Healthcare Supply Chain Association recommends these contract provisions for health care contracts:
- Suppliers should warrant their compliance with FDA premarket and post market guidance relative to cybersecurity risks throughout their product’s lifecycle.
- Products should be assessed and warranted to be free of known malicious code or other vulnerabilities at the time of delivery and/or implementation.
- Suppliers should comply with all reasonable security practices required by the provider that are consistent with current network and device security guidelines and best practices looking to:
- International Organization for Standardization (ISO) International Electrotechnical Commission (I(IEC) ( ISO/IEC)
- the Association for the Advancement of Medical Instrumentation (AAMI)
- the Open Web Application Security Project( OWASP)
- The SANS Institute
- the Center for Internet Security
- National Institute of Standards and Technology (NIST)
- The expected useful life of the device or service should be specified within the purchase agreement and security updates to the software and all supporting software components should be made available for the stated useful life at no additional cost to the provider
- Suppliers should make every effort to assist providers in resolving cybersecurity threats and vulnerabilities in a timely manner.
- Purchase agreements for medical devices and services should contain appropriate liability and warranty provisions that contain no limitations on supplier’s liability due to failure to comply with cyber security terms.
- Cyber security sharing initiatives should be explicitly allowed and exempted from any non-disclosure provisions
- A Manufacturers Disclosure Statement for Medical Device Security (MDS2) should be provided for any device that maintains or transmits data.
- SUPPLIER WARRANITES. Suppliers should warrant that they internally follow cybersecurity best practices, provide documentation describing in detail their cybersecurity/penetration testing process as well as program details for patching, incident response and secure set up and configuration.
HSCA | Recommendations for Medical Device Cybersecurity Terms and Conditions