Overcoming AI and Data Security Challenges in MedTech with May Lee | Ep. 37 - Full Transcript | The Med Device Cyber Podcast
Read the complete, searchable transcript of Episode 22 of The Med Device Cyber Podcast - expert conversations on medical device cybersecurity, FDA premarket and postmarket guidance, SBOM management, threat modeling, and penetration testing.
Prefer the listening experience? Open the episode page for the synopsis, key takeaways, topics, and Apple / YouTube listen links.
Episode summary
In this episode of The Med Device Cyber Podcast, hosts Trevor Slattery and Christian Espinosa are joined by May Lee, a consultant from CS Life Sciences with extensive experience in the medical device industry. May Lee shares her background, which includes an engineering degree from Arizona State University and over a decade of work with companies ranging from startups to large corporations like Philips and Cochlear. Her current specialization is in the burgeoning field of Artificial Intelligence (AI) and Machine Learning (ML) within medical devices, guiding companies through the complex regulatory and technical landscapes. The core of the conversation explores the significant shifts occurring in medical device cybersecurity. The panel discusses how the industry is moving away from treating cybersecurity as an afterthought and is now embracing a "secure by design" philosophy, where security is integrated from the earliest stages of the product lifecycle. This change is largely driven by stricter global regulations and a growing awareness of the potential risks. A major focus of the episode is the future threat posed by quantum computing. The hosts and guest unpack the "harvest now, decrypt later" strategy, where attackers steal encrypted data today with the intention of breaking the encryption once quantum computers become powerful enough. This looming reality necessitates a move toward post-quantum or quantum-safe cryptography to protect valuable and sensitive health data in the long term. The practical challenges of implementing these resource-intensive encryption methods on legacy or low-power medical devices are also considered. Furthermore, the episode provides a comparative analysis of the cybersecurity regulations in key global markets, primarily the United States (FDA), the European Union (EU MDR), and China (NMPA). They highlight the differences in approach, noting the FDA's increasingly prescriptive guidance versus the EU's reliance on broader standards. The discussion points out that China's requirements are often unique, demanding specific encryption algorithms and cloud providers, which can force manufacturers to create different versions of their products for different markets. The talk concludes with a strong emphasis on the importance of a comprehensive Total Product Life Cycle (TPLC) approach, including robust supply chain management and third-party risk assessment. The key advice for medical device manufacturers is to engage with technical and regulatory experts as early as possible to develop a clear strategy, ensuring a smoother, more cost-effective path to market.
Key takeaways from this episode
- Cybersecurity for medical devices is transitioning from a post-launch fix to a foundational "secure by design" principle, requiring integration throughout the entire product lifecycle.
- The advent of quantum computing presents a significant future risk to current encryption standards, creating the 'harvest now, decrypt later' threat for sensitive patient data.
- Medical device manufacturers must begin planning for post-quantum cryptography to ensure the long-term security of their products and the data they handle.
- Global regulatory requirements for medical devices are not harmonized; the US (FDA), EU (MDR), and China (NMPA) each have distinct and sometimes conflicting cybersecurity rules.
- China's market has unique regulatory demands, including specific encryption algorithms and approved cloud platforms, which can complicate a global market entry strategy.
- The integration of AI and Machine Learning introduces new layers of complexity for both cybersecurity and regulatory compliance in the medical device space.
- Engaging regulatory and cybersecurity consultants early in the development process can prevent costly redesigns and delays in getting a product to market.
- A thorough understanding of the entire supply chain, including all third-party software and hardware components, is essential for comprehensive risk management.