Hardware Podcasts

#426: Software as a Medical Device: Securing Your Digital Future

Global Medical Device Podcast · 29 Sept 2025 · 44m · Episode 426

What this episode covers

Jose Bohorquez and Mohamad Foustok from CyberMed explain that Software as a Medical Device (SaMD) must be treated as a medical device from inception, integrating security into the architecture rather than treating it as an afterthought. They highlight the 2023 FDA guidance shift, which raised the regulatory bar for all devices with software functions, regardless of connectivity, and discuss the 'zero trust' principle and 'reasonable assurance of cybersecurity.' The guests warn that skipping architectural planning leads to costly redesigns and legal risks, citing the recent $9.8 million DOJ settlement with Illumina as a cautionary tale for legacy devices.

Most relevant to

early-stage companies and companies scaling up

Topics

Mentioned

Companies
CyberMed, Bold Type, Illumina
Also
FDA, IEC 62304, CISA, NIST, FIPS

Related episodes from other shows

Other shows on the same ground, closest first.

  • Let's Combinate · 1h 03m

    021 - "Options" with Karandeep Singh Badwal

    Karandeep Singh Badwal, a QA/RA consultant and host of The MedTech Podcast, explains how defining 'intended use' determines whether a product is a regulated medical device or unregulated software, a critical distinction for startups. He details the specific regulatory challenges of Software as a Medical Device (SaMD), including cybersecurity, GDPR compliance, and the impact of the EU MDR on software classification. Badwal also discusses the strategic advantages for UK software companies post-Brexit, where they can still self-certify as Class 1 devices while EU counterparts face stricter notified body audits.

    Validation & product-market fitQuality & yield
    9 chapters

  • Let's Combinate · 30m

    140 - Medical Device & Diagnostics Cybersecurity, 3rd Party Software, SBOM's, Evaluating Skill and Mindset with Christian Espinosa

    Christian Espinosa, CEO of Blue Goat Cyber, explains the unique cybersecurity challenges of medical devices, emphasizing that patient safety is the primary driver over data privacy. He details the importance of Software Bill of Materials (SBOM) and identifying third-party open-source components, such as the Shellshock vulnerability, to mitigate supply chain risks. Espinosa also discusses his hiring philosophy for Blue Goat Cyber, prioritizing practical aptitude and clarity of purpose over formal certifications or degrees.

    Security & privacyPCB design & layout
    6 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

  • Let's Combinate · 41m

    134 - ISO62304, Software Development Process, SaMD, Closed Loop Systems, Complexities with Cloud and Better Software in MedTech with Richard Koch

    Richard Koch, founder of KochSaMD, explains the complexities of developing cloud-based medical devices, using a closed-loop insulin pump system as a primary case study. He details how ISO 62304 governs software development within the broader ISO 13485 framework, emphasizing the shift from batch-based physical manufacturing to continuous, high-velocity software updates. Koch warns that tech giants like Apple and Google are disrupting the industry by leveraging their digital expertise to acquire or compete with traditional medtech firms, urging leaders to upskill in software development to survive.

    Embedded firmwareConnected products & IoT
    7 chapters

  • Product Startup · 20m

    128: Creating an App for Your Hardware Device

    Piotr Zajac, CEO of Untitled Kingdom, a 55-person app development firm specializing in IoT, MedTech, and FemTech, explains how to build successful apps for hardware devices. He argues that developers must focus on one or two core features and prioritize user feedback to avoid over-engineering, citing a failed project where a client spent millions on unnecessary features. Zajac emphasizes that onboarding is crucial for creating user habits and that high-quality, secure software aligned with FDA and ISO standards is far cheaper in the long run than cheap, buggy code. He illustrates these points with the Irgo hearing aid and its Soundmatch app, which uses ultrasound to personalize hearing profiles.

    Connected products & IoTPrototyping & iteration
    6 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Global Medical Device Podcast. The episode itself belongs to its publisher.