Morrison Foerster’s Class Dismissed blog provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class actions lawsuits and product liability issues that affect consumer-facing companies. Through Class Dismissed, attorneys from our nationally recognized Consumer Class Action and Products Liability practices offer a real-time assessment of the developments in matters that are shaping the industry. This blog examines the full spectrum of consumer-related class action and product liability lawsuits ranging from false advertising, privacy, consumer product safety, ADA, food misbranding, TCPA, environment, retail, and government actions as well as nationwide and multidistrict litigation class actions.<h2>ABOUT MORRISON FOERSTER</h2>Morrison Foerster is a leading global law firm that transforms complexity into advantage for its clients. Our clients include some of the largest financial institutions, banks, consulting and accounting firms, and Fortune 100, technology, and life sciences companies. Highlighting the firm’s commitment to client service, leadership in market-changing deals and impact litigation, and values-based culture, Morrison Foerster has been repeatedly recognized as one of the top 10 firms on The American Lawyer’s A-List. Year after year, the firm receives significant recognition from Chambers and The Legal 500 across their various guides, including Global, USA, Asia‑Pacific, Europe, UK, Latin America, and FinTech Legal. Our lawyers passionately care about delivering legal excellence while living our values. Morrison Foerster has a long-standing commitment to creating a culture that respects and celebrates differences, while providing an inclusive environment. The firm has achieved Mansfield Certification Plus since 2018 as a result of successfully reaching at least 30 percent women, communities of color, and LGBTQ+ lawyer representation in a notable number of current leadership roles and committees. The firm also has a long history of commitment to the community and society through providing pro bono legal services, including litigating for civil rights and civil liberties, improving public education and fostering the wellbeing of children, advocating for veterans, promoting international human rights, enforcing the right to asylum, and safeguarding the environment.

Social

Search

Editors

park_julie_blog_150x150.png

park_julie_common_640x280.jpg

park_julie_heroretina_2700x1160.jpg

park_julie_mobileretina_750x1040.jpg

park_julie_social_600x600.jpg

Partner

Julie Park protects her clients’ products no matter what kind of product issue they face—whether it is planning for new product development, recalling an existing product, or defending clients against product liability or consumer class actions. Drawing on her deep technical and legal expertise, Julie counsels clients on consumer product safety regulation and pharmaceutical and medical device preemption while also managing complex and multijurisdictional litigation both in state and federal court.

Julie Y. Park

<div class="videoWrapper"><iframe frameborder="0" class="sticky-video" allowfullscreen="1" title="Meet Penny Preovolos, Litigation Partner" src="https://www.youtube-nocookie.com/embed/hv7hYn-Bl7c?rel=0&showinfo=0;vq=hd1080" title="iframe"></iframe></div>Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products. According to Chambers USA, Penelope has a “great reputation for antitrust and product liability work” and is a “superb all-around antitrust lawyer.”Penelope was named the 2019 Antitrust Lawyer of the Year by the Antitrust, UCL, and Privacy Section of the California Lawyers Association. She was co-chair of MoFo’s antitrust practice for 14 years. She has served as chair of the Antitrust and Trade Regulation Section of the State Bar of California and as a member of the Ninth Circuit Advisory Committee on Local Rules and Operations. She is an editor of and frequent contributor to Morrison & Foerster’s <a href="https://classdismissed.mofo.com/">Class Dismissed blog</a>, as well as a frequent speaker about class action and antitrust issues.More About PenelopePenelope clerked for the Honorable Charles M. Merrill, United States Court of Appeals for the Ninth Circuit. She graduated cum laude from Harvard Law School, where she was executive editor of the Harvard Civil Rights – Civil Liberties Law Review. Penelope was a member of Phi Beta Kappa at the University of California, Berkeley. She was awarded the University Medal, the highest undergraduate honor at the university, as well as the English Departmental Citation (awarded to the outstanding graduate in that department).

preovolos_penelope_blog_150x150.png

preovolos_penelope_common_640x280.jpg

preovolos_penelope_heroretina_2700x1160.jpg

preovolos_penelope_mobileretina_750x1040.jpg

preovolos_penelope_social_600x600.jpg

Senior Counsel

Penelope has served as lead counsel in major consumer class actions and antitrust cases for more than 35 years, successfully representing high-profile defendants in antitrust, consumer fraud, and product defect matters. Her clients span a range of industries, including consumer electronics, technology, retail, publishing, food and beverage, cosmetics, and household products.

Penelope A. Preovolos

Claudia focuses her practice on the defense of consumer class actions and on complex commercial litigation, including unfair business competition, false advertising, product liability, and privacy matters. She is currently representing numerous consumer goods manufacturers and retailers in false advertising and mislabeling class action lawsuits. Claudia also regularly counsels clients in the food, cosmetics, retail, and technology industries. She represents companies in false advertising disputes before the National Advertising Division (NAD) of the Council of Better Business Bureaus, Inc.<h5>More about Claudia</h5>Claudia is active in MoFo’s pro bono efforts, and recently traveled to El Paso, Texas, to work with families separated and detained at the border. She is also supervising a pro bono collaboration with Equal Rights Advocates, a nonprofit fighting for gender justice in work places and schools across the country. The initiative will help students who have been victims of sexual assault, attempted assault, or harassment find support and seek justice. Claudia is also a board member of Bay Area Legal Aid and a former board member of Equal Rights Advocates. Claudia is an editor and frequent contributor to MoFo’s <a href="https://classdismissed.mofo.com/">Class Dismissed</a> blog, which provides reports about the latest defense news, developments, and trends in class action lawsuits and product liability issues that affect consumer-facing companies. Her perspectives are also respected in the larger legal community: Claudia has published articles about class action and false advertising issues, and is a co-author of Chapter 7 — “Unfair Competition in California Business Litigation 2016” — of The Recorder. She also regularly speaks at conferences on class action and advertising trends. Claudia is currently serving as a Lawyer Representative for the Northern District of California. She received her J.D. degree in 2004 from Berkeley Law (Boalt Hall School of Law), where she was an associate editor of the Berkeley Technology Law Journal.

vetesi_claudia_blog_150x150.png

vetesi_claudia_common_640x280.jpg

vetesi_claudia_heroretina_2700x1160.jpg

vetesi_claudia_mobileretina_750x1040.jpg

vetesi_claudia_social_600x600.jpg

Claudia focuses her practice on the defense of consumer class actions and on complex commercial litigation, including unfair business competition, false advertising, product liability, and privacy matters. She is currently representing numerous consumer goods manufacturers and retailers in false advertising and mislabeling class actions.

Claudia M. Vetesi

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office.Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.Alexandra has significant trial experience. She has first-chaired a one-week jury trial and second-chaired a five‑week jury trial, both involving multiple claims and witnesses. She also has extensive experience in alternative dispute resolution, representing clients at mediations, mandatory settlement conferences, and early neutral evaluations.Alexandra enjoys tracking developments and keeping her clients updated on product liability and personal injury claims, frequently writing or presenting on emerging areas such as autonomous vehicles and smart devices. Alexandra’s experience also extends to professional liability, warranty claims, eminent domain, and construction law.Alexandra earned her J.D. from the University of San Diego School of Law. While in law school, the San Diego Law Review published her comment on the recovery of damages by plaintiffs in a persistent vegetative state, and she also served as a comment editor. She received her B.A. from the University of California, Los Angeles, where she majored in Political Science and minored in Spanish. A San Diego native, she attended a Spanish immersion school through the eighth grade. Alexandra is active in the San Diego community, advising students at a local college. She is also a member of several legal organizations in San Diego, including Lawyer’s Club, the Association of Business Trial Lawyers, and Wallace Inn of Court.

preece_alex_blog_150x150.png

preece_alex_common_640x280.jpg

preece_alex_heroretina_2700x1160.jpg

preece_alex_mobileretina_750x1040.jpg

preece_alex_social_600x600.jpg

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, consumer products, automobiles, and AI. Alexandra’s litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow is a partner in the Litigation Department of Morrison Foerster’s San Diego office. Alexandra litigates product liability matters involving medical devices, pharmaceuticals, automobiles, AI, and robotics. Alexandra's litigation expertise spans the entire case life cycle in both state and federal courts. She handles all phases of discovery, including fact investigation and expert discovery. Alexandra has taken over twenty-five depositions, including experts, plaintiffs, treating physicians, and third-party witnesses. She drafts and argues motions of all types, including motions for summary judgment, motions to quash, and motions for preliminary injunction.

Alexandra Barlow

Adam J. Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.Mr. Hunt has extensive experience representing consumer products companies, financial institutions, and technology firms in class action cases and complex commercial disputes before state and federal trial courts, as well as in arbitrations. Clients seek Mr. Hunt’s counsel for his creative, strategic thinking in high-stakes, high-profile matters. He has represented clients facing claims under false advertising, antitrust, and privacy laws throughout the country, securing wins at the pleading stage, summary judgment, and trial, in addition to negotiating favorable settlements, often early in the case. Representative experience includes successfully securing rulings dismissing two putative false advertising class action cases against one of the best-known consumer electronics companies in the world; obtaining a complete win on summary judgment for a major shipping and logistics company in a multimillion-dollar commercial dispute; appearing as counsel at trial for a leading financial institution in a $100 million commercial dispute, winning a bench trial verdict; and prevailing on motions to dismiss false advertising class actions against a leading Greek yogurt company.Mr. Hunt is also an editor of the firm’s <a href="https://classdismissed.mofo.com/" target="_self">Class Dismissed blog</a>, which provides insights, recommendations, and timely reports on the latest defense news, developments, and trends in the most current class action lawsuits that affect consumer-facing companies.Mr. Hunt maintains an active pro bono practice and is the recipient of the New York State Bar Association’s 2017 President’s Pro Bono Service Award for the First Judicial Department, the 2018 Public Service Award from New York University School of Law, and Morrison Foerster’s Kathi Pugh Award for Pro Bono Services.Mr. Hunt received his B.A. with honors from Swarthmore College and his J.D. cum laude from New York University.

hunt_adam_blog_150x150.png

hunt_adam_common_640x280.jpg

hunt_adam_heroretina_2700x1160.jpg

hunt_adam_mobileretina_750x1040.jpg

hunt_adam_social_600x600.jpg

Adam Hunt is a partner in the Litigation Department of Morrison Foerster’s New York office. His practice focuses on complex litigation, with an emphasis on class action and commercial litigation.

Adam Hunt

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. Subscribe to receive the latest updates by attorneys from our nationally recognized Consumer Class Action and Product Liability practices.

Welcome to Class Dismissed

class-dismissed-welcome-image.jpeg

class-dismissed-welcome-image

Morrison Foerster’s Class Dismissed blog provides insights and reports on the latest news, developments, and trends that affect consumer-facing companies. 

Class Action

Blog - Terms of Use

Blog - Privacy Policy

Blog - Blog Disclaimer

Blog - Attorney Advertising

morrison-foerster-blog-logo.png

Brings together legal insights and in-depth analyses on trends and complex issues shaping the global technology industry.

MoFo Tech

Equips our clients with the most up-to-date and relevant information on employment and labor law issues.

Employment Law Commentary

Stay on top of emerging issues and stay informed of developments related to the law and business of social media.

Socially Aware

In-depth analysis of developments and trends impacting government contracting.

Government Contracts Insight

The latest news and insights from the nationally recognized Consumer Class Action and Product Liability practices of Morrison & Foerster.

Class Dismissed

  Linkedin

MoFo LinkedIN

Class Dismissed Blog - RSS

Stay Connected

By submitting your data to subscribe to this blog, you approved Morrison & Foerster LLP to email you future information about MoFo news and events. You may opt-out at any time by sending a request to <a href="mailto:mofonews@mofo.com">mofonews@mofo.com</a>. To learn more about how Morrison & Foerster LLP uses and protects your personal data, please view our <a href="https://www.mofo.com/about/privacy-policy.html">Privacy Policy</a> at <a href="https://www.mofo.com/">www.mofo.com</a>.

Never miss a post from Class Dismissed. Enter your email below to stay up-to-date.

Subscribe

Class Action and Product Insights for Your Business

Morrison Foerster - Footer

The FDA’s recently issued draft guidance on “Postmarket Management of Cybersecurity in Medical Devices” seeks to address some of the increasing concerns that me

Blogs -  Home Button

Home

Blog - Topics

TCPA

Announcements & Press

Antitrust

Appellate & Supreme Court

Arbitration

Autonomous Vehicles & Robotics

Aviation & Drones

Class Certification

Consumer Products

Coronavirus (COVID-19)

CPSC

Drug & Medical Device

Emergency Use Authorization (EUA)

Environmental Law

False Advertising

FCRA

Food Misbranding

Government Actions

Internet of Things

Mass Torts

Pharmaceutical & Medical Devices

Privacy

Product Liability

Public Readiness and Emergency Preparedness Act (PREP Act)

Retail

Trials

Topics

Blog - Editors

Blog - About

About

Blog - Subscribe

FDA Embraces Internet of Things: New Draft Guidance on Postmarket Cybersecurity for Medical Devices

FDA Embraces Internet of Things: New Draft Guidance on Postmarket Cybersecurity for Medical Devices | Class Dismissed

Erin M. Bosman

The FDA’s recently issued draft guidance on “<a href="http://www.fda.gov/downloads/medicaldevices/deviceregulationandguidance/guidancedocuments/ucm482022.pdf" target="_blank">Postmarket Management of Cybersecurity in Medical Devices</a>” seeks to address some of the increasing concerns that medical device providers, regulators, and consumers have about postmarket cybersecurity standards related to medical devices. Because the consequences of cybersecurity breaches related to medical devices can be serious, manufacturers, health care facilities, and providers should take precautions to ensure that cybersecurity policies and protocols are thorough and up-to-date. It should be noted that this draft guidance is still in draft form and not to be implemented yet.Imagine this scenario: A rogue agent gains access to the serial number on the Vice President’s pacemaker. The agent sends the number to an associate who remotely hacks his way through the device’s security framework and accelerates the Vice President’s heart rate, inducing a heart attack. Sound familiar? Fortunately, this was not a news report; rather, it was a plot line during the second season of Showtime’s television series Homeland. But like many science fiction predictions, this one has already found roots in reality. With the rapidly expanding Internet of Things, and with millions of medical devices now connected to the Internet, hackers have more devices to target every day. Many of these devices, like the pacemaker in Homeland, are essential to a customer’s health, and as a result security breaches should not be taken lightly.BackgroundIn February 2013, President Obama issued <a href="https://www.whitehouse.gov/the-press-office/2013/02/12/executive-order-improving-critical-infrastructure-cybersecurity" target="_blank">Executive Order 13636</a>, which stated that cyber threats to national security are among the most serious our nation faces. Additionally, <a href="https://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil" target="_blank">Presidential Policy Directive – 21</a> tasks Federal agencies to strengthen the security and resilience of critical infrastructure against physical and cyber threats. The FDA’s draft guidance borrows principles from these directives and represents the FDA’s current efforts to help strengthen cybersecurity in the rapidly-growing medical device market. Moreover, the FDA encourages manufacturers to apply the voluntary National Institute of Standards and Technology (“NIST”) framework in the development and implementation of their cybersecurity controls. Although the NIST framework only applies to critical infrastructure, the FDA encourages applying its principles broader than critical infrastructure and offers guideposts for companies to improve their cybersecurity posture.Although the FDA’s guidance does not establish legally enforceable responsibilities, it does paint a picture of the FDA’s “current thinking” on this topic, though it should be noted that the draft guidance does not establish any rights for any person, and it is not binding on the public or the FDA, and medical device manufacturers retain the ability to use alternative approaches.Focusing primarily on patient safety, the FDA recommends that medical device manufacturers monitor, identify, and respond to cybersecurity vulnerabilities and exploits during the postmarket management of their devices. The draft document also provides some guidance concerning reporting duties related to cybersecurity breaches.General Principles Concerning Postmarket RegulationThe FDA states that its position is that medical device cybersecurity is a shared responsibility that implicates not just the manufacturer of medical devices, but also health care facilities, patients, and providers, though manufacturers are likely to be on the front line of any litigation.The FDA stated its view that due to the continuing evolution of cybersecurity risks associated with medical devices, it is not possible to eliminate risks through premarket controls alone. Accordingly, manufacturers should[1] increase their postmarket cybersecurity risk management measures. The draft guidance suggests that medical device manufacturers focus on certain aspects, including:<ol><li>Identify problem areas in cybersecurity framework. This can be achieved through analysis of complaints, returned products, service records, and other sources of data that may help identify existing and potential cybersecurity risks. Many medical devices now contain or share internal records, statistics, and incident reports related to their performance. These metrics can be crucial for manufacturers to identify potential weaknesses in their cybersecurity armor before they are exploited.</li><li>Characterize and assess the identified vulnerabilities with regards to exploitability and potential severity of impact to health. This includes establishing and communicating the process for receiving and managing vulnerability reports. The FDA guidance provides additional detail and recommends using a cybersecurity vulnerability assessment tool or similar scoring system in this process.</li><li>Clearly define “essential clinical performance” of the medical device at issue in order to develop safeguards that protect, respond, and recover from the cybersecurity risk. Essential clinical performance is defined as “performance that is necessary to achieve freedom from unacceptable clinical risk.” In turn, an unacceptable clinical risk is one with high exploitability potential that poses a severe impact to health. The FDA admits that risk assessment may be difficult (i.e. manufacturers may struggle to categorize a risk as acceptable or unacceptable). Even so, the FDA recommends that manufacturers “make a binary determination that a vulnerability is either controlled or uncontrolled using an established process that is tailored to the product, its essential clinical performance, and the situation.”</li><li>Adopt a coordinated vulnerability disclosure policy and practice. Clearly defining user expectations and allocating risks appropriately can save manufacturers time and money in the long run.</li><li>Deploying mitigations that address cybersecurity risk early and prior to exploitation. If possible, risks should be addressed before they are exploited. Not only will early action protect customers, it may also limit potential damage claims down the road. The FDA notes that “acceptable mitigations will vary according to the device’s essential clinical performance”—i.e., manufacturers should apply a sliding scale analysis. For example, the FDA notes that more significant mitigation may be necessary for a vulnerability affecting an insulin pump than one affecting a thermometer.</li></ol>The FDA recognizes that even in the most sophisticated cybersecurity programs, vulnerabilities may arise and complete security is impossible. The FDA’s guidance focuses only on those vulnerabilities that may affect safety. Manufacturers should be cognizant that other issues beyond the scope of the draft guidance could become the focus of other regulating bodies and/or plaintiffs’ attorneys.ReportingThe FDA document also provides some guidance to manufacturers with regard to reporting cybersecurity vulnerabilities and breaches to the FDA. Generally, the FDA does not plan to require premarket review or approval of “cybersecurity routine updates and patches” to medical device software.Additionally, the FDA does not plan on requiring reporting when changes to a device are made to address vulnerabilities associated with controlled risks. Controlled risks are those that present “sufficiently low residual risk that the device’s essential clinical performance could be compromised by the vulnerability.” Reporting is also not necessary when these changes are implemented “solely to strengthen cybersecurity.” However, the FDA suggests that companies report newly acquired information about cybersecurity vulnerabilities and device changes made as part of a cybersecurity routine update or patch in an annual report when they concern a premarket approval (or Class III) medical device (one that supports or sustains human life).The draft guidance provides a relevant example where manufacturers may not have to report an action to mitigate a controlled risk. In this example, a manufacturer becomes aware of an “open communication port” on its device. However, a design feature prevents unauthorized remote firmware from being downloaded onto the device. This requirement for physical access to the device substantially mitigates the threat; therefore, the risk is considered by the FDA to be controlled and acceptable. The manufacturer then enhances the device’s security by closing the open communication port and notifying users. These actions would be considered a cybersecurity routine update or patch and may not require reporting under federal standards. However, if this were a Class III device, the manufacturer would need to report the changes to the FDA in its annual report.On the other hand, when manufacturers implement risk control measures to account for uncontrolled risks to essential clinical performance, the FDA’s view is different, and reporting might be necessary. However, the FDA does not intend to enforce these reporting requirements when:  (1) there are no known serious adverse events or deaths associated with the vulnerability; (2) within 30 days, the manufacturer identifies and implements device changes and/or compensating controls to bring the residual risk to an acceptable level and notifies users; and (3) the manufacturer is a participating member of an Information Sharing Analysis Organization (“ISAO”)[2], such as the National Health Information Sharing & Analysis Center.The FDA’s drafters may have been Homeland fans as the guidance contains a familiar example where reporting may be necessary:  a manufacturer becomes aware of a vulnerability in a Class III medical device (i.e. a pacemaker) that allows it to be reprogrammed by an unauthorized user. The manufacturer performs a risk assessment and concludes that the vulnerability is moderately exploitable and the risk to the device’s essential clinical performance is uncontrolled. The manufacturer notifies the relevant stakeholders and distributes an emergency patch to mitigate the risk. The manufacturer is not a member of an ISAO. Even if the manufacturer is unaware of any incidents, because this vulnerability could result in severe injury or death, reporting may be necessary.ConclusionEven in light of the FDA’s guidance, manufacturers will likely struggle to categorize risks associated with cybersecurity vulnerabilities. Consequently, determining reporting requirements (contingent on whether a risk is uncontrolled or controlled) may also present challenges unique to each medical device at issue. Manufacturers will be well served by factoring in the FDA guidance into their existing cybersecurity plans. [1] The use of the word should in Agency guidance means that something is suggested or recommended, but not required.[2] An “ISAO” is a group created to gather, analyze, and disseminate critical infrastructure information. See <a href="https://www.whitehouse.gov/the-press-office/2015/02/13/executive-order-promoting-private-sector-cybersecurity-information-shari" target="_blank">Exec. Order No. 13691 (Feb. 13, 2015)</a>.