regulatory and quality system professionals | 919.313.3960
Cybersecurity’s Impact on Health Systems

Cybersecurity’s Impact on Health Systems

We are currently seeing significant technological advances in medical devices, hospital networks and patient care. As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect a device’s performance, functionality and safety to the patient. In recent years, researchers have demonstrated the potential threat of medical device and healthcare system hacking. They have been able to tamper with pacemakers, insulin pumps and other devices, which, if hacked, could cause serious harm, including death, to a patient. Recently, the FDA identified cybersecurity vulnerabilities in St. Jude Medical’s implantable cardiac devices and the corresponding Merlin@home Transmitter. These vulnerabilities, if exploited, could allow an unauthorized user, i.e., someone other than the patient’s physician, to remotely access a patient’s RF-enabled implanted cardiac device by altering the Merlin@home Transmitter. While no patients were harmed, this serves as a warning that similar devices containing configurable embedded computer systems can be vulnerable to cybersecurity intrusions and exploits, as well. To address these technological risks, in December 2016, the FDA finalized the guidance, “Postmarket Management of Cybersecurity in Medical Devices.” In reference to the guidance, Suzanne B. Schwartz, M.D., M.B.A., FDA’s Associate Director for Science and Strategic Partnerships, at the Center for Devices and Radiological Health stated that, “manufacturers should build in cybersecurity controls when they design and develop the device to assure proper device performance in the face of cyber threats, and then they should continuously monitor and address cybersecurity concerns once the device is on the market and being used by patients.” The new guidance...
What Happens When the FDA says, “I don’t know”

What Happens When the FDA says, “I don’t know”

The FDA is now trying to track what it’s calling “emerging safety signals.” Recently, a study found a possible link between reduced leaflet mobility in TAVRs and the incidence of stroke in the fall. When people turned to the FDA looking for insight, the agency responded with, “Limited available data do not allow us to fully characterize the causes, incidence, and short- and long-term risks of reduced valve leaflet motion, or to recommend appropriate treatment.” This basically equates to the FDA saying, “I don’t know.” The FDA has recently released a guidance, which will formalize its practice on notifying the public of situations when the agency is monitoring risks that have not yet been fully validated, and therefore, do not have FDA recommendations. Historically, the FDA has communicated important medical device post-market information after having analyzed available data and, in most cases, after having reached decision about relevant recommendations and about whether or not further regulatory action is warranted. According to the guidance, timely communication about emerging signals is intended to provide health care providers, patients, and consumers access to the most current information concerning the benefits and risks of marketed medical devices so they can make informed treatment choices based on all available information. Such communication may also reduce or limit the number of patients exposed to the potential risk while the issue is being further evaluated. Considerations for Determining FDA Public Notification will include: Seriousness of the adverse event(s) relative to the known benefits of the device Magnitude of the risk (e.g., likelihood of occurrence) Magnitude of the benefit Strength of the evidence of a causal relationship...
FDA Oversight of Laboratory Developed Tests (LDTs) is on the Horizon

FDA Oversight of Laboratory Developed Tests (LDTs) is on the Horizon

How Do Laboratory Developed Tests Impact Your Business? The Office of Public Health Strategy and Analysis recently issued a report that reviewed 20 products that relied on Laboratory Developed Tests (LDTs) to determine whether a lack of oversight may have caused actual harm to patients or not. Once, LDTs were relatively simple tests that may not have warranted regulatory compliance. However, these tests are playing an increasingly more important role in healthcare and have become significantly more complex. The concern is that these tests may present with inaccuracies that place patients at what would be considered otherwise avoidable risk. The report found that these 20 products, in fact, may have caused actual harm to patients. In some cases, patients were told they have conditions they do not really have, due to false-positive tests. This led to unnecessary distress and resulted in unneeded treatment. In other cases, the LTDs produced false-negative results, in which life-threatening diseases went undetected. These misdiagnosed patients failed to receive treatments. Additionally, some LTDs provided information with no relevance to the condition they were intended to be used for, and others were linked to treatments based on disproven scientific concepts. Not only do these situations cause harm to patients, but they are also costly to society.(1) The report found that FDA oversight of LTDs is needed to address the following: Lack of evidence supporting the clinical validity of tests Deficient adverse event reporting No premarket review of performance data Unsupported manufacturer claims Inadequate product labeling Lack of transparency Uneven playing field Threats to the scientific integrity of clinical trials No comprehensive listing of all LTDs being used...
Colliding Cultures: Software Development and the Medical Device Industry

Colliding Cultures: Software Development and the Medical Device Industry

Part 1 – Medical Device Software, the FDA and the US Congress Preface: In any given 2-week period, an average of 15% to 20% of the applications on my smartphone have new versions to fix software bugs. Others I speak with experience similar statistics. And, that doesn’t include how often my smartphone software crashes while executing tasks it was intended to perform. We don’t complain about it. Instead, we accept this state of constant, almost continuous, software revision to fix bugs as a matter of “how things are.” We have come to terms with the fact that the normal state of software is for it to be broken, in need of repair and “acceptably” functional, while simultaneously defective. One might think, given the prevalence and importance of software, we would reject software disrepair as normal – especially for critical applications that impact safety. But, the evidence suggests otherwise. If you perform a search on the FDA Medical Device Recall Database from January 1, 2013 to August 14, 2015, you will see 500 device recalls reported. This is the maximum number of rows the FDA report supports in a single query (meaning more than 500 devices were recalled). Enter the keyword “software” into the search, and the query returns 344 recalls due to medical device software. Reviewing randomly through these notices confirms that software issues played an instrumental – or the only – role in the recalls. And, all but nine are Class I or Class II recalls in response to a risk of temporary or serious adverse health consequences due to software problems. Is software so difficult and challenging...
Cybersecurity – A Real Threat to Medical Devices

Cybersecurity – A Real Threat to Medical Devices

The FDA is Taking Notice of Medical Device Cybersecurity The FDA just issued a Safety Communication on cybersecurity vulnerabilities of the Hospira Symbiq Infusion System. The Hospira Symbiq Infusion System is a computerized pump designed for the continuous delivery of general infusion therapy for a broad patient population. The pump is mostly used in hospitals, or other acute and non-acute health care facilities, such as nursing homes and outpatient care centers. This infusion system can communicate with a Hospital Information System (HIS) via a wired or wireless connection over facility network infrastructures. Unfortunately, it appears that it’s possible to access this pump remotely through a network, allowing unauthorized users to control the pump and change the dosage it delivers. This can potentially harm the patient. While it doesn’t appear that any unauthorized access occurred with this particular product, and Hospira is no longer selling this product, cybersecurity is still a real concern. It will be critical for manufacturers to implement appropriate safeguards now that more and more devices are connecting remotely to healthcare networks. In June 2013, the FDA outlined good practices to follow in Cybersecurity for Medical Devices and Hospital Networks. In this communication, the FDA recommends that medical device manufacturers and health care facilities take steps to assure that appropriate safeguards are in place to reduce the risk of failure due to cyberattack. These attacks could be initiated by the introduction of malware into the medical equipment or unauthorized access to configuration settings in medical devices and hospital networks. As products rely more heavily on networked communication, medical device cybersecurity is going to become an even greater concern....