Incident Response

Incident response for medical devices follows the standard cycle of assess, contain, eradicate, recover, and learn, with two additions specific to healthcare: a clinical safety role that judges patient impact and a regulatory role that handles FDA notification. Severity classification drives the whole response, and patient harm always means Severity 1.

5.9.1 When Prevention Fails

Despite best efforts, incidents happen. Your response determines the outcome.

Incident Response Plan Structure

flowchart TD
    A[Incident Detected] --> B[Initial Assessment]
    B --> C[Severity Classification]
    C --> D[Response Team Activation]
    D --> E[Containment]
    E --> F[Eradication]
    F --> G[Recovery]
    G --> H[Lessons Learned]

5.9.2 Response Team Roles

Incident Commander:

• Overall coordination
• External communication
• Decision authority

Technical Lead:

• Technical investigation
• Solution development
• Evidence preservation

Clinical Safety:

• Patient impact assessment
• Clinical guidance
• Safety communication

Legal/Regulatory:

• FDA notification
• Legal requirements
• Documentation

5.9.3 Incident Classification

Define severity levels clearly:

Severity 1 (Critical):

• Patient harm occurring/imminent
• Multiple devices compromised
• Active exploitation
• Core safety functions affected

Severity 2 (High):

• Potential patient harm
• Limited compromise
• Exploitation possible
• Important functions affected

Severity 3 (Medium):

• No direct patient impact
• Single device/site
• Theoretical exploitation
• Secondary functions

5.9.4 Response Procedures

Immediate Actions (First 24 hours):

1. Assess scope and impact
2. Contain the incident
3. Preserve evidence
4. Notify stakeholders
5. Begin investigation

Short-term (48-72 hours):

1. Develop mitigation
2. Test solutions
3. Communicate updates
4. Deploy fixes
5. Monitor effectiveness

Long-term (Weeks):

1. Root cause analysis
2. Permanent fixes
3. Process improvements
4. Documentation
5. Regulatory follow-up

For a case study in why destructive attacks need their own playbook, see What the Stryker attack actually means for medical device companies.