regulatory and quality system professionals | 919.313.3960
Cybersecurity’s Impact on Health Systems

Cybersecurity’s Impact on Health Systems

We are currently seeing significant technological advances in medical devices, hospital networks and patient care. As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect a device’s performance, functionality and safety to the patient. In recent years, researchers have demonstrated the potential threat of medical device and healthcare system hacking. They have been able to tamper with pacemakers, insulin pumps and other devices, which, if hacked, could cause serious harm, including death, to a patient. Recently, the FDA identified cybersecurity vulnerabilities in St. Jude Medical’s implantable cardiac devices and the corresponding Merlin@home Transmitter. These vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient’s physician, to remotely access a patient’s RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. While no patients were harmed, this serves as a warning that similar devices containing configurable embedded computer systems can be vulnerable to cybersecurity intrusions and exploits, as well. To address these technological risks, in December 2016, the FDA finalized the guidance, “Postmarket Management of Cybersecurity in Medical Devices.” In reference to the guidance, Suzanne B. Schwartz, M.D., M.B.A., FDA’s Associate Director for Science and Strategic Partnerships, at the Center for Devices and Radiological Health stated that, “manufacturers should build in cybersecurity controls when they design and develop the device to assure proper device performance in the face of cyber threats, and then they should continuously monitor and address cybersecurity concerns once the device is on the market and being used by patients.” The new guidance...
What Happens When the FDA says, “I don’t know”

What Happens When the FDA says, “I don’t know”

The FDA is now trying to track what it’s calling “emerging safety signals.” Recently, a study found a possible link between reduced leaflet mobility in TAVRs and the incidence of stroke in the fall. When people turned to the FDA looking for insight, the agency responded with, “Limited available data do not allow us to fully characterize the causes, incidence, and short- and long-term risks of reduced valve leaflet motion, or to recommend appropriate treatment.” This basically equates to the FDA saying, “I don’t know.” The FDA has recently released a guidance, which will formalize its practice on notifying the public of situations when the agency is monitoring risks that have not yet been fully validated, and therefore, do not have FDA recommendations. Historically, the FDA has communicated important medical device post-market information after having analyzed available data and, in most cases, after having reached decision about relevant recommendations and about whether or not further regulatory action is warranted. According to the guidance, timely communication about emerging signals is intended to provide health care providers, patients, and consumers access to the most current information concerning the benefits and risks of marketed medical devices so they can make informed treatment choices based on all available information. Such communication may also reduce or limit the number of patients exposed to the potential risk while the issue is being further evaluated. Considerations for Determining FDA Public Notification will include: Seriousness of the adverse event(s) relative to the known benefits of the device Magnitude of the risk (e.g., likelihood of occurrence) Magnitude of the benefit Strength of the evidence of a causal relationship...
Colliding Cultures: Software Development and the Medical Device Industry

Colliding Cultures: Software Development and the Medical Device Industry

Part 1 – Medical Device Software, the FDA and the US Congress Preface: In any given 2-week period, an average of 15% to 20% of the applications on my smartphone have new versions to fix software bugs. Others I speak with experience similar statistics. And, that doesn’t include how often my smartphone software crashes while executing tasks it was intended to perform. We don’t complain about it. Instead, we accept this state of constant, almost continuous, software revision to fix bugs as a matter of “how things are.” We have come to terms with the fact that the normal state of software is for it to be broken, in need of repair and “acceptably” functional, while simultaneously defective. One might think, given the prevalence and importance of software, we would reject software disrepair as normal – especially for critical applications that impact safety. But, the evidence suggests otherwise. If you perform a search on the FDA Medical Device Recall Database from January 1, 2013 to August 14, 2015, you will see 500 device recalls reported. This is the maximum number of rows the FDA report supports in a single query (meaning more than 500 devices were recalled). Enter the keyword “software” into the search, and the query returns 344 recalls due to medical device software. Reviewing randomly through these notices confirms that software issues played an instrumental – or the only – role in the recalls. And, all but nine are Class I or Class II recalls in response to a risk of temporary or serious adverse health consequences due to software problems. Is software so difficult and challenging...
Cybersecurity – A Real Threat to Medical Devices

Cybersecurity – A Real Threat to Medical Devices

The FDA is Taking Notice of Medical Device Cybersecurity The FDA just issued a Safety Communication on cybersecurity vulnerabilities of the Hospira Symbiq Infusion System. The Hospira Symbiq Infusion System is a computerized pump designed for the continuous delivery of general infusion therapy for a broad patient population. The pump is mostly used in hospitals, or other acute and non-acute health care facilities, such as nursing homes and outpatient care centers. This infusion system can communicate with a Hospital Information System (HIS) via a wired or wireless connection over facility network infrastructures. Unfortunately, it appears that it’s possible to access this pump remotely through a network, allowing unauthorized users to control the pump and change the dosage it delivers. This can potentially harm the patient. While it doesn’t appear that any unauthorized access occurred with this particular product, and Hospira is no longer selling this product, cybersecurity is still a real concern. It will be critical for manufacturers to implement appropriate safeguards now that more and more devices are connecting remotely to healthcare networks. In June 2013, the FDA outlined good practices to follow in Cybersecurity for Medical Devices and Hospital Networks. In this communication, the FDA recommends that medical device manufacturers and health care facilities take steps to assure that appropriate safeguards are in place to reduce the risk of failure due to cyberattack. These attacks could be initiated by the introduction of malware into the medical equipment or unauthorized access to configuration settings in medical devices and hospital networks. As products rely more heavily on networked communication, medical device cybersecurity is going to become an even greater concern....
FDA Issues Final Guidance on Reusable Medical Devices

FDA Issues Final Guidance on Reusable Medical Devices

Endoscopes Linked to “Superbugs” Lead to New FDA Guidance for Reusable Medical Devices UPDATE The FDA has released the slides from their presentation on Reprocessing Medical Devices. Get the slides here. In light of the fatal “superbugs” that have been plaguing hospitals after using endoscopes, the FDA has released new guidance for reusable medical devices. While the risk of getting an infection of this type is low, there is still a risk. With that in mind, the FDA has updated their thinking with the release of Reprocessing Medical Devices in Health Care Settings. The FDA is also intending on putting together an advisory panel to review and discuss the transmission of “superbug” infections via endoscopy procedures. The purpose of the panel is to seek expert scientific and clinical opinion related to reprocessing of duodenoscopes and other endoscopes, as well as automated endoscope reprocessors, based on available scientific information. The committee will make recommendations on: The effectiveness of cleaning, high level disinfection, and sterilization methods; the amount and type of premarket validation data and information needed to support labeling claims and technical instructions; the appropriate use of other risk mitigations, such as surveillance cultures; best practices and guidelines for 3 reprocessing duodenoscopes and endoscopes at user facilities to minimize the transmission of infections; and recommended approaches for ensuring patient safety during ERCP procedures, including a discussion of appropriate patient selection. It will be interesting to note how the regulations will adapt to meet the needs of patients with the increase in antibiotic-resistant...
Don’t Forget Safety Testing and the Value of Risk Management!

Don’t Forget Safety Testing and the Value of Risk Management!

Establish the Safety of Your Medical Device with IEC 60601 Compliance In our experience, the most frequently forgotten aspect of medical device development and commercialization from emerging companies is establishing a safety profile of a product. While clinical data or clinical trials may be necessary for establishing safety for some products, many Class II devices that follow a 510(k) clearance pathway require minimal, if any, clinical data to support safety claims. Once the need for clinical data is either planned for or eliminated, establishing the safety of a medical device through additional testing tends to be less of a priority. Depending on the technology incorporated into your medical device, applicable safety standards need to be identified during the design stages of the product. The most widely accepted benchmark for establishing safety for electrical medical devices is a standard called IEC60601-1, where compliance has become an acceptable means for satisfying electrical safety requirements for the commercialization of electrical medical devices in the European Union. 60601-1 has undergone revision recently. The third edition is enforced now in the EU and the second Edition is currently applicable in the U.S. The FDA will require the use of the third Edition of the standard for new devices as of June 30, 2013. In this new edition of the standard, there is strong emphasis on risk assessment, ISO 14971 and, in the U.S, a focus on device usability as an important factor contributing to the safety of the device. Product testing to 60601-1 is a very technical exercise that involves laboratory testing against the standard by a test house, such as Underwriters Laboratories. If...