Last reviewed: May 1, 2026
Listen now
Episode breakdown
Key takeaways
- Building a robust quality system from inception is critical for medical device startups to avoid significant delays and costs associated with cybersecurity compliance.
- Medical device software incurs ongoing compliance costs that hardware alone does not, primarily due to evolving regulatory expectations.
- Retrofitting cybersecurity into an existing medical device is substantially more expensive and time-consuming than integrating it during the initial design and development phases.
- The FDA's evolving cybersecurity documentation requirements necessitate continuous adaptation and proactive engagement from medical device manufacturers.
- Prioritizing product utility and user integration, as evidenced by positive clinician feedback, can drive market acceptance and sustained growth for medical technologies.
- FDA submissions for medical devices, particularly those involving software, become increasingly complex with changing cybersecurity requirements.
- Understanding the distinctions and compliance pathways for Software as a Medical Device (SaMD) is crucial for companies developing algorithm-driven health technologies.
Marc Zemel has been building Retia Medical for 15 years. The company started as two guys with slides and licensed technology. Now their data-driven hemodynamic monitoring technology for consistently accurate cardiac output measurements in high-risk surgical and critically ill patients is in 75 hospitals across 18 countries, sold by Medtronic in the U.S, and the company is preparing to launch their new product Argos Infinity, pending FDA clearance.
But getting here meant dealing with cybersecurity challenges that Marc didn't see coming. In this conversation, he talks about what actually slowed them down, what he wishes he'd done differently, and why building a proper quality system from day one would have saved him years of pain.
Retia Medical develops algorithms that monitor cardiovascular function. Their technology detects problems before blood pressure drops, which makes it valuable in operating rooms and ICUs. Nurses have gotten so attached to their monitors that they literally hug them because the devices help them do their jobs better.
Marc walks through the specific cybersecurity issues that surprised him. Like how software as a medical device comes with ongoing compliance costs that hardware doesn't have. Or how documentation requirements kept changing as the FDA updated its expectations. Or how retrofitting cybersecurity into an existing product is way more expensive than building it in from the start.
He also shares his philosophy on building companies. He doesn't focus on exits or acquisition targets. He focuses on building something people can't live without. When the product is that good, the rest takes care of itself.
If you're building a medical device startup or dealing with FDA submissions, this is a conversation worth hearing.
Frequently asked questions
Bring this work to your device
Need help with fda premarket cybersecurity?
Blue Goat Cyber delivers fda premarket cybersecurity services for medical device manufacturers - from threat modeling to FDA-ready reports.
FDA Premarket Cybersecurity ServicesMore on FDA Premarket Cybersecurity
Keep listening
-
Episode 69
Science Before Hype in MedTech Investing with Varun Turlapati of Chaanakya Capital
With Varun Turlapati
-
Episode 67
De-Risking Product Decisions in MedTech Startups with Brent Lavin of Ironwood MedTech Partners
With Brent Lavin
-
Episode 65
Why Clinical Trials Are the Most Expensive Capital Outlay for Startups with Rob Bedford, CEO of Franklyn Health
With Rob Bedford
-
Episode 64
Traceability Requirements and Documentation Audit Trails with Dr. Basant Bajpai, CEO of Compliance MedQRA
With Dr. Basant Bajpai