Medical Devices: Cybersecurity Risks

The St. Jude Medical www.sjm.com Merlin@home Transmitter uses a home monitor that transmits and receives RF signals that is wirelessly connected to the patient’s implanted cardiac device with the ability to read the data stored on the device. The transmitter at the patient’s home, sends the patient’s data to the physician via the Merlin.net Patient Care Network using a continuous landline, cellular, or wireless internet connection.

Many medical devices including St. Jude Medical’s implantable cardiac devices contain configurable embedded computer systems that can be vulnerable to cybersecurity intrusions and exploits. As medical devices become increasingly interconnected via the internet, hospital networks, other medical devices, and smartphones become more susceptible to cybersecurity vulnerabilities.

FDA www.fda.gov has reviewed all the information on potential cybersecurity vulnerabilities associated with the Merlin@home Transmitter and realizes there can be vulnerabilities for unauthorized users to remotely access a patient’s RF-enabled implanted cardiac device and alter the transmitter.

To improve patient safety, St. Jude medical has developed a software patch for the transmitters to reduce the risk for specific cybersecurity vulnerabilities. Starting in January 2017, the patch is now applied automatically to the transmitter. Patients and patient caregivers only need to make certain that their home transmitter remains plugged in and connected to the Merlin.net network if they need to receive the patch.

FDA has reviewed the software patch to ensure that it reduces the risk of exploitation and subsequent patient harm. The FDA conducted an assessment on the benefits and risks for using the Merlin@home Transmitter and has determined that the health benefits to patients from continued use of the device outweigh the cybersecurity risks.

In other news, St Jude Medical with a strong position in the fast growing areas such as atrial fibrillation, heart failure, and chronic pain on January 4, 2017 was just acquired by Abbott www.abbott.com, a leader in coronary interventions and mitral valve disease.

The two companies together will compete in nearly every area of the $30 billion cardiovascular market and will hold the number one or two positions across large and high growth cardiovascular device markets.