The U.S. Security and Exchange Commission’s final rule for disclosure of cybersecurity incidents would seem to weigh more heavily on device makers and their client hospitals than on other industries, particularly given that the draft rule required a four-day notification of any such events. The final rule retains that requirement to notify investors of any such breach within four days, although the SEC relented on the content of such disclosures to ease concerns about the potential for disclosures to amplify the cybersecurity threat.