Patient harm

FDA cybersecurity guidance uses patient harm to judge whether the risk from a vulnerability is controlled. A cybersecurity issue that could lead to patient harm and is not adequately controlled may require a correction and reporting under 21 CFR 806.

injury or damage to the health of patients, including death.

FDA guidance: Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (February 2026), Appendix 5, Terminology

Patient harm is defined as physical injury or damage to the health of patients, including death.

FDA guidance: Postmarket Management of Cybersecurity in Medical Devices (December 2016), Section IV.F, Definitions

The postmarket cybersecurity guidance speaks of physical injury or damage to the health of patients, while the premarket cybersecurity guidance drops the word 'physical'.