Medical Device Startups and Cybersecurity Challenges with Suzy Engwall | Ep. 39 - Full Transcript | The Med Device Cyber Podcast
Read the complete, searchable transcript of Episode 56 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.
Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.
Episode summary
In this episode of The Med Device Cyber Podcast, hosts Trevor Slattery and Christian Espinosa are joined by Suzy Engwall, a seasoned healthcare innovation consultant from Healthtech Strategies, to discuss the critical challenges and strategies for getting a medical device to market. Suzy shares her extensive 20-year background in healthcare, which began with a decade in lean transformation inside hospitals before she pivoted to the innovation sector. Frustrated by the institutional inertia and lack of resources that hampered progress within hospital systems, she now dedicates her work to helping startups and innovators navigate the complex healthcare landscape. Her experience spans setting up hospital innovation programs, teaching human-centered design to clinicians, advising startups, and working with investors, giving her a holistic view of the industry. The core of the conversation revolves around the numerous hurdles that medtech startups face, with cybersecurity emerging as a significant but often overlooked roadblock. Suzy explains that while funding is the most obvious initial challenge, the journey is fraught with other complex issues like go-to-market strategy, regulatory compliance, and reimbursement. She emphasizes that many innovators, particularly those coming from outside the healthcare industry, fail to appreciate the nuances of market adoption. A staggering 93% of medtech startups fail, and a primary reason is a lack of product-market fit. This failure stems from not just creating a great product, but understanding the intricate politics of hospital procurement, the lengthy buying cycles, and how a new device impacts existing clinical workflows and financial incentives. For example, a physician champion might love a new technology, but if it's rejected by a value analysis committee or perceived to reduce billable visits, it will not be adopted. The discussion also highlights the evolving role of cybersecurity. It is no longer just about protecting patient data (HIPAA compliance), but also about ensuring patient safety from threats that could manipulate a device's functionality. The hosts and Suzy note that while the FDA has recently implemented stricter cybersecurity regulations, hospitals themselves are raising the bar even higher, creating their own stringent requirements before allowing a new device onto their network. This creates a challenging environment for manufacturers, especially those with legacy devices that were not designed with modern security in mind. The conversation touches on the integration of Artificial Intelligence (AI) into medical devices, which introduces another layer of complexity concerning liability, ethics, and patient transparency. Ultimately, the episode argues that for a medical device to succeed, innovators must address regulatory, clinical, financial, and cybersecurity considerations from the earliest stages of development, rather than treating them as afterthoughts.
Key takeaways from this episode
- Cybersecurity is often an afterthought for medtech startups but has become a critical and non-negotiable requirement for both FDA approval and hospital procurement.
- A staggering 93% of medtech startups fail, primarily due to a lack of product-market fit and an underestimation of the complexities of market adoption in healthcare.
- Successfully selling a medical device to a hospital requires navigating long buying cycles, internal politics, and value analysis committees, which often hold more power than individual physician champions.
- The cybersecurity risk for medical devices extends beyond data breaches; it encompasses patient safety risks, where a device's core functionality could be maliciously altered.
- Hospitals are increasingly implementing their own cybersecurity standards that can be more rigorous than FDA regulations, creating another significant hurdle for manufacturers.
- Innovators must consider the entire healthcare ecosystem, including regulatory pathways, reimbursement models, and clinical workflows, from the very beginning of the design process.
- The rise of AI in diagnostics brings new challenges, particularly around liability, as it blurs the lines of responsibility between the physician, the AI developer, and the healthcare institution.
- Startups are advised to engage with the FDA early in their development process to understand what claims they can make and what regulatory hurdles, including cybersecurity, they will face.