GAO on Medical Device Security

Here is the recommendation from the GAO study of FDA Should Expand Its Consideration of Information Security for Certain Types of Devices

Recommendation for Executive Action
Recommendation: To better ensure the safety and effectiveness of active implantable medical devices, the Secretary of Health and Human Services should direct the Commissioner of FDA to develop and implement a more comprehensive plan to assist the agency in enhancing its review and surveillance of medical devices as technology evolves, and that will incorporate the multiple aspects of information security. This plan should include, at a minimum, four actions, such as determining how FDA can (1) increase its focus on manufacturers' identification of potential unintentional and intentional threats, vulnerabilities, the resulting information security risks, and strategies to mitigate these risks during its PMA review process; (2) utilize available resources, including those from other entities, such as other federal agencies; (3) leverage its postmarket efforts to identify and investigate information security problems; and (4) establish specific milestones for completing this review and implementing these changes.

http://gao.gov/products/GAO-12-816

Pump Hack II

From the news wire: Pump hacked by sniffing serial number.

http://www.cso.com.au/article/404909/lethal_medical_device_hack_taken_next_level

I get that hacking is seen as a noble endeavor, particularly by the practitioners. My gripe is that while there are significant computing shills involved the communications leave me cold.

Consider these headlines:


Lethal medical device hack taken to next level
Attacker sniffs insulin pump ID, delivers fatal dose

To me these articles project a cavalier attitude of, 'We play games with devices that keep people alive.'

There is an FDA process for reporting device flaws. That seems more useful and a nobel a channel of communications than general media. If reason for the hacks is to motivate change then the FDA is in a position to see that it happens.

Shouldn't Better Diabetes Devices Be BIGGER News?

Pump-hack-gate, yes I am officially going with the gating of the event to signify its significance, continues to get print and now more media attention for the congress members who wrote a letter about it.

Here is the thing that bugs me. Do these same folks have the same interest in keeping people with diabetes healthy? Do they invest a similar concern that Low Glucose Suspend is available in 40 countries around the world but not here in the USA where it was engineered?  Do they cover advances that can save the lives of kids with the same attention that they cover the very unique and isolated hacking of a pump.

No. It doesn't seem so.

I though I was used to the rest of the world not appreciating the real risks of type 1 diabetes. The food police and the ignorant are one thing. One ignorant person at a time. This wholesale stuff with media that are selling their banner ads with stories about what are very marginal risks would do well to learn what the real balancing acts of diabetes are and what the risk associated with them mean in daily life.

http://abcnews.go.com/Technology/wireStory?id=14344300

Congress & Pump Hacking, Who Didn't See This Coming

So it begins:

Aug 15, 2011: Eshoo, Markey Ask GAO to Study Safety, Reliability of Wireless Healthcare Tech
Senior Committee members Anna G. Eshoo (D-CA) and Edward J. Markey (D-MA) sent a letter to the Government Accountability Office (GAO) early this week calling on them to look into whether the new devices are "safe, reliable and secure. " The issue stems from a hack shown at the popular Las Vegas conference where researcher Jerome Radcliffe -- diagnosed with Diabetes 11 years ago -- demonstrated how he could tweak the dosage levels on his pump remotely.

Dear Congresswoman Eshoo and Congressman Markley

I read the press release about your letter concerning wireless health technology. I have a personal interest in insulin pumps. I am a social media writer and participant in the diabetes community online as I am the father of two teenage type 1 diabetics who lives depend on insulin pumps. I know that diabetes management is a balancing act. Insulin and activity balance with food to maintain blood sugar. It is never a perfect balance of risks but it is what families living with diabetes strive to manage.

I hope that in your efforts to publicize your letter you are aware of the relative risks involved with insulin pumping. The community of families living with type 1 diabetes has been shocked with the deaths of a number of adolescents in the past year form hypoglycemia, excessively low blood sugar. You may know the condition better as insulin shock and it can result even when people believe that have balanced all the inputs just right. 

Insulin absorption is affected by a number of variables. Physical activity can present diabetics with increased insulin efficiency as well as changes when in insulin impacts blood sugar. It is possible that healthy, active kids see blood sugars fall overnight as a result of daytime physical exertion. In those cases reducing or stoping the delivery of insulin, even normal amounts that have previously been fine, can help prevent dangerous low blood sugars.

The US Government has tightened regulation of insulin pumps to the point where innovations that are available around the world are not available for use here. Continuos glucose monitoring systems (CGM) integrated with pump systems are sold in Europe. These insulin pump systems are made by US companies. The more advanced systems can shut off insulin to people having a low glucose episode. This innovation, while made in the USA, is not available for sale here, yet it is available around the world. 

These devices have the potential to save lives. They give people living with diabetes in Europe more choices to consider with their physicians than we have in the US. Sadly the FDA does not even have guidelines for considering how to approve low glucose suspend.

Let me be clear. I am not suggesting that wireless security is unimportant. The devices should be secure. Device makers should be allowed to bring more secure devices to market without a significant regulatory delay.

I am urging you to reflect on the life saving capabilities of innovations like CGM integration and low glucose suspend with the security risk. To date there has been no reported case of any health impact from the possibility of hacking an insulin pump. Zero. 

There have been and continue to be tragic cases of severe hypoglycemia that cost young American lives. The particularly sad loss of adolescents with type 1 diabetes highlights  where LGS may have prevented the unfortunate loss of life. Unlike pump hacking, the lives of American children are been lost to hypoglycemia. Pump hacking, considered outside of the balance of risks facing insulin dependent diabetics, may increase the regulatory delay of life saving technology reaching American families.

The cumbersome FDA regulatory process for inulin pumps slows innovation to US families. Your letter uses the word proliferation. Typically politicians use the word with a negative context. We need a wider rapid adoption of life saving innovation to help keep American teens alive not the proliferation of government studies that prevent US patients from using the innovations of American companies to live healthy lives. 

How can you as senior members of the House Energy and Commerce Committee speed up not only the safety of devices but the availability of life saving tools?