What to do in case of security incidents and reportable events?

Patient Protection and Evidence Preservation First

In the event of a malfunction, incorrect software output, cyberattack, or failed interface, further damage must be prevented first. This may require a safe shutdown, isolation of a service, reverting to a validated procedure, or informing affected operators. At the same time, software version, configuration, logs, input data, timestamps, and any changes made must be secured against tampering. An unverified reinstallation can destroy important evidence.

Simultaneously, regulatory triage takes place. Article 2 number 64 MDR defines an incident among other things as a malfunction or deterioration in performance, ergonomically induced user error, insufficient manufacturer information, or adverse effect. According to number 65, it is serious if death, temporary or permanent serious deterioration of health, or a serious threat to public health has occurred, could have occurred, or could occur. Even a "near miss" without actual damage can therefore be reportable.

Deadlines According to Article 87 MDR

Manufacturers must report immediately upon becoming aware and no later than:

• within 15 calendar days for other serious incidents,
• within 10 calendar days for death or unexpected serious deterioration of health,
• within 2 calendar days for a serious threat to public health.

MDCG 2023-3 Rev. 2 explains terms, awareness date, and deadline calculation. If there is uncertainty, the investigation should not delay the report: a timely initial report can initially be incomplete and supplemented by follow-up reports. In Germany, the BfArM provides the current reporting pathway for manufacturers and authorized representatives; responsibilities may also lie with the Paul-Ehrlich-Institut for certain IVDs.

Investigation, Correction, and Communication

An incident team should designate regulatory, clinical, technical, data protection, and communication roles. The investigation considers the cause, affected versions and installations, probability of occurrence, possible clinical consequences, and whether the event can occur systematically. Findings feed back into risk files, cybersecurity assessments, clinical evaluations, and post-market surveillance.

If risk reduction requires a safety corrective action in the field, Articles 87 paragraph 1(b) and paragraph 8 as well as Article 89 MDR also apply. Measures, communication with authorities, and safety information to customers must be coordinated, traceable, and effectiveness-tested. Technical troubleshooting, CAPA, and regulatory reporting are three connected but distinct work packages.

The specific reporting obligation depends on the product, role, event, and country. Therefore, internal escalation paths should be significantly shorter than the statutory maximum deadlines and involve responsible specialists or authorities early on.