Vendor cybersecurity due diligence
Vendor cybersecurity due diligence in Healthcare & Life Sciences is now a hard compliance obligation, not a best-practice recommendation. The U.S. Department of Health and Human Services Office for Civil Rights, the U.S. Food and Drug Administration, and the European Data Protection Board have each issued enforceable guidance or rulemaking that directly governs how covered entities and device manufacturers assess third-party security controls. Compliance teams are auditing business associate agreements and vendor security attestations against the HHS OCR 2024 HIPAA Security Rule proposed updates before those requirements finalize.
Watch
- HHS OCR proposed HIPAA Security Rule amendments: vendor-specific technical safeguard requirements
- FDA cybersecurity guidance for medical device supply chain software bill of materials (SBOM) obligations
- NIS2 Directive Article 21 enforcement timelines for EU health sector supply chain risk assessments
- State attorney general enforcement patterns targeting inadequate third-party security contracting in health data breaches
- APRA CPS 234 cross-border application to APAC-based health IT vendors serving U.S. and EU entities
Recent material activity in Healthcare & Life Sciences
-
CMS renews NCQA deeming authority for Medicare Advantage HMOs and PPOs for six years
On July 27, 2026, CMS approved NCQA's renewal application for Medicare Advantage deeming authority, covering Health Maintenance Organizations and Preferred Provider Organizations. The six-year term allows NCQA-accredited…
Read a full sample brief → -
ECDC publishes week 30 Communicable Disease Threats Report covering Ebola, West Nile Virus, and respiratory surveillance across EU/EEA
The European Centre for Disease Prevention and Control issued its weekly Communicable Disease Threats Report for the period 18 to 24 July 2026. The report covers active threat monitoring for Ebola, West Nile Virus, Crime…
Read a full sample brief → -
Baxter recalls single lot of Cefazolin in Dextrose Injection over cardboard particulate contamination
Baxter International announced a voluntary nationwide recall on July 24, 2026 of Lot LD175708 (expiry February 14, 2027) of Cefazolin in Dextrose Injection, USP, 2G/100mL, due to cardboard particulate matter found in sol…
Read a full sample brief → -
Baxter recalls single lot of Cefazolin in Dextrose Injection over cardboard particulate contamination
Baxter International announced a voluntary nationwide recall on July 24, 2026 of one lot of Cefazolin in Dextrose Injection, USP, 2G/100mL, due to cardboard particulate matter found in solution. The recall covers Lot LD1…
Read a full sample brief → -
FDA issues Early Alert on Boston Scientific ENROUTE carotid neuroprotection systems over arterial sheath tip separation risk
FDA's Center for Devices and Radiological Health issued an Early Alert on July 24, 2026 for specific lots of the ENROUTE Transcarotid Neuroprotection System and ENROUTE Transcarotid Neuroprotection System Plus. Boston Sc…
Read a full sample brief → -
FDA issues Early Alert on Boston Scientific ENROUTE carotid neuroprotection systems over arterial sheath tip separation risk
FDA's Center for Devices and Radiological Health issued an Early Alert on July 24, 2026 for specific lots of the ENROUTE Transcarotid Neuroprotection System and ENROUTE Transcarotid Neuroprotection System Plus. Boston Sc…
Read a full sample brief → -
FDA grants full approval to zidesamtinib for ROS1-positive NSCLC following prior TKI therapy
The FDA approved zidesamtinib (Jideytro, Nuvalent, Inc.) on July 22, 2026 for adults with locally advanced or metastatic ROS1-positive non-small cell lung cancer who had received at least one prior ROS1 tyrosine kinase i…
Read a full sample brief → -
Sunny Pharmtech recalls three lots of injectable cyclophosphamide over steel particulate contamination
The FDA published a voluntary nationwide recall by Sunny Pharmtech, Inc. on July 24, 2026, covering three lots of Cyclophosphamide for Injection, USP, in 1g/vial and 2g/vial presentations. Steel particulate matter confir…
Read a full sample brief → -
FDA classifies diabetes digital behavioral therapeutic devices into Class II under special controls
On July 24, 2026, the FDA issued a final classification order placing diabetes digital behavioral therapeutic devices into Class II with special controls. The order establishes the regulatory pathway and codified special…
Read a full sample brief → -
FDA issues five-year import debarment order against Francis Esteban Matos following federal felony conviction
On July 24, 2026, FDA issued a final debarment order barring Francis Esteban Matos from importing or offering for import any drug into the United States for five years. The order follows a federal felony conviction for c…
Read a full sample brief →