Patients Face Firmware Updates To Prevent Pacemaker Hacking

Almost half a million pacemakers implanted in patients with heart disease have been recalled because of a scary and shocking scenario: The life-saving devices could be tampered with remotely by computer hackers – pacemaker hacking is becoming a possibility.

The U.S. Food and Drug Administration released a safety alert in August of 2017 about potential pacemaker hacking, stating the potential for personal harm. The safety alert, titled “Implantable Cardiac Pacemakers by Abbott (formerly St. Jude Medical): Safety Communication – Firmware Update to Address Cybersecurity Vulnerabilities,” immediately grabbed headlines.

Pacemaker Hacking Fears Stoked by FDA

“White hat hackers have previously pointed out the risks with connected medical devices,” according to an article in Fortune titled “465,000 Pacemakers Recalled on Hacking Fears.” “In its announcement, the FDA noted that this vulnerability could allow third parties to rapidly drain the pacemaker’s battery or adjust the operation of the device.”

Josh Corman, director of the Atlantic Council’s Cyber Statecraft Initiative, which focuses on the public impact of cybersecurity vulnerabilities, said the threats involving such medical devices are real.

“Corman says people should not have a crisis of confidence that imperils future medical breakthroughs, despite the reality that nothing is unhackable,” CNN Money reports in an article titled “Over half a million hackable pacemakers can now be fixed.” “Instead, he says, it’s important to determine what connectivity is actually needed, and balance it with acceptable risks.”

The fix actually is easy and takes no more than three minutes, although it will require everyone affected to make an appointment with his or her doctor. The corrective action is a firmware update.

“The FDA and Abbott do NOT recommend prophylactic removal and replacement of affected devices,” the FDA states in the safety alert. “Print or digitally store the programmed device settings and the diagnostic data in case of loss during the update.

After the update, confirm that the device maintains its functionality, is not in backup mode, and that the programmed parameters have not changed.”

The FDA stated that no injuries have been reported yet but made clear the danger of that happening in the future.

“Many medical devices – including St. Jude Medical’s implantable cardiac pacemakers – contain configurable embedded computer systems that can be vulnerable to cybersecurity intrusions and exploits,” the safety alert states. “As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect how a medical device operates.”

Pacemaker Hacking Scenarios Explained

The scary and shocking scenario might play out like this: A computer hacker gains access to an implanted pacemaker and changes its programmed data, resulting in improper pacing – making the heart beat too fast or too slow – depleting the battery in the process. While the FDA’s safety alert is limited to pacemakers, there is no reason bad actors are unable to gain access to other devices connected to the Internet. The firmware of these devices forms the basis of their operating systems.

Included in the recall list are the Accent DR RF, Accent MRI, Accent SR RF, Allure Quadra RF, Allure RF, Anthem RF, Assurity, Assurity MRI and Quadra Allure MP RF.

CodeCmmt002.svg“All industries need to be constantly vigilant against unauthorized access,” Robert Ford, Abbott’s executive vice president of medical devices, said in a press release titled “Abbott Issues New Updates for Implanted Cardiac Devices.” “This isn’t a static process, which is why we’re working with others in the healthcare sector to ensure we’re proactively addressing common topics to further advance the security of devices and systems.”

The topic of hacking and health care is not a new one. In 2013, former Vice President Dick Cheney revealed on CBS’ 60 Minutes he disabled a feature on his defibrillator that enabled it to be connected to Wi-Fi out of fear of being assassinated by terrorists. Also in 2013, the FDA and the Industrial Control Systems Cyber Emergency Response Team, which works to reduce the risks surrounding 16 critical-infrastructure sectors in the United States, came out with dual studies not only on pacemakers and defibrillators but on drug-infusion pumps, patient monitors and ventilators, as well – all containing passwords. A blog later published the findings.

“Pacemaker programmers do not authenticate to pacemaker devices,” the blog, titled “Understanding Pacemaker Systems Cybersecurity,” states. “Any pacemaker programmer can reprogram any pacemaker from the same manufacturer.  This shows one of the areas where patient care influenced cybersecurity posture.”

Patients and physicians are urged to contact Abbott’s customer hotline for technical support. The number is 800‐722‐3774 and patients can call with questions regarding the firmware update. They additionally are urged to report any adverse events via the FDA’s MedWatch Online Voluntary Reporting Form.

Thousands of Victims Left in Wake of Disastrous Medtronic Infuse Product

Please note: At this time, the dangerous drug attorneys at Searcy Denney are not accepting cases for injuries from the Medtronic Infuse Bone Graft. If you or a loved one has suffered injuries by another dangerous drug or medical device, we are always available to answer your legal questions for free.

Medtronic, one of the world’s largest medical-device makers, already has been the focus of high-profile litigation that resulted in an $8.45 million settlement. The Dublin, Ireland, company whose operational headquarters are in Fridley, Minnesota, is now the focus of more high-profile litigation involving thousands of Medtronic Infuse cases that could result in $300 million in payouts.

All of the cases surround the Infuse Bone Graft product. Infuse Bone Graft, when used correctly, is surgically implanted in an area of the body where bone growth is lacking. It consists of a naturally occurring protein carried via a sponge, which releases the protein in stages so it can be absorbed properly.

“Using Infuse Bone Graft eliminates the need for a second surgery to harvest, or remove surgically, bone from your body (“autogenous” bone) for placement at the surgery site,” the Medtronic Web site states. “Autogenous bone harvest has the risk of pain, complications, longer surgical time, and more anesthesia.”

Problems with Medtronic Infuse Bone Graft Explained

Problem is, Infuse Bone Graft has not been used correctly, according to the plethora of plaintiffs who have suffered debilitating and permanent injuries as a result. In some cases, patients said they were unaware they were going to receive the product.

By Group29 - Own photo, CC BY-SA 3.0, https://en.wikipedia.org/w/index.php?curid=54280613

Medtronic’s Headquarters in Fridley, Minnesota. By Group29 – Own photo, CC BY-SA 3.0, Wikipedia.

“Many of the injured patients allege in their lawsuits that they found out about the use of Infuse only after their surgery ended with complications,” reports the StarTribune in an article titled “Medtronic says it’s close to resolving Infuse lawsuits.” “Some say Medtronic sales reps were present in the operating rooms during their surgeries.”

That allegation was the root of the problem in the first case, where two men being treated at the University of California Los Angeles said their doctors were getting kickbacks from Medtronic.

“Patients Ralph Weiss and Jerome Lew alleged that hundreds of thousands of dollars in Medtronic consulting, grants and royalty payments to UCLA surgeon Jeffrey Wang created conflicts of interest that led to risky treatments about which they were not informed,” the StarTribune reports in another article titled “Patients who received Medtronic’s Infuse product to get $8.45 million in settlements.” “They said they were not told that they were receiving Infuse or that it was being inserted into mechanical devices with which it had never been tested for safety.”

In addition to the sponge, there is another carrier for Infuse Bone Graft – the LT-Cage Device. Small, hollow and thimble-like, it is used for spinal fusion.

“Today there is a clinically studied, proven alternative to taking bone graft from the patient,” according to Medtronic. “A potential advantage to having spinal-fusion surgery using the Infuse Bone Graft and LT-Cage Device is that it removes the need to collect bone from your hip.”

Weiss and Lew both experienced extra spinal bone growth that led to nerve damage. Weiss had lumbar surgery, while Lew’s condition prompted Wang to insert the LT-Cage Device into Lew’s neck even though the U.S. Food & Drug Administration warned that could cause nerve damage.

“The following is a list of potential adverse events which may occur with oral maxillofacial surgery using the INFUSE® Bone Graft:” reads a document on the FDA’s Web site. “Some of these adverse events may have been previously reported in the adverse events table below or have been reported to the manufacturer.”

Off-Label Use of Medtronic Infuse Bone Graft Exacerbates Problems

“Ectopic and/or exuberant bone formation” is listed as a risk in addition to nerve damage. Other potential adverse events include allergic reaction, death, fetal-development complications, itching, scar formation, tissue damage and antibodies to certain types of collagen.

Such off-label use of a medical device is acceptable, according to the FDA. In response to the question of whether the FDA requires and Institutional Review Board to approve off-label use, the agency states, “No, when a physician uses a legally marketed device outside its labeling to treat a patient and no research is being done, IRB review is not required. Note: Although not required by FDA, an IRB may still decide on its own initiative to review such use.”

The $8.45 million settlement was split between Weiss and Lew. Their doctor, Jeffrey Wang, is believed to have received $300,000 in consulting fees, grants and royalties from Medtronic beginning in 2000, and at one point appeared as an endorser on the company’s Web site.

“Substantially all” of the thousands of other cases that stem from the product’s misuse have reached agreements, says Mark Reilly, managing editor of the Minneapolis / St. Paul Business Journal, in an article titled “Medtronic could soon settle thousands of Infuse lawsuits.”

Reilly notes that Medtronic will pay $22 million to 950 plaintiffs, already paid $85 million to settle a shareholder lawsuit and paid another $40 million to the U.S. Department of Justice.

“In all the settlements, Medtronic denied wrongdoing,” Reilly says.

Viagra and Cialis MDL Litigation Update

In April of 2016, the Judicial Panel on Multidistrict Litigation, a panel who determines whether to coordinate federal court lawsuits into multidistrict litigation (MDL), centralized lawsuits involving men who developed melanoma after ingesting Viagra. This MDL was established in San Francisco federal court before Judge Seeborg and styled as In Re: Viagra (Sildenafil Citrate) Products Liability Litigation. Recently, Judge Seeborg expanded the MDL proceedings to include claims against Eli Lilly & Company, after patients who ingested Cialis (a drug similar to Viagra) also developed melanoma. To date, hundreds of individual personal injury and wrongful death lawsuits have been filed by patients alleging that Viagra and/or Cialis were defectively designed, inadequately tested, and improperly marketed, as the manufacturers did not properly inform the patients or their prescribing physicians that the use of the drug could cause or promote the growth of melanoma cancer cells.

The discovery efforts concerning both drugs are now moving on nearly-parallel tracks and are progressing smoothly, especially with Judge Seeborg’s recent rulings.

Judge Seeborg entered a scheduling order, which governs the progress of the case by setting certain deadlines for each of the parties involved. This specific order imposed a timetable requiring the parties to complete key parts of the general and scientific liability discovery by certain dates.

Viagra_TabletteWhat Does Judge Seeborg’s Scheduling Order Mean for the Parties?

Both defendants have been producing documents relating to the development of the drugs, clinical studies before and after FDA approval, interactions with the FDA and other drug regulators, how the drugs were marketed, monitoring of safety issues, etc. Per Judge Seeborg’s order, the Plaintiffs Steering Committee is only allowed to conduct 14 depositions of key fact witnesses from the two international drug manufacturers. Considering the complexity of the case and the length of time that both Cialis and Viagra have been on the market, the permitted amount of depositions seems exceptionally low, but the plaintiffs are hopeful that Judge Seeborg will allow additional depositions in the future. Nonetheless, the depositions of Pfizer’s fact witnesses relating to Viagra must be completed by October 30, 2017 and Eli Lilly’s fact witness depositions must be completed by January 15, 2018.

The plaintiffs have also been limited to a total of 12 general causation experts – 6 for Viagra and 6 for Cialis. These experts are scientists who will be hired by the plaintiffs to provide expert witness opinions to substantiate the plaintiffs’ case and to satisfy the high thresholds required for admissibility of expert witness testimony in federal court. These experts will cover subjects including how the drugs cause cancer, whether the risks of melanoma are higher n patient who have ingested ED drugs, how much of an exposure to the ED drugs is required in order to cause an increased risk of melanoma, why the cancer link should have been discovered sooner by the manufacturers, whether the rugs were properly tested before being sold to patients, the adequacy of the drug manufacturers’’ systems to detect potential safety issues, and whether the drugs were ethically and honestly marketed by the Defendants. The plaintiffs’ experts must prepare and file their extensive reports by February of 2018. Thereafter, the experts will testify in depositions regarding their opinions. The Defendants’ experts will likewise be required to file their extensive reports by April 2, 2018, and the depositions of those experts must be completed by August 15, 2018.

The Daubert Challenge

Following the completion of the expert witness depositions, both sides will file briefs requesting the MDL judge to strike, or remove, expert witness testimony that they believe does not meet the rigorous standards required for admissibility at trial in federal court. The judge may decide to strike all, some, or none of the expert testimony. In making that determination, the MDL judge will focus on the methods used by the experts in arriving at their opinions. If the judge determines that the experts for both the plaintiffs and defendants have relied upon accepted scientific procedures, even if they have reached differing opinions, the testimony will be admissible and the responsibility of determining which testimony is most credible and reliable will be left for a jury to decide in future trials. This process is known as a Daubert challenge and must be completed by November 19, 2018.

Bellwether Trial Plan for Viagra & Cialis MDL

Judge Seeborg has also ordered the parties to present him with a bellwether trial plan, a plan for selecting the first Viagra and/or Cialis cases to be tried in the MDL, by May 1, 2018.  Once Judge Seeborg selects the cases to be prepared for trial, case-specific depositions and expert witness discovery will be completed.  These trial preparation efforts will be coordinated with the general liability and expert witness discovery discussed above. The purpose of the bellwether trial process is to complete a trial or trials of individual cases that are representative of many of the cases that are pending in the MDL, such that the parties will receive feedback as to the value of the cases, the likelihood of prevailing, etc.  In preparing the bellwether cases for trial, the MDL judge will make several rulings relating to legal issues and will also decide on the admissibility of evidence and case-specific expert witness testimony (which must also endure the Daubert challenge, similar to the generic expert witness testimony).  In this part of a case, the judge will evaluate whether the plaintiff’s treating doctors and expert witnesses have properly followed scientific and medical methodology in determining that Cialis or Viagra were the legal cause of the plaintiff’s melanoma (as opposed to other causes).

Once the bellwether trial process is complete and Judge Seeborg is ready to dismantle the MDL, it is likely that he will remand each individual case back to its respective local federal court jurisdiction for trial settings.  Since the first MDL trials will not occur until 2019, it is doubtful that the remaining cases will be set for trials until late 2019 or, more likely, 2020 and later.

But, for now, the judge and the parties will remain heavily focused on completing the generic liability discovery and the generic expert witness discovery, which must be completed prior to preparing for the first bellwether trials and potential trials in the future.

Zimmer Implantable Spinal Fusion Stimulator Recall

The FDA announced a recall of Zimmer Biomet’s SpF PLUS Mini and SpF XL IIb implantable spinal fusion stimulators.  This is due to the high levels of potentially harmful chemicals that are potentially harmful to tissues and organs (cytotoxicity). The recall of the implantable device affects certain serial numbers that were manufactured between Oct. 11, 2016 and Jan. 18, 2017 and distributed between March 28, 2017 and April 6, 2017.  This discovery was made during a routine monitoring procedure. The cytotoxicity can cause chronic infections, long-term hospitalization due to revision surgeries, paralysis, and death. On April 20th, Zimmer Biomet released an urgent Medical Device Removal notification to all of its customers to seek medical treatment to quarantine the devices.

spinal fusion stimulator

Though not the same device, this is what a spinal fusion stimulator can look like.

Spinal Fusion Stimulator Failed Cytotoxicity Tests

“A cytotoxicity test is a part of the biological evaluation of medical devices to ensure compatibility with the device and the human body,” said the FDA. “A positive cytotoxicity test (failed result) can indicate that a device contains potential harmful chemicals at amounts or levels that could be dangerous to the patient.” The FDA has labelled this as a Class 1 recall which is the most serious classification of recall. This severity of classification is only reserved for products that could be linked to serious complications or death.

These devices are used during spinal fusion surgery. They increase the possibility of permanently connecting two or more bones of the spine together. They are implanted in patients backs and provide constant electrical stimulation to the surgical site. This assists in fusing the vertebrae bones.

Zimmer Biomet will apparently schedule a time for removal of the quarantined devices from medical facilities by one of their sales representatives. Surgeons who extract these devices should conduct normal clinical monitoring for 3-6 months postoperatively for implanted patients. Hopefully the spinal fusion simulators were recalled in time to avoid adverse health effects in patients. However, with 100,000 of these devices already implanted in patients, that may not be the case.

Invokana Under New Scrutiny as FDA Publishes Further Research

Janssen Pharmaceuticals’ type 2 diabetes medication is under new scrutiny. This new scrutiny follows confirmation from the Food and Drug Administration (FDA) that use of the drug canagliflozin, sold as Invokana and Invokamet, potentially increases the risk of amputation of the feet or legs. Most of these amputations have involved the toe and middle of the foot. Amputations of the leg, both above and below the knee, have also been necessary in some cases.

New Clinical Trials Show Dangers of Invokana

invokanaThe FDA initially highlighted this alarming side effect last year following results from two clinical trials. These clinical trials indicated that Invokana and Invokamet XR potentially caused patients to be twice as likely to require an amputation than those who received a placebo. The initial trial, CANVAS, demonstrated that 5.9 of 1,000 patients taking Invokana had an amputation within a year. Meanwhile, the number of individuals who had amputations from those taking a placebo was 2.8 out of 1,000. A second trial, CANVAS-R, was conducted with similar results. Out of 1,000 people, 7.5 taking the drug had an amputation while the amount of those who received an amputation while on a placebo was 4.2.

On Tuesday, the FDA stated that these medications will now receive mandatory black box warnings. This is the strictest type of warning issued by the FDA, indicating significant health risks and detrimental side effects for patients. Janssen also announced that a majority of patients who had undergone amputations would likely require additional surgery. In response to the recent FDA studies, Janssen issued a statement saying, “Patient safety is our highest priority. We are working with the FDA to include this information in the prescribing information for canagliflozin and look forward to the presentation of the full CANVAS Program results at the American Diabetes Association Scientific Sessions in June.”

Other Side Effects Associated With Invokana

Aside from the correlation with amputations, the drug also has other negative effects. These negative side effects include decreased cardiovascular health and an increased chance of bone fractures and urinary tract infections. Researchers encourage doctors to look at pre-existing conditions that could be exacerbated when patients take the drug. The potentially exacerbated pre-existing conditions include peripheral vascular disease, neuropathy, diabetic foot ulcers, and previous amputations.

An announcement of this magnitude has many industry insiders wondering what this could mean for Invokana’s competitors. The competing drugs that fall into this specific class of diabetes treatments are known as sodium-glucose cotransporter 2 inhibitors. This class of diabetes drugs includes well-known names like Farxiga and Jardiance. Seamus Fernandez, an analyst at the healthcare-specialized investment bank Leerink Partners, has predicted that Jardiance in particular will benefit from the market losses that are projected for Invokana. Mr. Fernandez believes that many doctors will likely switch patients away from Invokana immediately.

Investors in Johnson & Johnson (J&J) are also wondering if they should be worried about this new research. Janssen is the pharmaceutical arm of the American multinational manufacturer. However, Fernandez believes that they do not have much cause for concern. He doubts that the class of drugs overall will suffer a substantial setback. Regardless, adding the FDA’s strongest safety warning to Invokana’s packaging will undoubtedly create issues for this J&J company.