{"id":"https://openalex.org/W3131069091","doi":"https://doi.org/10.1038/s41746-021-00403-w","title":"Building resilient medical technology supply chains with a software bill of materials","display_name":"Building resilient medical technology supply chains with a software bill of materials","publication_year":2021,"publication_date":"2021-02-23","ids":{"openalex":"https://openalex.org/W3131069091","doi":"https://doi.org/10.1038/s41746-021-00403-w","mag":"3131069091","pmid":"https://pubmed.ncbi.nlm.nih.gov/33623135"},"language":"en","primary_location":{"id":"doi:10.1038/s41746-021-00403-w","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41746-021-00403-w","pdf_url":"https://www.nature.com/articles/s41746-021-00403-w.pdf","source":{"id":"https://openalex.org/S4210195431","display_name":"npj Digital Medicine","issn_l":"2398-6352","issn":["2398-6352"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"npj Digital Medicine","raw_type":"journal-article"},"type":"review","indexed_in":["crossref","doaj","pubmed"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.nature.com/articles/s41746-021-00403-w.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077273070","display_name":"Seth Carmody","orcid":"https://orcid.org/0000-0003-4559-3359"},"institutions":[{"id":"https://openalex.org/I4210155085","display_name":"California Library Association","ror":"https://ror.org/048saf111","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210155085"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Seth Carmody","raw_affiliation_strings":["DRX Labs LLC, Monrovia, MD, USA","MedCrypt, San Diego, CA, USA"],"affiliations":[{"raw_affiliation_string":"DRX Labs LLC, Monrovia, MD, USA","institution_ids":["https://openalex.org/I4210155085"]},{"raw_affiliation_string":"MedCrypt, San Diego, CA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5007972253","display_name":"Andrea Coravos","orcid":"https://orcid.org/0000-0001-5379-3540"},"institutions":[{"id":"https://openalex.org/I4210096455","display_name":"BioTracking (United States)","ror":"https://ror.org/00qhyxs61","country_code":"US","type":"company","lineage":["https://openalex.org/I4210096455"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Andrea Coravos","raw_affiliation_strings":["Biohacking Village, Las Vegas, NV, USA","Elektra Labs, Inc, San Francisco, CA, USA","Harvard-MIT Center for Regulatory Science, Boston, MA, USA"],"affiliations":[{"raw_affiliation_string":"Biohacking Village, Las Vegas, NV, USA","institution_ids":["https://openalex.org/I4210096455"]},{"raw_affiliation_string":"Elektra Labs, Inc, San Francisco, CA, USA","institution_ids":[]},{"raw_affiliation_string":"Harvard-MIT Center for Regulatory Science, Boston, MA, USA","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5038904542","display_name":"Ginny Fahs","orcid":null},"institutions":[{"id":"https://openalex.org/I1339813059","display_name":"Aspen Institute","ror":"https://ror.org/0174e3t82","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I1339813059"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Ginny Fahs","raw_affiliation_strings":["Aspen Institute Tech Policy Hub, San Francisco, CA, USA. ginnyfahs@gmail.com","I Am The Cavalry, Washington, DC, USA. ginnyfahs@gmail.com","Aspen Institute Tech Policy Hub, San Francisco, CA, USA"],"affiliations":[{"raw_affiliation_string":"Aspen Institute Tech Policy Hub, San Francisco, CA, USA. ginnyfahs@gmail.com","institution_ids":[]},{"raw_affiliation_string":"I Am The Cavalry, Washington, DC, USA. ginnyfahs@gmail.com","institution_ids":[]},{"raw_affiliation_string":"Aspen Institute Tech Policy Hub, San Francisco, CA, USA","institution_ids":["https://openalex.org/I1339813059"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5018775534","display_name":"Audra Hatch","orcid":null},"institutions":[{"id":"https://openalex.org/I4210142480","display_name":"Thermo Fisher Scientific (United States)","ror":"https://ror.org/03x1ewr52","country_code":"US","type":"company","lineage":["https://openalex.org/I4210142480"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Audra Hatch","raw_affiliation_strings":["I Am The Cavalry, Washington, DC, USA","Thermo Fisher Scientific, Inc, Waltham, MA, USA"],"affiliations":[{"raw_affiliation_string":"I Am The Cavalry, Washington, DC, USA","institution_ids":[]},{"raw_affiliation_string":"Thermo Fisher Scientific, Inc, Waltham, MA, USA","institution_ids":["https://openalex.org/I4210142480"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5067971733","display_name":"Janine Medina","orcid":null},"institutions":[{"id":"https://openalex.org/I2799708222","display_name":"Office of Technology Transfer","ror":"https://ror.org/031gy6182","country_code":"US","type":"government","lineage":["https://openalex.org/I1299022934","https://openalex.org/I1299303238","https://openalex.org/I2799708222","https://openalex.org/I4210091794"]},{"id":"https://openalex.org/I4210096455","display_name":"BioTracking (United States)","ror":"https://ror.org/00qhyxs61","country_code":"US","type":"company","lineage":["https://openalex.org/I4210096455"]},{"id":"https://openalex.org/I1330347796","display_name":"United States Department of Defense","ror":"https://ror.org/0447fe631","country_code":"US","type":"funder","lineage":["https://openalex.org/I1330347796"]},{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Janine Medina","raw_affiliation_strings":["Biohacking Village, Las Vegas, NV, USA","I Am The Cavalry, Washington, DC, USA","Pennsylvania State University Policy Innovation Lab of Tomorrow (PILOT), State College, PA, USA","US Department of Defense Technology Transfer Program, New York, NY, USA"],"affiliations":[{"raw_affiliation_string":"Biohacking Village, Las Vegas, NV, USA","institution_ids":["https://openalex.org/I4210096455"]},{"raw_affiliation_string":"I Am The Cavalry, Washington, DC, USA","institution_ids":[]},{"raw_affiliation_string":"Pennsylvania State University Policy Innovation Lab of Tomorrow (PILOT), State College, PA, USA","institution_ids":["https://openalex.org/I130769515"]},{"raw_affiliation_string":"US Department of Defense Technology Transfer Program, New York, NY, USA","institution_ids":["https://openalex.org/I2799708222","https://openalex.org/I1330347796"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5005314601","display_name":"Beau Woods","orcid":"https://orcid.org/0000-0001-6109-1434"},"institutions":[{"id":"https://openalex.org/I154695773","display_name":"Atlantic Council","ror":"https://ror.org/015f81693","country_code":"US","type":"government","lineage":["https://openalex.org/I154695773"]},{"id":"https://openalex.org/I4210096455","display_name":"BioTracking (United States)","ror":"https://ror.org/00qhyxs61","country_code":"US","type":"company","lineage":["https://openalex.org/I4210096455"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Beau Woods","raw_affiliation_strings":["Atlantic Council, Washington, DC, USA","Biohacking Village, Las Vegas, NV, USA","I Am The Cavalry, Washington, DC, USA"],"affiliations":[{"raw_affiliation_string":"Atlantic Council, Washington, DC, USA","institution_ids":["https://openalex.org/I154695773"]},{"raw_affiliation_string":"Biohacking Village, Las Vegas, NV, USA","institution_ids":["https://openalex.org/I4210096455"]},{"raw_affiliation_string":"I Am The Cavalry, Washington, DC, USA","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5042113508","display_name":"Joshua Corman","orcid":null},"institutions":[{"id":"https://openalex.org/I130769515","display_name":"Pennsylvania State University","ror":"https://ror.org/04p491231","country_code":"US","type":"education","lineage":["https://openalex.org/I130769515"]},{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]},{"id":"https://openalex.org/I41154525","display_name":"PTC (United States)","ror":"https://ror.org/03qqbvj08","country_code":"US","type":"company","lineage":["https://openalex.org/I41154525"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Joshua Corman","raw_affiliation_strings":["Heinz College of Information Systems and Public Policy, Carnegie Mellon University, Pittsburgh, PA, USA","I Am The Cavalry, Washington, DC, USA","PTC, Inc, Boston, MA, USA","Pennsylvania State University Policy Innovation Lab of Tomorrow (PILOT), State College, PA, USA"],"affiliations":[{"raw_affiliation_string":"Heinz College of Information Systems and Public Policy, Carnegie Mellon University, Pittsburgh, PA, USA","institution_ids":["https://openalex.org/I74973139"]},{"raw_affiliation_string":"I Am The Cavalry, Washington, DC, USA","institution_ids":[]},{"raw_affiliation_string":"PTC, Inc, Boston, MA, USA","institution_ids":["https://openalex.org/I41154525"]},{"raw_affiliation_string":"Pennsylvania State University Policy Innovation Lab of Tomorrow (PILOT), State College, PA, USA","institution_ids":["https://openalex.org/I130769515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5038904542"],"corresponding_institution_ids":["https://openalex.org/I1339813059"],"apc_list":{"value":3060,"currency":"USD","value_usd":3060},"apc_paid":{"value":3060,"currency":"USD","value_usd":3060},"fwci":19.1527,"has_fulltext":true,"cited_by_count":49,"citation_normalized_percentile":{"value":0.99363057,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":"4","issue":"1","first_page":"34","last_page":"34"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T13690","display_name":"Quality and Safety in Healthcare","score":0.9589999914169312,"subfield":{"id":"https://openalex.org/subfields/3607","display_name":"Medical Laboratory Technology"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}},"topics":[{"id":"https://openalex.org/T13690","display_name":"Quality and Safety in Healthcare","score":0.9589999914169312,"subfield":{"id":"https://openalex.org/subfields/3607","display_name":"Medical Laboratory Technology"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/transparency","display_name":"Transparency (behavior)","score":0.7195401191711426},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.6042618751525879},{"id":"https://openalex.org/keywords/supply-chain","display_name":"Supply chain","score":0.5936713814735413},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5266128778457642},{"id":"https://openalex.org/keywords/safer","display_name":"SAFER","score":0.5062512755393982},{"id":"https://openalex.org/keywords/health-care","display_name":"Health care","score":0.4844541549682617},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.4836467504501343},{"id":"https://openalex.org/keywords/product","display_name":"Product (mathematics)","score":0.4662904143333435},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.4645307660102844},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.45407047867774963},{"id":"https://openalex.org/keywords/risk-analysis","display_name":"Risk analysis (engineering)","score":0.45300543308258057},{"id":"https://openalex.org/keywords/component-based-software-engineering","display_name":"Component-based software engineering","score":0.42308366298675537},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.28875434398651123},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.11024311184883118},{"id":"https://openalex.org/keywords/marketing","display_name":"Marketing","score":0.09258970618247986}],"concepts":[{"id":"https://openalex.org/C2780233690","wikidata":"https://www.wikidata.org/wiki/Q535347","display_name":"Transparency (behavior)","level":2,"score":0.7195401191711426},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.6042618751525879},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.5936713814735413},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5266128778457642},{"id":"https://openalex.org/C2776654903","wikidata":"https://www.wikidata.org/wiki/Q2601463","display_name":"SAFER","level":2,"score":0.5062512755393982},{"id":"https://openalex.org/C160735492","wikidata":"https://www.wikidata.org/wiki/Q31207","display_name":"Health care","level":2,"score":0.4844541549682617},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.4836467504501343},{"id":"https://openalex.org/C90673727","wikidata":"https://www.wikidata.org/wiki/Q901718","display_name":"Product (mathematics)","level":2,"score":0.4662904143333435},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.4645307660102844},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.45407047867774963},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.45300543308258057},{"id":"https://openalex.org/C174683762","wikidata":"https://www.wikidata.org/wiki/Q609588","display_name":"Component-based software engineering","level":4,"score":0.42308366298675537},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.28875434398651123},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.11024311184883118},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.09258970618247986},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.0},{"id":"https://openalex.org/C50522688","wikidata":"https://www.wikidata.org/wiki/Q189833","display_name":"Economic growth","level":1,"score":0.0},{"id":"https://openalex.org/C2524010","wikidata":"https://www.wikidata.org/wiki/Q8087","display_name":"Geometry","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1038/s41746-021-00403-w","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41746-021-00403-w","pdf_url":"https://www.nature.com/articles/s41746-021-00403-w.pdf","source":{"id":"https://openalex.org/S4210195431","display_name":"npj Digital Medicine","issn_l":"2398-6352","issn":["2398-6352"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"npj Digital Medicine","raw_type":"journal-article"},{"id":"pmid:33623135","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/33623135","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NPJ digital medicine","raw_type":null},{"id":"pmh:oai:doaj.org/article:7e1d28530dc643d8a252c9ea41c7ec0a","is_oa":true,"landing_page_url":"https://doaj.org/article/7e1d28530dc643d8a252c9ea41c7ec0a","pdf_url":null,"source":{"id":"https://openalex.org/S112646816","display_name":"SHILAP Revista de lepidopterolog\u00eda","issn_l":"0300-5267","issn":["0300-5267","2340-4078"],"is_oa":true,"is_in_doaj":true,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"journal"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"npj Digital Medicine, Vol 4, Iss 1, Pp 1-6 (2021)","raw_type":"article"},{"id":"pmh:oai:pubmedcentral.nih.gov:7902663","is_oa":true,"landing_page_url":"https://www.ncbi.nlm.nih.gov/pmc/articles/7902663","pdf_url":null,"source":{"id":"https://openalex.org/S2764455111","display_name":"PubMed Central","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"NPJ Digit Med","raw_type":"Text"}],"best_oa_location":{"id":"doi:10.1038/s41746-021-00403-w","is_oa":true,"landing_page_url":"https://doi.org/10.1038/s41746-021-00403-w","pdf_url":"https://www.nature.com/articles/s41746-021-00403-w.pdf","source":{"id":"https://openalex.org/S4210195431","display_name":"npj Digital Medicine","issn_l":"2398-6352","issn":["2398-6352"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319908","host_organization_name":"Nature Portfolio","host_organization_lineage":["https://openalex.org/P4310319908","https://openalex.org/P4310319965"],"host_organization_lineage_names":["Nature Portfolio","Springer Nature"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"npj Digital Medicine","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W3131069091.pdf","grobid_xml":"https://content.openalex.org/works/W3131069091.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W184025731","https://openalex.org/W1525478949","https://openalex.org/W1923747344","https://openalex.org/W2071499295","https://openalex.org/W2254713255","https://openalex.org/W2352444199","https://openalex.org/W2515176952","https://openalex.org/W2990605291","https://openalex.org/W3005602423","https://openalex.org/W3023216269","https://openalex.org/W3026444438","https://openalex.org/W3081085269","https://openalex.org/W3081503524","https://openalex.org/W4230722671","https://openalex.org/W4232736849"],"related_works":["https://openalex.org/W2953205341","https://openalex.org/W235065745","https://openalex.org/W2029935773","https://openalex.org/W2787754950","https://openalex.org/W1572215850","https://openalex.org/W1985775355","https://openalex.org/W2352115286","https://openalex.org/W2084793300","https://openalex.org/W2737684287","https://openalex.org/W3166402310"],"abstract_inverted_index":{"An":[0],"exploited":[1],"vulnerability":[2],"in":[3,22,28],"a":[4,32,49,58],"single":[5],"software":[6,20,33,54,63,100],"component":[7],"of":[8,17,35,51,73,78,82,94],"healthcare":[9,23,112],"technology":[10],"can":[11,25],"affect":[12],"patient":[13],"care.":[14],"The":[15],"risk":[16],"including":[18],"third-party":[19],"components":[21],"technologies":[24,96,113],"be":[26],"managed,":[27],"part,":[29],"by":[30,67],"leveraging":[31],"bill":[34],"materials":[36],"(SBOM).":[37],"Analogous":[38],"to":[39,88],"an":[40,46],"ingredients":[41],"list":[42,50],"on":[43],"food":[44],"packaging,":[45],"SBOM":[47],"is":[48],"all":[52,90],"included":[53],"components.":[55],"SBOMs":[56,84],"provide":[57],"transparency":[59,104],"mechanism":[60],"for":[61,114],"securing":[62],"product":[64],"supply":[65,91],"chains":[66],"enabling":[68],"faster":[69],"identification":[70],"and":[71,106,110],"remediation":[72],"vulnerabilities,":[74],"towards":[75],"the":[76,80,86],"goal":[77],"reducing":[79],"feasibility":[81],"attacks.":[83],"have":[85],"potential":[87],"benefit":[89],"chain":[92],"stakeholders":[93],"medical":[95],"without":[97],"significantly":[98],"increasing":[99],"production":[101],"costs.":[102],"Increasing":[103],"unlocks":[105],"enables":[107],"trustworthy,":[108],"resilient,":[109],"safer":[111],"all.":[115]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":9},{"year":2023,"cited_by_count":14},{"year":2022,"cited_by_count":9},{"year":2021,"cited_by_count":4},{"year":2020,"cited_by_count":1}],"updated_date":"2026-03-20T23:20:44.827607","created_date":"2025-10-10T00:00:00"}