Is your cybersecurity upgrade FDA reportable?

Sep 23

Rebecca Jones McKnight and Gail Hannah Javitt | DLA Piper LLP

In today’s marketplace, technology evolves at a rapid rate, and must adapt to changing circumstances, such as threats to cybersecurity. For device companies, some types of modifications to devices post-market − potentially including cybersecurity-related changes − are reportable to the FDA. In particular, corrections to devices already in the field trigger FDA reporting under 21 C.F.R. Part 806.

What do device manufacturers need to know to understand their obligations under Part 806? The reporting threshold is whether a correction or removal is initiated “to reduce a risk to health” or to remedy a violation of FDA law “which may present a risk to health.”