Continuing Education Information Sheet

• Explain why healthcare is a top target for cyber threat actors and how medical devices are uniquely vulnerable
• Summarize FD&C Act Section 524B and its cybersecurity provisions for device application submissions
• Apply the FDA 'Cybersecurity in Medical Devices' guidance to device design and approval
• Advise manufacturers on incorporating and monitoring cybersecurity measures

Intended audience: Attorneys advising medical device manufacturers and healthcare-sector clients on cybersecurity and FDA regulatory compliance.

Level: intermediate

Prerequisites: None

• Daniel B. Garrie, Founder, Law & Forensics; Neutral at JAMS; Faculty at Harvard

  Law & Forensics LLC · JAMS · Harvard · Rutgers Law School · Journal of Law & Cyber Warfare

  Daniel B. Garrie is the founder and executive managing partner of Law & Forensics LLC, a boutique cybersecurity and forensic engineering firm he co-founded in 2008. He serves as a neutral, arbitrator, and forensic special master at JAMS, focusing on cybersecurity, cryptocurrency, and complex technology disputes, and holds faculty appointments at Harvard and Rutgers Law School. A patented software inventor and prolific author, he is editor-in-chief of the Journal of Law & Cyber Warfare and a widely cited authority on computer forensics, eDiscovery, and cyber litigation.

• David Rifkind, Chief Legal Officer, Caidya

  Caidya

  David Rifkind is Chief Legal Officer at Caidya, a clinical research organisation, which he joined in March 2022. He has more than 30 years of legal experience in business and corporate transactions in highly regulated industries, covering corporate governance, compliance and data privacy, protection and security initiatives. At Caidya he built a data privacy team drawing on inside legal, the chief information security officers and IT personnel to meet global requirements including the GDPR and China's PIPL. He has held roles at General Electric and Avantor, and earlier worked in private practice and as a prosecutor in the Delaware Attorney General's office. He holds a B.A. in political science from The George Washington University and a J.D. from Columbia Law School. At Legal Cyber Academy, David Rifkind teaches on cyber guidelines for medical devices.

• Tom Mustac, Senior Director & Head of Systems, Cloud & Biomed Security, Mount Sinai Health System

  Mount Sinai Health System

  Tom Mustac (Tomislav Mustac) is senior director and head of systems, cloud and biomedical security at Mount Sinai Health System, responsible for the cybersecurity of connected devices across the Icahn School of Medicine at Mount Sinai, eight hospital campuses and more than 400 ambulatory practices. His remit covers three domains — traditional IT infrastructure, cloud systems, and medical and IoT devices — including remediating the vulnerabilities that have long affected the medical device sector. He previously worked at GE Healthcare, on the device manufacturer side of healthcare technology, and his professional affiliations include InfraGard, H-ISAC, the Health Sector Coordinating Council and AEHIS. He holds a doctorate in information assurance from the University of Fairfax and an MBA from Iona. At Legal Cyber Academy he teaches on cyber guidelines for medical devices.

Legal Cyber Academy is not an accredited provider; the notes below explain how a learner may self-submitthis activity where their board permits. The pathways shown reflect this course’s subject matter. Always confirm your board’s current rules.

• Healthcare-relevant subject matter — physicians may self-claim AMA PRA Category 2 Credit™ where the activity is relevant to their practice.

• CLE (attorneys)up to 1.1 hr (60-min basis)

  Many U.S. jurisdictions let an attorney apply for CLE credit for a non-accredited program (often called individual attorney or self-application). Use this certificate plus the course Information Sheet as your supporting documentation. Your state bar or CLE board decides whether credit is granted, how much, and any self-study cap.

• CE / CPD (privacy, insurance, IT)up to 1.1 hr (60-min basis)

  Where your professional body recognizes self-reported or self-directed learning (CPD) — for example many privacy (CIPP/CIPM) and security certifications — record this activity using the certificate and Information Sheet. Confirm your program's self-reporting rules and any documentation it requires.

• CME — AMA PRA Category 2up to 1.1 hr (60-min basis)

  Physicians may self-document relevant activities as AMA PRA Category 2 Credit™, which you claim yourself based on participation. This course is NOT certified for AMA PRA Category 1 Credit™ — Category 1 requires an ACCME-accredited provider, which Legal Cyber Academy is not.