Infusion Pumps and Cybersecurity

Are medical device companies too often ignoring or deprioritizing security problems?

Qmed Staff

The theme of medical device cybersecurity has been making headlines for years but, in 2015, the topic received unprecedented attention.

Security researcher Jeremy Richards described the Hospira Lifecare PCA 3 drug-pump as "the least secure IP enabled device" he's examined.

The U.S. Computer Emergency Readiness Team--a subsidiary of the Department of Homeland of Security--released its own warning about the device, giving the device a 10/10 score in terms of the potential for how "exploitable" the device is.

FDA itself has expressed concerns around Hospira's LifeCare PCA3 and PCA5 infusion pump systems, and even going as far as to advise health providers to stop altogether using another retired Hospira device, the Hospira Symbiq infusion system.

When it comes to infusion pumps, Hospira has been in the process of retiring old pump models and replacing them with new ones. The company, which Pfizer acquired this year for $17 billion, has said its next-generation infusion systems have more cybersecurity protections than the older models.

Overall, medical device cybersecurity is drawing more attention from the U.S. government. In July, FDA released guidance to industry on the topic of cybersecurity. FBI released a warning about the safety of connected devices in September that mentioned the possibility of medical device security breaches.

Medical device companies too often are ignoring or deprioritizing security problems, Jay Radcliffe, a senior security consultant at Rapid7, said in early December  at BIOMEDevice San Jose. "You can't hide. All too often, you see medical device companies doing that. The FDA and FTC are coming down hard on them," Radcliffe said. "And they are looking bad to their customers because their customers are saying: what do you mean there is a vulnerability with my medical device?"

Brian Buntz is the editor-in-chief of MPMN and Qmed. Follow him on Twitter at @brian_buntz. Chris Newmarker is senior editor of MPMN and Qmed. Follow him on Twitter at @newmarker