Week of September 14, 2026
Software-driven recalls kept landing, a major manufacturer closed out an August cyber incident, and Health-ISAC published a procurement baseline that hospitals are likely to hand straight to their device vendors.
- StandardsSeptember 18, 2026
Health-ISAC publishes a nine-domain MedTech security baseline
Health-ISAC's Medical Device Security Council released a MedTech Security Baselines paper covering nine capability domains that hospitals commonly expect manufacturers to support. It distinguishes devices running full operating systems from constrained embedded and real-time platforms, and calls for documented compensating controls where a device cannot support a control natively. Health-ISAC frames it as decision support for evaluation and procurement, not a certification standard or a prescriptive checklist.
Why it matters: Procurement questionnaires tend to follow documents like this within a quarter or two. If your device cannot meet a domain natively, the answer buyers will accept is a written compensating control tied to the clinical context - not silence.
- RecallSeptember 18, 2026
Philips EPIQ Elite ultrasound software issue classified Class 2
FDA posted a Class 2 recall (Z-3249-2026) for Philips EPIQ Elite Diagnostic Ultrasound Systems running software version 14.0. Philips reported that a Doppler sample could be displayed shallower than its actual measurement location, potentially producing inaccurate blood flow velocity measurements and misdiagnosis. Philips issued an Urgent Medical Device Correction on August 7, 2026 advising customers to avoid a specific preset on the C5-1 probe. FDA recorded the cause as a software design change.
Why it matters: A software design change that alters clinical output is a postmarket change-control problem before it is a field-action problem. The same verification gap that lets a display error ship is what reviewers probe when they ask how your SPDF handles post-clearance software updates.
- IncidentSeptember 14, 2026
Boston Scientific restores operations after its August cyber incident
Boston Scientific said manufacturing, order fulfillment and shipping are fully restored following the cybersecurity incident identified on August 25, with products moving at or above normal levels and some order backlog still clearing. The company said independent assessments by CrowdStrike and other third parties found no evidence of ongoing threat activity or compromise of its systems or product technologies since containment on August 25. Disruption to remote monitoring activations has also been resolved.
Why it matters: The device itself was not the entry point, but remote monitoring and order fulfillment were the patient-facing casualties. Business-continuity planning for connected device services belongs in the same risk conversation as device security, and increasingly shows up in hospital contracts.
- RecallSeptember 14, 2026
Class I recall over APAP firmware that can shut down therapy
FDA classified as Class I a nationwide recall of BMC Medical Luna G3 APAP Model LG3600 devices running firmware G3-2.00.76, which may display an error and shut down when the device is simultaneously under high pressure, high respiratory rate and high peak flow. BMC upgraded devices to firmware G3-2.00.77 at the U.S. importer's warehouse in late 2024, but determined up to 196 units may never have received the update. BMC reported no complaints or serious adverse events tied to the failure.
Why it matters: The interesting failure here is distribution, not code: a fix existed for two years and a subset of units never received it. If you cannot prove which serial numbers are running which firmware, your patch process is not a patch process.
- GuidanceFebruary 3, 2026
Reminder: the February 2026 premarket guidance is the operative one
FDA's current final guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions, was issued February 3, 2026 and supersedes the June 27, 2025 version. It ties cybersecurity expectations to the Quality Management System Regulation and restates FDA's recommendations under Section 524B of the FD&C Act for cyber devices.
Why it matters: Submissions still arrive citing the 2023 or 2025 guidance. That alone signals a stale package to a reviewer, and the QMSR framing in the 2026 version means cybersecurity evidence has to come out of design controls rather than a separate appendix written at the end.
Want the long-form version?
These briefings stay short on purpose. The detailed guidance breakdowns, SBOM requirements, and submission checklists live on Blue Goat Cyber, and the conversations behind them are in the episode archive.