Mind the Gap: The Biggest Threat in MedTech Cybersecurity That No One Is Talking About

Hello and welcome, everybody. My name is Sean Smith, and this is Friday in Focus. Welcome. Today's session is Mind the Gap, the Biggest Threat in MedTech Cybersecurity that no one is talking about. This really is a brand new issue. I was just at RAPS this week, and was telling people about what's going on, and they're like, huh… Okay, so before I get into that, I'm gonna go through a couple of announcements about what's coming up so you know. Tuesday the 22nd, we have a panel discussion brilliant panel, is going to be telling us about what's going on at the FDA and why you should care. It's a 90-minute panel because there's really a lot of territory to cover, and

so I want to make sure that, we… we get through all that. There was a similar panel, actually, Phil, Phil Desjardins, from Arnold & Porter was on the panel at, At the event this week. And it was really, really good. Then we're gonna have, next Friday, testing to prove it works. Which is about software validation testing, and, wanna… and how that can go awry. Just added, Tuesday, September 29th, Sex Bias in Medical Device Usability Testing. This is going to be really, really, an excellent session. Artie and Diane are going to be speaking about this,

And, Diane just joined. She's from, Zoot Clinical, Reviewer from DNV. And then on the 30th, Device Innovation Commercialization. Phase 1, with Renee and Michelle. And then… Coming up, friday, October 2nd. Compliance still wrong, the human side of risk decisions. Similar, but different from the preceding week. And then on the 9th, we are going to have a, design development company from Uruguay. Now, who on the call has thought of having their design and development work done in Uruguay? Raise your hand if you have.

So that's… that's an interesting, group. So now that I'm done my announcements, I am going to stop sharing. And turn over the controls to Michelle. I met… Michelle… In June, and we started talking about this. And this is the first public unveiling of it. Now, before you dive into the problem at hand, I'd like to take a moment to introduce Michelle, Matt, and Debra. Please, tell us a little bit about you and your background before we… Get rolling. Michelle, when you were a small child, did you dream of being a cybersecurity expert when you grew up?

No, I did not. Not even when I was an older person in college did I dream of that. I… I wanted to be a veterinarian.

Mmm.

Thought it would be good. became a genetic engineer instead, and then found my way into cyber, like so many people in cyber. We find our ways through the back door into the.

That's true.

I think, a lot.

And Matt, when you were small, did you dream of working at the FDA one day, and then…

Now, I wanted to make mind-controlled neuroprosthetics. I wanted to make mind control prosthetic arms, was the original plan, so went into biomedical engineering, and then… found myself at the FDA, and… Landed into Cybersecurity?

And Debra… Did you want to work at the Mayo Clinic?

I actually graduated with a degree in finance, never thought I'd find my way at a healthcare delivery organization or hospital system, and actually started in their, finance department, into their IT department, and then was a founding member of their Office of Information Security, so my route was very circuitous to, the role that I, ended my career at Mayo with, but I never once thought that's where I would be, so…

Isn't it interesting the way that we find our way to… to, MedTech and, you know, the space that we're in? Yeah, it's… everyone… everyone finds their own way here, but very few are direct. So let's go ahead and get started. Michelle, why don't you tell us why we're here today?

Yeah, thanks, Sean. We're here today to talk about… things that people often don't talk about, but it's kind of this undercurrent of awareness. I think we're in a place right now, every time we open up LinkedIn or watch the news, we're hearing about another medical device company being attacked, another hospital getting hit with ransomware, and it seems like a pretty scary place when it comes to security, and so there's been increasing pressure on what do medical device manufacturers do in their space, what do hospitals do in their space. And what we're gonna talk about today is the gap of how those two sides

are talking, or in some cases, not talking to each other, because when you're dealing with vulnerabilities coming in, here on the slide here, a vulnerability shows up on one of your devices, you find out it's being actively exploited, you need to get ahold of the hospitals. all the hospitals that own that device, you need to do it now. And… if companies think their web portal is reaching the hospital customers, they're wrong. If they think that publicly disclosing it on a site like CISA, it's just hospitals, especially when they're in the middle of something big happening, there's a lot of… kind of, expectations put in the hospitals to go find that information. We call it the great big Easter Egg Hunt. So, we're going to talk a little bit about what does that gap look like? What does that mean to both sides of this, situation?

And, maybe some ideas of how I might be able to solve that problem. So, big question, right, related to this issue, as we get more and more situations where, cybersecurity issues pop out, is how do you reach them all at once, right? I don't know if you… does anyone else hear an echo? From my audio?

I… I am not hearing one, Michelle.

Okay, so the, panelists that are not… speaking… that are not speaking should mute their audio. That's… that's the solution, I think.

And I'm not hearing any echo.

Okay. It might be that there's two audio… feeds Tuchida, so maybe just double check that. Sorry. So, how do we reach everybody at once, right? So, there's a vulnerability in a device. And usually time is of the essence. What are the options right now? We have portals, right? Medical device manufacturers love portals. It's a great place for them to have full control of putting information out there, but portals just don't get visited regularly. If you think about it from the hospital point of view, there's often hundreds, if not a thousand vendors that they have to look at, and everybody's got a portal. An email blast? We all know how long email lists stay fresh and valid. Email, like, large groups of emails also tend to get filtered, by corporate firewalls.

You could publish it publicly, like I mentioned. Sometimes this is necessary, from a regulatory point of view, but you really are waiting for someone to come and land and look for information there. You could call them, not really feasible at scale. Sometimes it helps for particular situations, but, you know, a lot of times what happens… I know early in the days of WannaCry, when we had our first big cyber attack we were dealing with, the hospitals and manufacturers who knew each other became in the loop because they were getting calls directly from people they knew at the manufacturer side, but not everyone was getting information.

So, you need to reach your customers where they are, and not really expect them to come to you. This is really a key part of creating a good communication path between these two spaces. So, this is kind of what we mean by this gap, right? Manufacturers create and publish a lot of information. They have advisories, they communicate about patches, they have end-of-support dates that need to be communicated, MDS2 forms, SBOMs, disclosure, The gap is, what do the hospitals receive? They receive what they happen to find, right? Again, that Easter egg hunt. It depends on how mature the hospital is, what resources they have. If they happen to go and check a portal, or they happen to go check a public site, or they happen to get an email. Those are all happens.

Right? The industry has spent a decade getting better at producing this security information, because producing it is part of securing devices. And really, we haven't spent a lot of time figuring out how do we make sure that people get the information who are owning and have this shared responsibility. This concept of shared responsibility was released by FDA back in 2014 with their first pre-market guidance, talking about there is this important shared responsibility between these two sides. But it's really hard to have that when you don't have a great way of communicate communicating between these two pieces. So everyone is… nobody's doing anything wrong, they're doing the things that they're supposed to do in their spaces, but that gap in the middle? That gap is the lack of communication.

So, that communication mechanism, we've had a couple of different ways of doing this, but kind of a comprehensive solution hasn't been built yet. So what does this look like for the hospital side, right? If the hospital doesn't hear from you as a manufacturer, they will often seek the information elsewhere, and this creates friction for both sides, right? The hospital, isn't really necessarily seeing regular confirmation of vulnerabilities. They're wondering, you know, they see all these vulnerabilities being released, they're not really hearing a lot of information a lot of times, so they buy software tools to help them try to figure it out.

As a result, they scan products, they use these tools to examine some of their medical devices, get a whole bunch of false positives, and then… then that pushes information back to the manufacturer, asking, why am I seeing this critical vulnerability in your product? But the manufacturer actually Spent their own resources figuring out that that wasn't an issue, and they figured that out 6 months ago, right? So, without a single source of truth, where we have this regular feed, it feels reliable, it gives us confidence that both sides are talking to each other, and the things that are… that should be happening on the medical device are happening on the medical device side,

Without that, regular cadence of information, manufacturers are left wondering, right? And we've talked to a lot of hospitals over the past couple of years about this particular topic. And, say, general… perspective is, you know, we hired a team to go tell us what kind of vulnerabilities we have, because we just are not getting enough information about our devices Don't know if the manufacturers are checking it regularly, so… I feel like I have to take that responsibility, I don't really want it, right? So, if the manufacturers are already taking that responsibility, and the gap is really just

making sure the hospitals are confidently knowing that they're getting this information. That's really the best way to make the best use of the resources being expended on both sides. So we have a poll here, and I talked to Sean, and he wants us to just, pop your answers into the chat, if you would. So… Question for the group here is, when did you last confirm that a security advisory you sent actually reached the hospitals that own the device, right? Within the last 3 months, within the last year? Oh, you guys are active in here. That's awesome. Sean, you've got a… you've got a good, a good group who, who actually comes in and, responds to polls very quickly.

Yeah, I want everyone to respond to the poll. That's wishful thinking. Usually, we might hit 50% if we're lucky, but, you know, feel free to answer the poll question. Helps us really understand where everyone is. And, So this is great.

Yes. Alright. Awesome, thanks for everybody for… Filling all that out. We'll have a couple more for ya, so stay prepared.

So I'm seeing a lot of ease, and I, you know, have a feeling that's because a lot of the people on the call are consultants, and one of the things that I'd like to keep in mind as we move forward is, you know, this… this… we really wanted to present this information to consultants, because consultants are the ones who are going to convince their clients That this is an issue that is worthy of attention. You know, my experience at RauPS talking to people about this was a little bit like deer in headlights when people were looking at me. Like, what are you talking about?

Yeah.

No. But this really falls into the category of, post-market activity and your quality management system. And, you know, I think that under QMSR, this is really gonna be… An issue, particularly if there's a high-profile event.

Yeah. And you have to prepare in advance for communication in an emergency, before… that emergency happens, right? That's why we do incident response tabletop exercises, but we often don't get to this part, which is actually communicating the part, the information back and forth. Right? I also saw a number of E is not yet, right? So, I think there might be, folks here who are entering this industry and thinking about these things. Yeah, so, just doing pen testing is not enough, because we could do all we can, but, you know, the cyber environment is constantly changing.

Absolutely. Alright. So… what do today's channels look like, right? They're… they're kind of set up in the best way they can, really, right now, which is build it and they will come, right? The manufacturer spent a fair amount of resources, time, and effort, money to build these customer portals But, you know, we've talked to major manufacturers, and one manufacturer, had shared that they monitor their portals, and they get about 100 users per month. with a customer base in the thousands, right? So we know that they're not getting the information they need, and certainly not in an emergency, or if they didn't know that they were going to be looking for this information. Bulk email, we know, also doesn't work. Any of us here who've tried to send large group email,

filters are very good at removing that, and I tell you what, if your… if your manufacturer, if the manufacturer is under a cyber attack, the hospitals will actually block any mail… emails from you anyways. Same… so that also relates to distribution lists. You can have distribution lists People are changing jobs all the time, may not be the right person for this information versus the reason you have that contact, that happens a lot as well. And then the MDS2 form, right? This is something that It's helpful to have, but often we only get it during procurement, and it doesn't get regularly updated as the device updates, and so there's lots of

There's lots of static availability of this information, but not a lot of active pushing, which in a situation with,

Hey, what is DS2 forum?

Oh, the MDS2 form, it's a medical device disclosure form that lists, all of their… all the cybersecurity control categories, what kind of controls you put into your device. So hospitals can know what kind of authentication was put onto the device, whether it has emergency access, all kinds of different things. It's specifics about how security is applied to that device. It's a standard, A standards-based form that is… was developed for a communication path, actually.

Thank you.

Yeah, you're welcome. Thanks for asking that question. So, I wanna… I… I did… I did bring a couple of folks from… from MedTech with me here today, and I wanted to… to pass the talk to… Debra, who spent 24 years at Mayo, and she lived this world quite a bit, and Debra and I have been working together for 3 years now. I've known her for many, many more than that, and I wanted to give her a chance to talk about what actually happens when an advisory happens, or a hospital needs communication. Deb, you want to share a little bit about your thoughts and your experiences about how it felt to be looking for, needing, or receiving information from manufacturers during your time at Mayo?

Sure, I'm glad to do that. So, from the healthcare perspective of the communication process, I want to start fundamentally with who a key player is at a hospital or a healthcare system. And it happens to be the healthcare technology management team. That team is a group that's responsible for, caring for medical devices when they're in the practice setting. And they don't have the time to search different channels for information, and the information we're talking about here. So when you think about it, if an advisory is shared, and many times it's not pushed to them, but if it is shared. with them, several questions have to be answered by that team. The first one is fundamentally, do we actually own the product?

The second is, if we own it, what is the action that I'm supposed to take? Or is the communication that's coming to me simply a notification that an action is pending, but we don't know what it is yet? And lastly, if it is an action's pending, when do I have to go look again to find information to know what I actually have to do? So to be honest, it truly is more common for hospitals and health systems to need to search out this information instead of receive it as a push. So the concept of building things and they will come creates a real challenge within hospital settings. Because it requires this, healthcare technology management team

To know where to look, and then to search out the information in, a timely manner. So, does the team go log into a web portal if a manufacturer provides it? Do they have to visit the website that might have public information? What about that, email communication and doing all that monitoring? And last but not least is, that, relationship method of, do I actually just reach out to my known contact at the manufacturer? This sounds like a lot. But now, think about having to do this with hundreds of manufacturers, who all do it differently. The task is extremely daunting. So there… there, is just not enough time for these people in the hospital to search all these places. So fundamentally, what this can mean is that hospitals need to make a risk decision. They need to prioritize which manufacturers they're actually going to monitor.

And the question becomes, do we want the skilled hospital team searching for information, or do we actually want them doing the critical work to keep medical devices functioning so clinical staff can provide safe patient care? I think the answer's super easy, and we need them focused on the job they were hired to do. In the words of a healthcare technology management leader, he said to me, we only want to engage in one platform for this function. The reason for this is, is that finding the information is actually harder than, having the team in the hospital take action. So with that kind of lay of the land in that background, I'm going to pass it back to Michelle. But before I do, Michelle, can I… can I make one other statement about the MDS2 form?

Sure.

Something that's really important to understand is while the MDS2 form provides security capability information to hospitals, it's important to understand that form is something many hospitals want access to before they'll make procurement decisions. So, it's really important to have that available and accessible for the hospital. So, back to you.

Awesome, thank you so much. Alright. So we have one more poll, boye. There's one more after this, but a new poll. For… for the… for the manufacturers on the call, if you could put… produce a list today, or could you produce a list today, of every hospital that owns your highest volume product? Awesome.

Yeah, I love this question. We had, we had talked about, looking, you know… It's 10 p.m, do you know where your children are?

Yeah, exactly. Y'all remember those days.

You know, it's… It's… it's 10 AM, do you know where your devices are? Yeah. I think once they… once… once they leave the loading dock, it can become God's own personal mystery where they end up.

Yeah, well said. Yeah, and I think that that's a… and I would say that, like, looking at the results, and I don't think everyone can see the results, if I understand correctly, there's a really… a big mix, right? Of the there's a fair number of A's and C's, in addition to the E's, if it's not… if you're… if you're not a medical device manufacturer. I think that one thing that I would like to highlight a distinction here is I think most companies have a list. They say, yes, I have a list of my customers. I have a list of where these products are. The question is, how accurate is this list? Because you can't really currently vet if you really know where everything is, right?

So, that's something that I think is another piece of the gap, is are we really sure about the things That we think we know about how we're communicating. are we sure that the information is going to who we think it is? Is it as comprehensive as we think it is? And I would… I would venture to say, based on conversations I've had, that… In many cases, devices are hidden places that you don't know. It's the other part of the Easter egg hunt, right? So, because people swap devices, devices get older, they sell them to other firms, they don't necessarily tell your manufacturers,

As we… as we go through this problem, though, we're looking for… if we don't… if we have this gap, right, both sides are looking for better efficiencies in the conversations that myself, Deb have had with both sides of this conversation. Manufacturers, they would really like to have fewer interruptions, answering questions about things they've already closed. Having a clearer, more reliable view of their install base. Knowing which hospitals have actually patched and managed their devices, if they're in charge of that, and which ones have not, which have received information and responded to it.

compensating controls that, thing… actions you're asking the hospitals to do to manage your devices. Do you know if the hospitals are actually falling through with that? And also. that legacy fleet, right? How are you reliably communicating end-of-support dates, the status of support for some of these products? We know, you know, I still remember Michael McNeil, a decade ago, talking about this challenge of older devices staying in hospitals, and he's like, you know, you're gonna have to, you know, pull these medical devices from the hospital's cold, dead hands, because, like, that's a lot of money to invest in these devices. And it's hard, right? And there's always this trade-off of the budget

for replacing products. And the risks that they may bring as being older devices, and not having a clear view of all of the devices that have reached end of support, and their support status is a challenge. On the hospital, they don't want to go visit 150 portals. They want to have a single view. They want to have MDS2 forms, that form that gives you the understanding of what kind of security controls are on this device. How do I need to integrate those realities of those controls into my larger infrastructure and manage those controls or lack of controls in the best way I can? How do I know when my products are going end of support, right? Do I have to go ask every single manufacturer about every product I have?

And then… Doing other things to kind of fill this gap on the hospital side, spending money or energy or resources trying to kind of take a look themselves, right? Because the gap in communication leads them to wonder, what are the risks on my network? Because that's their responsibility. The hospital has to manage their network, manufacturer has to manage Their products, both of those have overlapping needs. And, you know, coming back to the whole question we had, you know, do you… do you… it's 10 o'clock, do you know where your device is? It's 10 years in, do you know where your device is, right?

most manufacturers, and I've seen a bit of this in the chat, talking, well, it's a requirement for you to know where your devices are. Absolutely, you're expected to do that. The reality is, it's not always as easy as it sounds, and as time goes by, right, we… work on the design, we verify, manufacture, distribute. Then, after 15 years, it's a lot harder to figure out where that stuff is. But. the… the, the, sorry, I was just seeing there was an ask for, when we're going to take questions. Sean, are we taking questions during the session? Do you normally take them during or after at the end?

I'd like to get through the presentation before we move into questions, you know.

ringing. That's what I thought, so. So, it does become a challenge when you are trying to find these devices, and it becomes even more important the older the device gets, because that's when we start to start losing support for some of those components. So, communicating and understanding who's got what, and making sure that whoever has those devices knows what the situation is with the products. Is a really important way of managing the larger post-market phase. Devices that can't be tracked, can't be adequately managed. Not only for security, but also for recalls, maintenance. Risk management absolutely requires traceability.

Right. And this has been, you know, I spent, 8 years in the medical device world, in the regulatory department, and traceability was always a challenge for us. Wouldn't it be nice if hospitals were able to share what products they have, willingly, in one place, right? Keep it up to date, wouldn't it be easier? Make sure that they are keeping you going about… what products they have, the new products they're adding to their system, the old products they're retiring, right? That's the other thing, like, they might retire a product, but you don't know. Right? They're not using it anymore. Let's give them a reason and a place to share the information, and then both sides actually win in this situation.

Matt? You have been at the FDA side for 8 years. You're now here at MedTech, and you have really looked at, kind of the regulatory side of this post-market management, and the challenge that comes with it, and what the FDA has done to try to enforce better management in this post-market space. Do you want to talk for a minute about that?

Sure. Definitely the regulatory oversight for cybersecurity is drastically evolving over the past decade. And recently, with FDA's new authorities from Congress to enforce that there's a reasonable assurance that devices are cybersecure, and requirements that manufacturers go through and continue to monitor and maintain and update devices throughout the lifecycle with the 524B requirements. This is only getting added regulatory pressure and oversight that can impact, what you might see from the post-market perspective once your devices are out there. So, from a quality management system perspective.

Both the pre-market and post-market cybersecurity guidances from FDA connect into those quality management system requirements, where your processes need to address cybersecurity for that ongoing monitoring and maintenance. of the devices we're putting out into the field. So, there's a regulatory cloud brewing. of more post-market oversight. We see a lot more currently on the pre-market side, during the submission reviews of how the FDA is looking at more details of how you're securing your products. But the natural next step is that the post-market oversight is going to also grow as well.

in terms of what I've experienced at FDA, unless you really get to the level where something's driving a field action or a recall, it's hard to have that traceability and knowledge of whether your communications are reaching the field, whether your updates For security issues are getting applied, unless you have recall-level traceability, for whether those actions have been taken, so that really drives into what Michelle was saying before about security being a shared responsibility, where We need to have better open communication between manufacturers and hospitals so that risk can be prioritized, and that we can better protect the hospital infrastructure, and better protect the safety of patients.

By getting these security information more freely flowing. Definitely, I've… seen, even at my time at MedTech, the, It's underestimated what it takes to manage cybersecurity in the post-market, in terms of what it takes from a resource perspective to monitor for vulnerabilities, develop and release patches. So right now, a lot of focus and discussions around the pre-market barrier of getting your device to market, but that's just the beginning of the story, that's just the beginning of The oversight that can be applied, and now we're going to need to make sure that we're paying attention to this post-market side of cybersecurity management, and being able to drive that better, through

Better communication mechanisms, better resourcing for that post-market oversight once the device is in the field.

Yeah. And there was a question in the chat about how long has FDA been expecting manufacturers to… find cyber hack points, the phrase used in the chat, you know, kind of this expectation, spent over a decade, right?

Yeah. First pre-market guidance that went in-depth for considering cybersecurity was in 2014, and FDA's kind of ramped up what they're looking for in submission documentation since, then, as they've seen more post-market issues. FDA's oversight's largely been driven from post-market vulnerabilities and seen design issues that could have been caught During the pre-market development of the product appear in the post-market side, so they've been ramping up Their expectations, really, with the 524B requirements going into effect in 2023 was a significant shift, because they had more, regulatory pressure they could apply in the submission process.

But also the guidances keep getting longer and more detailed, and we know that they are working on a more in-depth update to the post-market guidance as well.

Yeah, thanks. And there have been some comments coming in to the chat as I was talking about, you know, do you know where your device is, 15 years in? And there's been some discussion around, well, there's a regulatory requirement that you're supposed to know where your devices are. You're absolutely supposed to know where your devices are. All I'm saying today is it's really hard to actually do that in reality. That's the gap. We all know we should know where our devices are, as manufacturers. The challenge is that it's harder to do that, and the longer those devices are in the field, the harder it is to keep them tracked. Okay, poll 3.

How many devices? That you have in the field have established end-of-support dates. I'm really curious about this one for the manufacturers on the… On the call today. There's a very excited A, Erin.

So, In a previous webinar we did, one of the people talked about Cobwebs and legacy devices. And the, little discussed area of things that are, you know, vaguely unsupported but still in use. area of products, that are… that are in the marketplace. Any comment on that? While we finish the poll.

Could you repeat that question, Sean? I am very sorry.

That's okay, that's okay. Just, you know, the question of legacy devices in the marketplace, and, you know, the ones that are secretly gathering cobwebs but are still in use, and the vulnerabilities that they present.

Like, is… the question, what are we doing about that? Or, sorry, I'm just not…

Just… just sort of, They're… they're… they're not on the… on the current product inventory list, but they're still in the marketplace.

Yeah, and they're not being actively sold. The manufacturer may have just, end-of-lifeed those products, but if they don't know that that happened, there could be a lot of, Part of the lack of communication about the status of patching for a product may actually be because it's not being patched. Because it's end of support, and there's no way to patch them anymore, right? So, there's a… I think there's a lot of, you know, the iceberg scenario, right? The stuff popping out of the water on the new stuff, where we hear about patches, we hear about vulnerabilities discovered, there's a whole bunch of ice below the ocean.

that can't be patched anymore. It's still in active use. And the visibility of what that footprint looks like is… Blurry, at best. Right. All right. Thank you for that. So, amongst our conversations, as we've continued to talk to hospitals and manufacturers. what hospitals are actually asking for. They want MDS2 forms. They want to understand what kind of security is in place for those products, and getting them after procurement is generally painful. It's a one-off. You have to go ask for these things. End of support dates, there's really no place where end of support dates are, generally placed. It's something that's often released after the product's been on the market for a little while. So, without a communication method in place, those end-of-support dates, sometimes aren't really generally known, or…

And they're very hard to find, right? They also want confidence that vulnerabilities are being monitored, right? Communication is a great way to ensure that the… the vulnerabilities that are important are being handled. And then just general security information. There's all kinds of reasons that… hospitals need to find out about security information about their products, and without a common way of getting that, and that information can sometimes be unexpected. So they won't know to go look at the portal if there's new information released, right? So… what would this look like if it worked, right? The communication could go…

to those people who need it, who own the devices, centralized in one place, right? For the manufacturer, you have a vulnerability that affects a product line, you can post it, within an hour, it's reached all the hospitals that own that product, and it really only goes to those people who have those products. A few days later, you can see, have people taken action? Marked it closed. it'd be great to have that information, this basic information. And then, you know, you just have to follow up with the stragglers that aren't responding to that issue. For the hospitals, one place to get the information pushed to them, instead of them going on the Easter egg hunt, right?

they just want information that covers their product. They don't want to go searching through a haystack trying to find information about the products they own. That means they also have to have, you know, they could have thousands of products for a hospital, and trying to parse out all the things that they know they own, the models, makes, manufacturers, it's a huge amount of work, and it's really not logistically possible. And they also want to stop paying outside firms to help them figure out what vendors already know. So… So if we're able to start getting information regularly to… from one side to the other, we gain transparency. You publish it once, the hospitals, and only the hospitals that have that product, they get that information, delivered to them, not just made available. Traceability.

We have this product called Bridge we're going to talk about in here in just a minute. It's less of an issue, because… If you put a platform together that has that traceability built into the framework, the… manufacturers share the products they have, the hospitals share the products they have, and then the platform provides that traceability, so communication is routed automatically and delivered in one place. It makes it a lot easier. You don't have to worry about accountability and finger-pointing, because the manufacturer knows their responsibility to send the information. The hospital knows their responsibility of responding and closing that information on their side. Both of the sides have receipts.

And the opportunity is, if you have transparency, traceability, accountability for all this information that is constantly flowing in the area of security, then you gain all those things as an opportunity, and as the platform is able to grow, and more and more users are on this, you actually have something that you didn't have before. And so, Every mechanism today is a pull. Right? Imagine if we were able to just push it to the people who own the product with a record that it arrived. And that's what we've been working on for a few years. Right? The ability to communicate on a secure, independent platform that everyone who owns a particular product

About anything you want to tell them. You want to have an emergency broadcast system? You have issues happening, in your corporate infrastructure, your products aren't affected, you can tell them about it. You have a product that's affected, there's active exploitation, you can tell them about it. Vulnerability advisories, regular communication, yes. Hospitals, we've got your back, we're watching these products, here's the vulnerabilities you need to care about, and this is when the patch is coming out for it. End of support dates. This is when the responsibility of managing that device is going to get transferred over to the hospital, because me, as a manufacturer, I can't support it anymore, because the software in it is out of date, and we can't update it to new stuff. This happens all the time. MDS2, tell me about the product.

and what kind of controls it has. If that changes, I also want to know what the latest and greatest is. I have one version of software, I haven't patched it, bad on me, but I want to know what MDS2 version is related to my version of software that I have in my product. So, a couple of little screenshots at the bottom there, Wouldn't it be great to be able to have one place, if you were a hospital, that said, okay, these are all the products I have that are end of support, lower left. These are all the products that are going end of support in a year, these are all the products that are going end of support in two years. Wouldn't that be nice for capital planning, right? We could actually respond to that.

And then, all of the different, end of support listed dates for all the products you have there. What does a manufacturer see? They see, All of the vulnerabilities they've posted, in the past month. all the hospitals that are connected with their devices. This is a preview slide, so it has small numbers, but you can also see in the orange there, people who are the manufacturer, or the hospitals are still pending, responding to that particular advisory. the green ones are closed, right? And you can see the review rate and what's happened with your communications about your product as you go through.

Because when an incident hits, you want all this information in one place before that happens. The best plan is an organized way to manage status in something like this. I've been through incident responses, it's not fun. So one dashboard, every manufacturer, only their product. So Hospital C, there's no more Easter egg hunt, right? Every manufacturer that's on Bridge can then show up on this dashboard, and they can look… they can sort what are all my critical vulnerabilities? What are all of my end-of-support dates? Which products do I have that are not currently being supported that I have to manage myself?

which ones are pending? One year, two year, like I said. And how many advisories do I have that are still pending that I have to address or figure out how we're going to get these patches applied, scheduling visits, whatever it takes. So, last poll. If there's one place to get security information about every device you own or make. What is most important, do you think, in this space? Is it vulnerability advisories? Is it end of support dates? Is it MBS2 forms and other security documentation? Is it security updates, like if there's a firewall configuration change, operating system update?

Or is it emergency broadcast critical information needs to get immediate action? And I'll be honest with you, like, even if you don't work in a hospital or a manufacturer, you can still vote on what you think this should be, because we all work in this space, we see the risks, we see the information that needs to be shared, and we see the lack of it in many cases. All of the above where possible. I like people who are, like… there are some folks who are voting for more than one, and… and that's great to see as well. So, okay. just another… Maybe one or two more slides, and then we're going to go to questions.

So… This can feel a little overwhelming for manufacturers. Hospitals do join this platform at no cost. This means there's no paywall that prevents hospitals from participating, which means it can be your only way of communicating this information, because there's nothing blocking them from getting it. This was by design. The manufacturers have a low-cost, membership fee. But you can just start with your most mature product lines, and that's what a number of manufacturers we've been in conversations with recently cleared capital equipment, they have all the information that you need. Don't get overwhelmed by, like, oh, I've got to update a thousand products, and some of them don't have information that I have available yet. Use it as an onboarding path to

Highlight and share information, start smaller if you need to, structured around how the business actually works. And so, if it sits on a hospital network, that's what hospitals care about most. Equipment is a big one that has a lot of interest in this, Also, infusion pumps are a big one that I think hospitals would like to have more information about. And so… Just as we close out, before we jump to questions here. we would like to invite anyone who would like to talk to us about this. Even if you just have more questions about this topic, Deb and I love to talk about this… this challenge.

Show you the device, that we've built, the platform, book a call. Hospitals and health systems will likely be getting invites from the various manufacturers who are coming aboard the system. soon, but we can also onboard hospitals without an invitation, and talking to consultants and partners about how they might be able to help us along this journey, with how we share information. Pull a contact list for every single hospital that owns your flagship product. I would love to know, if it's really as accurate as sometimes we think it is. If you can't, this is the gap. If you have no way to be able to contact and know where all of those products are, this is what we built Bridge to Close. We don't quite have 20 minutes, but, would love to hear from folks. I…

I was trying to kind of keep track, there's a lot happening, in the chat, so I'm gonna… I think, Deb, you've been in the chat a little bit, but I think we're open to questions, right?

Instead of the raised hands, we got Bruce Swope first. Bruce, what do you have to say?

I don't see raised hands, so I'm gonna let you do that.

You there, Bruce? Okay.

Do they have to be unmuted?

Yeah, allow to talk. Allow to talk.

How about now?

Yeah. There we go.

Hey, Bruce.

All right, sorry. Yeah, I raised my hand early on when you asked a question and said, raise your hand. But, I understand exactly what the bridge product's doing. I… Go… I'm going way back now. In the early 90s, I work for a company that built this product for Windows machines. And that you… it would go out on the network and find every Windows machine that you owned. Tell you if it was patched, and tell you if they were vulnerable. And so what you're doing is something that's needed. And one thing I remember greatly, and you're talking about hidden machines. We had a sales rep go to Dell. And Dale had… I want to say 250,000 Windows machines on their network.

250. And since they were free, because they made them, every engineer had 6, 8, 10 machines that they were playing with.

Oh my.

And there was a zero-day vulnerability that came out. And, while the sales rep was in place. And it was a bad one. And what the vulnerability did was it compromised a machine that wasn't patched for this. It would then immediately start pinging every other machine on the network, looking for machines that weren't patched. And it would ha- it would hack them. And then they would immediately start looking again. And so, while the sales rep was in the office, the Dell network. Collapsed.

Oh, wow.

Because there just was so much traffic going on. That they couldn't talk. And so, the sales rep said, okay, he installed the system, got it started patching the machines, and… And… and they said, a PO's coming to you, we're gonna buy the software. For some strange reason, they were excited about buying the software. You're talking about the hidden machines. And they complained Two days after we did this, hey, it's happening again! Well, yes. Michelle was on vacation, She came back in, and she turned all her machines on. And that went on for 3 months.

That's crazy.

So what you're talking about doing makes perfect sense.

Yeah, it's a long-standing problem, and one of the things that is kind of special about the way we're doing this is we're not touching anybody's network. So that we don't prevent people from getting on it because of their security protocols. We're independent, it's a web portal, everyone's sharing information outside of their infrastructure.

The way you're doing it is the only way it can be done. You can't… Yeah, I appreciate that. All your problems you talked about going through, I was listening, I said, yep. Pentesting won't do this. Yep, they're not going to know where their machines are. You have to have… your product is well needed, and I would… Carrie and I would love to talk to you in the future about how we can introduce other people to it.

Thank you very much. I appreciate that, Bruce. Just scrolling back in the chat, Kris Kelly asked an interesting question. I wonder if an older medical device had a cyber event, who's responsible, especially if it's past end of life? This is a very interesting question, and I'm going to tap Matt on this, because The answer might surprise you. If you made that device, and something happens, and that device becomes a security risk, and a safety risk, you're still responsible. Right, Matt? Back me up on that one?

Yeah, so that's something that takes some manufacturers by surprise. Once you stop selling it, you start winding down some of your quality system processes. The quality management system things don't turn off unless your device is no longer in use, or no longer in the field, so you still bear the responsibility of communicating if there's unacceptable risk unless you do a recall to remove the product. Or you do a market withdrawal to get the product out of the field, you still own that risk, and your company still owns the reputational risk if your device is affected, even if you've ended up supported, you've communicated that, you've transferred the risk. If you're aware of something unacceptable, you still have to

You still own that communication risk and helping to address what those safety risks are.

Yeah, thanks, Matt. I wanted to, before we lose, folks, I wanted to address one other question that's kind of towards the bottom, which is, how many manufacturers and hospitals are on Bridge yet? Well, you guys are, like, front of the line hearing about this. We've been working behind the scenes With about a dozen of the largest manufacturers globally. We do a lot of work with medical device manufacturers, we have about 120 clients globally, and we reached out to the manufacturing world to say, hey, we want to do this thing. We want to get your feedback on what it should look like. We want it to be your platform, not our platform. And we have been working with these manufacturers for 2 years.

With feedback back and forth, we are, advancing pretty far in, getting one of the largest medical device manufacturers in the world. They're very interested in being, on this first round. Also, extremely large hospital proactively wanted to join this, and we're going through all of their vendor credentialing. Anyone who's gone through this process knows that takes a while. We're quite a ways through that process, so, our first… we do have one hospital system that has just come on because they want to. A number of other manufacturers are reviewing, our agreements, and we're moving through that process. It's fairly early, but I will tell you, I have talked to probably

a couple hundred people in the past few years. Deb's probably talked to more, to be honest with you. Not a single person has ever told us this is not a good idea. everyone has agreed it's a good idea. So here's the challenge we have. You know, nobody likes to be at the dance early. Everyone's along the… everyone's waiting for the first person to go in. The first two are looking like they're gonna be extremely large players in this industry, which will really help us accelerate this. I'm excited to see where it's going. I would love to talk to more people about this. Even if you're not interested or not in a place to join Bridge, this conversation has been a very powerful one in this industry. MedTech exists to get this industry more secure in any way it can.

We love conversations like this. Sean, thank you for inviting me here today, along with Matt and Deb for coming and representing what we're doing here. It's exciting to be… we kept this under the vest for a long time, and it was very hard. It's great to be able to talk to everybody about it. I love all the questions. Might follow up with some of you if you had questions that we didn't get to answer today, that I have an easy response for. But, thank you, everyone, for your time today, and, it was really great to… To join the MedTech Leading Voice. Sean, thank you.

Yeah, there's a lot of questions that are coming in, you know, and so we're gonna follow up with you guys, if we didn't get to your questions, I apologize for that. As I said, this is the first really public viewing of… of Bridge, and you know, now… now that you know that it's here, I hope that you will all reach out to Michelle, and MedTech… MedTech to learn more. There's some interesting questions in here about, FDA and best practices for young companies. Thank you, Paul and everyone for your questions. This has been an excellent session, and…

Please feel free to follow up with me. I appreciate everybody's time and attention today, and I hope that you will join us on Tuesday for FDA Ground Truth. And everything else coming up. Thanks again.

And the… our contact information and our websites and the website for Bridge are all in the slide deck you guys are gonna get, so you can find it in there.

Nice job, you guys.

Appreciate it. Thank you.

Awesome.

Bye.

Bye-bye.

Thanks, Sean.

Happy Friday.