Advanced medical devices are an essential component of modern day healthcare. Many of these devices incorporate cyber-technology to improve their responsiveness, adaptability, and to give doctors and patients ways to monitor and control their activity. Currently, there are about 4000 different types of medical devices approved by the FDA and the medical device industry in the U.S. has grown to be worth over $170 billion. The FDA categorizes these devices in three ways:

• Class I devices are simple, non-invasive tools like bandages and stethoscopes. They are typically not subject to FDA regulation and rarely incorporate any cyber-technology.
• Class II devices make up the majority of the commercial market. Many of them are simple devices, such as hypodermic needles or pregnancy tests, but some more complex ones, like ultrasound machines and other scanners, do involve quite a bit of cyber-technology. Devices are put here when they pose low risk to the patient, but nonetheless must be approved by the FDA for safety and effectiveness.
• Class III devices make up only 10% of the market for medical devices, but are responsible for the majority of device-related injuries and deaths. Most of the Class III devices are either worn by or implanted into the patients. These include things like pacemakers, surgical meshes, and joint replacements. Other high-risk devices such as defibrillators, radiation-therapy machines, and dialysis machines also fall into this category.

Since Class III devices are often the most complicated and and are the source of the most controversy, we will focus on those primarily. These devices are the most stringently regulated of the three classifications but more and more we see that the strict FDA requirements are not enough to prevent harm being done by manufacturer negligence or malicious hacking.

Device Malfunctions and Legal Consequences

The FDA keeps track of reported device failings in its Manufacturer And User facility Device Experience (MAUDE) database. The database shows a steady increase in the number of reported malfunctions, injuries and deaths over the past decade and a half. One cause of this increase is a growth in the proportion of Class III devices compared to other devices. There has been a great deal of innovation in these more dangerous and complicated devices following recent advancements in cyber-technology, so more and more of them are being created and sent to the FDA for approval. This has raised concerns that the FDA isn’t taking the proper time and care to properly test and approve these high-risk devices. The overall number of devices submitted for FDA approval has increased significantly as well as more and more companies enter into the industry. Right now, an average of 12 new devices are approved by the agency every day.

Brand new Class II and III devices must go through a fairly rigorous 10-step process before they can be marketed to doctors and consumers. This includes requiring multiple successful human trials (following an application for experimental usage of the device) and the completion of an FDA inspection of all manufacturing facilities and material/component suppliers. This process is in line with what was laid out by Congress in the 1976 Medical Device Regulation Act (commonly called the Medical Device Amendments). However there is an important exception in the law that allows manufacturers to subvert much of this regulatory process. The 510(k) exception is a clause in the law that allows devices to come to market without any human trials if they are “substantially equivalent” to a device the FDA previously approved. Unfortunately, the law is vague as to what exactly this means and just how different a device has to be from an existing one to no longer meet this criteria.

Critics claim that the FDA is too liberal with granting these exceptions and that they are allowing devices with significant technological changes to be fast-tracked in order to cut down on the growing backlog of devices waiting for approval. There are hundreds of millions of devices recalled every year, and analysis shows that devices that went through the quicker 510(k) process were 11.5 times more likely to be subject to recalls than devices that went through the full process. The most common cause for recalls in the last five years was software troubles. Tinkering with the software of a device is oftentimes not enough to move it out of the “substantially equivalent” category so many devices have made it to market without enough software testing thanks to the exception. These issues make software the “weak link” when it comes to the regulation and safety of modern devices.

---

The digital technology in the more dangerous Class III devices is advancing rapidly. According to Axel Wirth, a device engineer with Symantec, the traditional methods of testing the software in wearable/implantable devices has been “outpaced” by the complexity of the digital technology. Due to the small size of medical implants like pacemakers, software for them must be highly compact and the devices have to be optimized to run off very little power since frequent battery changes are not possible. These restrictions make it challenging for device manufacturers to create robust code with lots of fail-safes. A modernized regulation system would take this into account and require additional testing of all software components. However, when the Medical Device Amendments were passed there was hardly any computer software involved healthcare. Many are calling for the FDA to change its regulatory practices by ending the 510(k) exceptions and requiring more rigorous levels of software testing for Class III devices. The agency is currently working on a five-pronged Device Safety Action Plan which intends to address these concerns.

Device Telemetry and Cybersecurity

In hospitals, telemetry is a catch-all term that refers to the many ways that computers and devices connect and relay patient information. Advances in wireless technology have allowed for substantial increases in hospital efficiency thanks to the inter-connectivity of these devices. However, when it comes to the Class III implantable and wearable devices there are several issues related to wireless communication. Even if the devices work as intended and follow the full FDA regulatory process, there can be issues related to data scrambling, patient privacy and risks of hacking.

As mentioned before, Class III implantable devices are generally quite small and have to run for long periods of time off of low power. This makes wireless communication difficult, since its an additional draw on the limited energy source. Designers will often compensate for this by having the devices use low-frequency channels that require less power to transmit on, sometimes going as low as 460 MHz. Not only are these low frequency channels more susceptible to scrambling as the signal passes through the body (increasing the risk of faulty data being given to doctors/analysts) but a patient has multiple devices that are outputting at similar low frequencies there can be interference between them. Many companies are aware of these issues and take steps to mitigate them, but current regulations are lax with regards to bandwidth testing.

There are also additional privacy and security concerns when it comes to the telemetry in wearable and implantable devices. Most Class II and III medical devices will be used exclusively in hospitals. As such they don’t need particularly advanced wireless security protocols as the hospital network they are on will be (hopefully) closed and secure. However, devices that travel with the patient outside of a hospital setting and make use of less protected wireless technology such as Bluetooth or 4G are at much greater risk of unauthorized remote access. Since almost all implantable devices are Class III, any sort of hacking or remote access put the patient’s life at risk. The FDA has issued several warnings, including one this year, about the risk of cyber-attacks on these devices. While there haven’t yet been any major attacks or deaths resulting from device hacking, white-hat trials have been conducted which show that crucial devices such as pacemakers can be taken control of by hacking. In addition to altering the function of devices or using them to directly harm a patient, hackers could also steal identifying data directly from the devices or use their wireless signals to secretly track patients’ movements. While hospitals and device manufacturers are careful to secure devices that hold patient medical records (as required by HIPAA), they have lagged behind in improving the security of other devices. These include medical implants and other Class III devices which people are most worried about being compromised.

It is unclear at this time what the best solutions will be to these telemetry issues. More FDA regulation regarding bandwidth range and security features might help but adding additional restrictions to these small devices could have an impact on other aspects, such as performance and safety. As more and more medical devices are being used outside of secure hospital environments the privacy and security challenges the pose will increase. If people are going to be comfortable using and implanting these devices in the future, more aggressive action must be taken to improve their communication reliability and security. (A good overview of some recent approaches to security in implantable devices can be found here).