagnostic facility, or outpatient treatment facility that is not a physician’s office. Serious injuries are defined as life-threatening events, events that result in permanent impairment of a body function or permanent damage to a body structure, and events that require medical or surgical intervention to preclude permanent impairment or damage. Malfunctions are defined as the failure of a device to meet its performance specifications or otherwise not perform as intended. User facilities are required to file annual reports that summarize their adverse event reports. 21 C.F.R. pt. 803, Subpart C. In addition to MAUDE, FDA has other adverse event reporting systems in place to capture adverse events associated with medical devices. One of these is the Medical Product Safety Network (MedSun) system. MedSun collects voluntary report information from a limited number of hospitals and user facilities. All reports received through MedSun are entered into the MAUDE system. Launched in 2002, the primary goal of MedSun is to enable FDA to work collaboratively with specific device-user facilities in the clinical community to identify, understand, and solve problems with the use of devices. MedSun user facilities are required to report device problems that result in serious illness, injury, or death. MedSun user facilities are also encouraged to voluntarily report other types of problems with devices, such as “close-calls,” potential for harm, and other safety concerns. Once a problem has been identified, FDA works with the MedSun user facilities’ representatives to clarify and understand the problem. Subsequent reports and lessons learned from these collaborations are then shared with the greater clinical community so that all clinicians may take necessary preventative actions to address device problems. Currently, 350 user facilities participate in the MedSun network. Participants are recruited from all regions of the country using the American Hospital Association Membership Listing. FDA’s voluntary adverse event reporting system, MedWatch, was created in 1993 to encourage voluntary reporting by interested parties, such as consumers of medical devices, and health care professionals, such as physicians. These parties can use MedWatch to report serious adverse reactions, product quality problems, therapeutic failure, and product-use errors associated with human medical products, including drugs, biologic products, and medical devices, among other things. Consumers can submit information about their experiences either online or by fax, mail, or phone. Consumers can also request that their physicians either complete the MedWatch form for them or help them complete the form, given that these providers have test results and other clinical information that will help FDA better evaluate the MedWatch reports. Adverse event reports submitted to FDA through MedSun or MedWatch are eventually entered into MAUDE. MAUDE data consist of voluntary reports since June 1993, user-facility reports since 1991, distributor reports since 1993, and manufacturer reports since 1996. MAUDE may not include reports made according to exemptions, variances, or alternative reporting forms authorized by regulation. FDA is in the process of developing a new system to replace MAUDE, the FDA Adverse Event Reporting System, which the agency plans to implement by September 2013. According to FDA, this new system will perform similar functions as MAUDE, but will also allow for (1) greater capacity for storing adverse event data, and (2) greater search capability than MAUDE. Two federal entities that have specific responsibilities related to developing and implementing policies with respect to the confidentiality aspect of information security in terms of protected health information. These entities are the Office for Civil Rights (OCR) and the Office of the National Coordinator for Health Information Technology (ONC), both within the Department of Health and Human Services (HHS). OCR is responsible for developing, interpreting, and enforcing the Privacy and Security Rules called for in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). OCR enforces the Privacy and Security Rules by investigating complaints that individuals have filed with the Office in instances where they believe a covered entity violated health information privacy rights or committed another violation of the rules. OCR may also conduct periodic audits to ensure that covered entities are in compliance with Privacy and Security Rules. In calendar year 2011, OCR conducted a total of 3,898 investigations. Of these investigations, OCR determined no violation had occurred in 33 percent of them (1,303 investigations) and, for the remaining 67 percent (2,595 investigations), obtained corrective action. OCR has also issued guidance documents for covered entities on how to comply with the HIPAA Privacy and Security Rules. ONC was formally established by the Health Information Technology for Economics and Clinical Health Act of 2009 (HITECH Act). It is charged with promoting the development of a nationwide health information technology (IT) infrastructure that allows the secure exchange of health information. For example, ONC has developed a federal health IT strategic plan for working with the private and public sectors to implement different health IT efforts. In this plan ONC addresses, among other things, privacy and security issues related to health IT. The plan also includes strategies related to identifying health IT system security vulnerabilities as well as health IT privacy and security requirements and best practices. ONC has also developed the Nationwide Privacy and Security Framework for Electronic Exchange of Individually Identifiable Health Information in order to establish a policy framework for electronic health information exchange to help guide nationwide adoption of health IT and help improve the availability of health information and health care quality. ONC also assesses gaps and weaknesses in current privacy and security policies in light of evolving technology, and works with federal entities to address these issues. Additionally, ONC incorporates privacy and security in its programs, which are designed to implement HITECH initiatives, including certification of electronic health records, as well as supporting the efforts of several related initiatives to facilitate nationwide adoption of health IT. For example, one initiative relates to developing information security and best practices for safeguarding protected health information in electronic health records, while another initiative relates to identifying standards, protocols, legal agreements, specifications, and services, to enable secure health information exchanges. Table 8 includes the results of our evaluation of the evidence provided by the Food and Drug Administration (FDA) regarding its consideration of information security in its review of two premarket approval (PMA) supplements reviewed in 2001 and 2006 related to active medical devices with known vulnerabilities. Specifically, the supplements and supporting materials were for a defibrillator and its associated programming wand (wand) and programmer, and a specific insulin pump with wireless capabilities. This evidence was provided to FDA in the respective PMA supplements to the original applications by the manufacturer. Although the defibrillator-related supplement was reviewed in 2001 and the insulin pump supplement was reviewed in 2006, FDA officials identified these supplements as being the most recent ones related to the devices involving potential information security issues and the most appropriate for our evaluation. In addition to the contacts named above, Tom Conahan, Assistant Director; Vijay D’Souza, Assistant Director; Kaitlin Coffey; West Coile; Neil Doherty; Lynn Espedido; Nancy Glover; Rosanna Guerrero; Cathleen Hamann; Gay Hee Lee; Lee McCracken; and Monica Perez-Nelson made key contributions to this report.

Summary: Certain medical devices have become increasingly complex, and the growing use of wireless technology in these devices has raised concerns about how protected they are against information security risks that could affect their safety and effectiveness. FDA, an agency within the Department of Health and Human Services (HHS), is responsible for ensuring the safety and effectiveness of medical devices in the United States. FDA reviews manufacturers applications to market medical devices during its premarket review process and monitors devices, once it has approved them, through its postmarket efforts. In this report, GAO (1) identifies the threats, vulnerabilities, and resulting information security risks associated with active implantable medical devices, (2) determines the extent to which FDA considered information security during its premarket review of certain devices with known vulnerabilities, and (3) determines what postmarket efforts FDA has in place to identify information security problems. To address these objectives, GAO reviewed relevant documents and interviewed officials from agencies, such as FDA, HHS, the Federal Communications Commission, and the Department of Homeland Security. GAO also interviewed subject-matter experts in information security. Several information security threats exist that can exploit vulnerabilities in active implantable medical devices, but experts caution that efforts to mitigate information security risks may adversely affect device performance. Threats to active devicesthat is, devices that rely on a power source to operatethat also have wireless capability can be unintentional, such as interference from electromagnetic energy in the environment, or intentional, such as the unauthorized accessing of a device. Several experts consider certain threats to be of greater concern than others; for example, experts noted less concern about interference from electromagnetic energy than other threats. Incidents resulting from unintentional threats have occurred, such as a malfunction resulting from electromagnetic interference, but have since been addressed. Although researchers have recently demonstrated the potential for incidents resulting from intentional threats in two devicesan implantable cardioverter defibrillator and an insulin pumpno such actual incidents are known to have occurred, according to the Food and Drug Administration (FDA). Medical devices may have several such vulnerabilities that make them susceptible to unintentional and intentional threats, including untested software and firmware and limited battery life. Information security risks resulting from certain threats and vulnerabilities could affect the safety and effectiveness of medical devices. These risks include unauthorized changes of device settings resulting from a lack of appropriate access controls. Federal officials and experts noted that efforts to mitigate information security risks need to be balanced with the potential adverse effects such efforts could have on devices performance, including limiting battery life. FDA considered information security risks from unintentional threats, but not risks from intentional threats, during its 2001 and 2006 premarket review of two medical devices that have known vulnerabilities. Specifically, FDA considered risks from unintentional threats for four of the eight information security control areas GAO selected for its evaluationsoftware testing, verification, and validation; risk assessments; access control; and contingency planning. However, the agency did not consider risks from intentional threats for these areas, nor did the agency provide evidence of its review for risks from either unintentional or intentional threats for the remaining four information security control areasrisk management, patch and vulnerability management, technical audit and accountability, and security-incident-response activities. According to FDA, it did not consider information security risks from intentional threats as a realistic possibility until recently. In commenting on a draft of this report, FDA said it intends to reassess its approach for evaluating software used in medical devices, including an assessment of information security risks. FDA has postmarket efforts, such as its adverse event reporting system, in place to identify problems with medical devices, including those related to information security. However, FDA faces challenges in using them to identify information security problems. For example, the agencys adverse event reporting system relies upon reports submitted by entities, such as manufacturers, that are more closely related to clinical risks than to information security risks. Because information security in active implantable medical devices is a relatively new issue, those reporting might not understand the relevance of information security risks. GAO recommends that FDA develop and implement a plan expanding its focus on information security risks. In comments on a draft of this report, HHS concurred with GAOs recommendation and described relevant efforts FDA has initiated.