Chairman Palmer's Opening Statement at O&I Hearing on Vulnerabilities in Medical Devices

Good morning and welcome to today's hearing entitled Aging Technology Emerging Threats Examining Cybersecurity Vulnerabilities in Legacy Medical Devices. Legacy medical devices are medical devices that cannot be reasonably protected against current cybersecurity threats. In some instances these are older devices that were made before existing cybersecurity requirements were established, but they can also be newer devices that have outdated software and lack the necessary cybersecurity protections required to defend against current threats. There's a broad range of medical devices that can be vulnerable to cybersecurity threats, but examples include patient monitors, infusion pumps, and imaging systems. With over 6,000 hospitals in the United States, each housing a range of rooms and beds and an average of 10 to 15 connected devices per bed, it is clear how integral medical devices are to delivering healthcare in the United States. One challenge with these devices is that the hardware can last 10 to 30 years, but the software becomes obsolete much sooner. Patching and updating software are common ways to address cybersecurity vulnerabilities, but it is unlikely that such vulnerabilities can be sufficiently mitigated through these approaches due to outdated technology and compatibility issues. Moreover, merely replacing devices comes with financial and logistical challenges which leads many hospitals to retain these elixir medical devices well beyond their life expectancies, often without the software support to handle modern cybersecurity risk. This is particularly true in small rural and under-resourced facilities, making it crucial to find practical solutions. It is also important to recognize that the healthcare sector is one of the 16 critical infrastructure sectors in the United States and has become a significant target for cyberattacks. For example, in 2017, the global WannaCry ransomware attack severely impacted the healthcare sector. In the United States, medical device manufacturers rushed to patch affected devices after WannaCry showed that malware could jump from PCs to embedded medical devices. This attack demonstrated how unpatched older Windows-based systems and medical devices can be immobilized by ransomware. Additionally, the risk of harm to patients is a big concern because if a medical device's vulnerability is exploited, the ability for a device to help monitor, diagnose, or treat a patient can be compromised. There's also national security concerns. On January 30th, the Cybersecurity and Infrastructure Security Agency and the Food and Drug Administration released an alert about a Chinese-made patient monitor that had a hidden backdoor that could enable remote control and data exfiltration. While the vulnerability may have been unintentional, it raised concerns and highlighted the risk of nation-state actors pre-positioning destructive malware in our healthcare sector as part of a potential large-scale cyberattack to disrupt one of our nation's critical infrastructure sectors. Progress was made to address legacy medical devices in 2022 with the enactment of the Patch Act, which increased FDA's authority over medical device cybersecurity. The law now requires manufacturers to submit cybersecurity plans for new devices. Legacy medical devices that were on the market before this law took effect, however, still pose a significant risk. Therefore, addressing cybersecurity threats and legacy medical devices is critical. Fortunately, thanks to the ongoing work of the experts represented by our witnesses today, we have valuable partnerships and coordinated efforts to help address these risks and threats. I thank our witnesses for joining us today and sharing their expertise to guide the efforts in addressing these challenges and look forward to their testimony.