Meaningful Use for Medical Devices (MUMD): A Patient-Impact-Weighted Incentive Framework for Cyber-Resilience

This proposal presents Meaningful Use for Medical Devices (MUMD), a framework for prioritizing and incentivizing the remediation of cybersecurity vulnerabilities in networked medical devices and the health information systems on which they depend. The framework does not claim to discover that the Common Vulnerability Scoring System (CVSS) is insensitive to clinical consequence. That limitation is well established and has been addressed by recognized instruments, including the MITRE Rubric for Applying CVSS to Medical Devices [9], the risk-management standard ISO 14971 [4], AAMI TIR57 [8], and the cybersecurity guidance of the U.S. Food and Drug Administration (FDA) [1,3] and the International Medical Device Regulators Forum (IMDRF) [6]. The recognized open problem, rather, is that the contribution of a cybersecurity risk to a device's overall benefit-risk profile remains underspecified across regulators [11]. MUMD's contribution sits there: it is an incentive layer, a tiered, deadline-linked financial structure with a need-based stipend, placed atop a clinically grounded severity assessment, together with a candid treatment of the incentive-compatibility problem such a structure raises. The severity assessment pairs a weighted Patient-Impact Score (PIS) with a non-compensatory severity gate anchored to the FDA serious-injury definition at 21 CFR 803.3(w), so that a vulnerability capable of causing death or serious injury, characteristically one affecting a Class III, life-sustaining device, cannot be averaged below the highest remediation tier. The framework is presented as a proposal. It has not been piloted; Section 6 sets out how it would be evaluated. The worked illustrative examples in Section 3 demonstrate, on paper, how the calibrated score can reorder vulnerabilities relative to CVSS in both directions for those constructed cases; whether this holds in practice awaits empirical evaluation in Section 6.