FDA's cybersecurity page names three routes. Manufacturers, importers and device user facilities file Medical Device Reports, which are mandatory. Health care providers use MedWatch Form 3500. Patients and caregivers use MedWatch Form 3500B. The right route depends on who you are.
The three routes
FDA lists these under "Reporting Cybersecurity Issues" on its medical device cybersecurity page:
- Manufacturer, importer or device user facility: Medical Device Reporting (MDR), which is mandatory.
- Health care provider: MedWatch Form 3500.
- Patient or caregiver: MedWatch Form 3500B.
The page is the starting point. The detailed rules for when an MDR is due sit in FDA regulations and guidance that this page links to, and they are not summarized here.
Manufacturers: reporting is one piece of a plan
For manufacturers, the guidance on premarket submissions says a plan should cover how vulnerabilities found after release will be identified and communicated, in line with ISO 13485 subclauses on analysis of data and improvement and with 21 CFR Part 806 where it applies. The same guidance says cyber device makers must submit a plan for monitoring, identifying and addressing postmarket vulnerabilities, including coordinated vulnerability disclosure.
Reporting to FDA and coordinating disclosure with researchers and customers are different tasks. Your plan should cover both. See what goes in a management plan.
Hospitals and clinicians
If you see a device behaving oddly in a way that might be security related, such as unexpected resets, unknown network connections or failed update checks, the provider route is Form 3500. Also tell the manufacturer, since only they can issue a fix. Keep logs and note exact model and software version.
Patients and caregivers
Form 3500B is the consumer route. FDA also publishes a paper on best practices for communicating cybersecurity vulnerabilities to patients, dated October 1, 2021 on its resources page, which manufacturers may find useful for their own notices.
What to gather before you report
A useful report is specific. Whatever route you use, collect the following first:
- Manufacturer, model and the exact software or firmware version.
- What you observed, when, and whether it repeats.
- Whether the device was on a clinical network, a guest network or a patient home network.
- Any logs the device or its management console produced.
- Whether the device was in use on a patient when the problem occurred, and what the clinical effect was or could have been.
Do not include patient identifiers in a security report unless the form specifically needs them. Strip them from log excerpts too.
Security researchers
The reporting section on the FDA page does not give a researcher route. Researchers normally go to the manufacturer's coordinated disclosure channel. FDA's page lists an MDIC report on coordinated vulnerability disclosure from September 2018 among its resources. Check the manufacturer's published policy first.
Quick check
Is reporting to FDA the same as telling the manufacturer?
No. FDA reporting feeds regulatory oversight. A manufacturer is the one that can patch, so tell them as well through their disclosure channel.
Sources
- FDA medical device cybersecurity page
- FDA guidance, Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 3, 2026)
Last reviewed: 19 October 2026.
