Section 524B gave hospitals a baseline to buy against

The week

On December 29, 2022, President Biden signed the Consolidated Appropriations Act, 2023. Section 3305 of the act added a new section 524B to the Federal Food, Drug, and Cosmetic Act on the cybersecurity of medical devices. It applies to “cyber devices”: devices that include software, can connect to the internet and could be vulnerable to cybersecurity threats. Manufacturers submitting such devices for premarket review must provide a plan to monitor, identify and address postmarket vulnerabilities, including coordinated vulnerability disclosure. They must maintain processes that give reasonable assurance the device and related systems are secure, including updates and patches. And they must supply a software bill of materials covering commercial, open-source and off-the-shelf components. The requirements took effect 90 days after enactment, at the end of March 2023.

Hospitals had spent years asking device makers for a list of software components, a way to report vulnerabilities and a commitment to ship patches. They rarely had the bargaining power to insist, especially for specialized equipment with few alternatives. Section 524B did not apply to hospitals at all. It set a floor manufacturers had to meet for new submissions, and that changed the negotiation. The effect showed up at three procurement moments: selecting a new device, contracting for its support, and managing the installed base the law did not touch.

Selecting a new device

Before the law, a request for a software bill of materials in a request for proposals often met a refusal, a marketing sheet or a promise to provide one later. Once FDA required an SBOM in premarket submissions for cyber devices, the question shifted from whether a manufacturer had one to whether it would share it. FDA submissions are not automatically available to buyers, so health systems still had to ask, and some manufacturers asked for nondisclosure terms first.

The paperwork matters less than the process behind it. Strong selection questions ask whether the manufacturer publishes a coordinated vulnerability disclosure policy. They ask how it assesses and tells customers about new vulnerabilities in third-party components, which operating system the device runs, and when support for it ends. They also ask whether the hospital can apply operating system patches itself, or only the manufacturer can. A manufacturer that built these processes for FDA can answer quickly. Slow or vague answers are a useful signal, and they should lower the score rather than prompt a follow-up meeting.

Scoring matters too. If security answers carry little weight in the evaluation, they will not change outcomes. Health systems that gave security a defined share of the technical score, agreed in advance by clinical engineering, security and supply chain, turned the baseline into an actual criterion.

Contracting for support

The law requires manufacturers to maintain processes for updates and patches. It sets no service terms between a manufacturer and a particular hospital. That gap belongs in the contract.

Useful clauses are specific. They set a time frame for the manufacturer to assess a newly published vulnerability and tell the customer whether the device is affected. They commit to patches or documented compensating controls for critical issues. They state which party may apply operating system and antivirus updates without voiding the device’s validation. They require a minimum notice period before end of support, and a right to receive updated SBOMs when software changes.

Sequence matters as much as wording. Device contracts are often negotiated by supply chain and clinical departments, with security consulted late or not at all. Once price is agreed, the buyer’s bargaining power is gone. Bringing security into the requirements stage, with standard contract language that references the manufacturer’s own FDA-facing commitments, made the terms harder to refuse. A manufacturer can hardly argue that it cannot commit to processes it has already described to its regulator.

There is a cost. Security requirements raise manufacturers’ costs, and some of that reaches device prices. What changed is that the baseline became a cost of market entry shared by all manufacturers, rather than an extra that one hospital had to fund alone. Bid evaluation should then use total cost of ownership. A cheaper device with a short support horizon and no patch commitments carries later costs: segmentation work, monitoring, early replacement and possible downtime.

The installed base the law did not touch

The requirements apply to new premarket submissions. Imaging systems, infusion pumps, laboratory analyzers and patient monitors already in service were unaffected. Many run older operating systems and will stay in use for years because they are expensive and clinically trusted.

For these devices, the hospital’s bargaining power is indirect. Manufacturers building new processes for new products can often extend some of them, such as vulnerability notices and component lists, to current product lines on request. Service contract renewal is the moment to ask, because it is the only time the hospital is paying for something new.

Where a manufacturer will not support an older device, the decision becomes a capital and clinical one. Compensating controls come first: placing devices on dedicated network segments, restricting which systems they can talk to, and monitoring their traffic for anomalies. A replacement timeline should be agreed by clinical leadership, finance and security together, and recorded in the capital plan with the device’s risk rating attached. Without that record, legacy devices tend to stay in service until they fail or are attacked.

Clinical engineering teams need a practical inventory to do any of this: device model, software version, network location, support status and whether an SBOM is on file. Many hospitals had the first three in a maintenance system and none of the security attributes. Adding them is unglamorous work that makes every later decision faster.

With hindsight

FDA issued final guidance on cybersecurity in premarket submissions in September 2023 and, from October 1, 2023, began refusing to accept cyber device submissions that lacked the required information. SBOMs became routine in new device submissions, and many manufacturers began providing them to customers on request. The hospital side moved more unevenly. Large systems with strong clinical engineering and security functions wrote the new expectations into contracts. Many smaller hospitals lacked the staff to do so. The installed base proved the durable problem, and legacy devices remain a common finding in healthcare security assessments in 2026. The baseline itself held: device cybersecurity is now treated as a product quality matter regulated at the manufacturer. The gap that remains is use. An SBOM on file helps only if someone matches it against new vulnerability advisories.