Patients Face Firmware Updates To Prevent Pacemaker Hacking

Almost half a million pacemakers implanted in patients with heart disease have been recalled because of a scary and shocking scenario: The life-saving devices could be tampered with remotely by computer hackers – pacemaker hacking is becoming a possibility.

The U.S. Food and Drug Administration released a safety alert in August of 2017 about potential pacemaker hacking, stating the potential for personal harm. The safety alert, titled “Implantable Cardiac Pacemakers by Abbott (formerly St. Jude Medical): Safety Communication – Firmware Update to Address Cybersecurity Vulnerabilities,” immediately grabbed headlines.

Pacemaker Hacking Fears Stoked by FDA

“White hat hackers have previously pointed out the risks with connected medical devices,” according to an article in Fortune titled “465,000 Pacemakers Recalled on Hacking Fears.” “In its announcement, the FDA noted that this vulnerability could allow third parties to rapidly drain the pacemaker’s battery or adjust the operation of the device.”

Josh Corman, director of the Atlantic Council’s Cyber Statecraft Initiative, which focuses on the public impact of cybersecurity vulnerabilities, said the threats involving such medical devices are real.

“Corman says people should not have a crisis of confidence that imperils future medical breakthroughs, despite the reality that nothing is unhackable,” CNN Money reports in an article titled “Over half a million hackable pacemakers can now be fixed.” “Instead, he says, it’s important to determine what connectivity is actually needed, and balance it with acceptable risks.”

The fix actually is easy and takes no more than three minutes, although it will require everyone affected to make an appointment with his or her doctor. The corrective action is a firmware update.

“The FDA and Abbott do NOT recommend prophylactic removal and replacement of affected devices,” the FDA states in the safety alert. “Print or digitally store the programmed device settings and the diagnostic data in case of loss during the update.

After the update, confirm that the device maintains its functionality, is not in backup mode, and that the programmed parameters have not changed.”

The FDA stated that no injuries have been reported yet but made clear the danger of that happening in the future.

“Many medical devices – including St. Jude Medical’s implantable cardiac pacemakers – contain configurable embedded computer systems that can be vulnerable to cybersecurity intrusions and exploits,” the safety alert states. “As medical devices become increasingly interconnected via the Internet, hospital networks, other medical devices, and smartphones, there is an increased risk of exploitation of cybersecurity vulnerabilities, some of which could affect how a medical device operates.”

Pacemaker Hacking Scenarios Explained

The scary and shocking scenario might play out like this: A computer hacker gains access to an implanted pacemaker and changes its programmed data, resulting in improper pacing – making the heart beat too fast or too slow – depleting the battery in the process. While the FDA’s safety alert is limited to pacemakers, there is no reason bad actors are unable to gain access to other devices connected to the Internet. The firmware of these devices forms the basis of their operating systems.

Included in the recall list are the Accent DR RF, Accent MRI, Accent SR RF, Allure Quadra RF, Allure RF, Anthem RF, Assurity, Assurity MRI and Quadra Allure MP RF.

CodeCmmt002.svg“All industries need to be constantly vigilant against unauthorized access,” Robert Ford, Abbott’s executive vice president of medical devices, said in a press release titled “Abbott Issues New Updates for Implanted Cardiac Devices.” “This isn’t a static process, which is why we’re working with others in the healthcare sector to ensure we’re proactively addressing common topics to further advance the security of devices and systems.”

The topic of hacking and health care is not a new one. In 2013, former Vice President Dick Cheney revealed on CBS’ 60 Minutes he disabled a feature on his defibrillator that enabled it to be connected to Wi-Fi out of fear of being assassinated by terrorists. Also in 2013, the FDA and the Industrial Control Systems Cyber Emergency Response Team, which works to reduce the risks surrounding 16 critical-infrastructure sectors in the United States, came out with dual studies not only on pacemakers and defibrillators but on drug-infusion pumps, patient monitors and ventilators, as well – all containing passwords. A blog later published the findings.

“Pacemaker programmers do not authenticate to pacemaker devices,” the blog, titled “Understanding Pacemaker Systems Cybersecurity,” states. “Any pacemaker programmer can reprogram any pacemaker from the same manufacturer.  This shows one of the areas where patient care influenced cybersecurity posture.”

Patients and physicians are urged to contact Abbott’s customer hotline for technical support. The number is 800‐722‐3774 and patients can call with questions regarding the firmware update. They additionally are urged to report any adverse events via the FDA’s MedWatch Online Voluntary Reporting Form.

Viagra and Cialis MDL Litigation Update

In April of 2016, the Judicial Panel on Multidistrict Litigation, a panel who determines whether to coordinate federal court lawsuits into multidistrict litigation (MDL), centralized lawsuits involving men who developed melanoma after ingesting Viagra. This MDL was established in San Francisco federal court before Judge Seeborg and styled as In Re: Viagra (Sildenafil Citrate) Products Liability Litigation. Recently, Judge Seeborg expanded the MDL proceedings to include claims against Eli Lilly & Company, after patients who ingested Cialis (a drug similar to Viagra) also developed melanoma. To date, hundreds of individual personal injury and wrongful death lawsuits have been filed by patients alleging that Viagra and/or Cialis were defectively designed, inadequately tested, and improperly marketed, as the manufacturers did not properly inform the patients or their prescribing physicians that the use of the drug could cause or promote the growth of melanoma cancer cells.

The discovery efforts concerning both drugs are now moving on nearly-parallel tracks and are progressing smoothly, especially with Judge Seeborg’s recent rulings.

Judge Seeborg entered a scheduling order, which governs the progress of the case by setting certain deadlines for each of the parties involved. This specific order imposed a timetable requiring the parties to complete key parts of the general and scientific liability discovery by certain dates.

Viagra_TabletteWhat Does Judge Seeborg’s Scheduling Order Mean for the Parties?

Both defendants have been producing documents relating to the development of the drugs, clinical studies before and after FDA approval, interactions with the FDA and other drug regulators, how the drugs were marketed, monitoring of safety issues, etc. Per Judge Seeborg’s order, the Plaintiffs Steering Committee is only allowed to conduct 14 depositions of key fact witnesses from the two international drug manufacturers. Considering the complexity of the case and the length of time that both Cialis and Viagra have been on the market, the permitted amount of depositions seems exceptionally low, but the plaintiffs are hopeful that Judge Seeborg will allow additional depositions in the future. Nonetheless, the depositions of Pfizer’s fact witnesses relating to Viagra must be completed by October 30, 2017 and Eli Lilly’s fact witness depositions must be completed by January 15, 2018.

The plaintiffs have also been limited to a total of 12 general causation experts – 6 for Viagra and 6 for Cialis. These experts are scientists who will be hired by the plaintiffs to provide expert witness opinions to substantiate the plaintiffs’ case and to satisfy the high thresholds required for admissibility of expert witness testimony in federal court. These experts will cover subjects including how the drugs cause cancer, whether the risks of melanoma are higher n patient who have ingested ED drugs, how much of an exposure to the ED drugs is required in order to cause an increased risk of melanoma, why the cancer link should have been discovered sooner by the manufacturers, whether the rugs were properly tested before being sold to patients, the adequacy of the drug manufacturers’’ systems to detect potential safety issues, and whether the drugs were ethically and honestly marketed by the Defendants. The plaintiffs’ experts must prepare and file their extensive reports by February of 2018. Thereafter, the experts will testify in depositions regarding their opinions. The Defendants’ experts will likewise be required to file their extensive reports by April 2, 2018, and the depositions of those experts must be completed by August 15, 2018.

The Daubert Challenge

Following the completion of the expert witness depositions, both sides will file briefs requesting the MDL judge to strike, or remove, expert witness testimony that they believe does not meet the rigorous standards required for admissibility at trial in federal court. The judge may decide to strike all, some, or none of the expert testimony. In making that determination, the MDL judge will focus on the methods used by the experts in arriving at their opinions. If the judge determines that the experts for both the plaintiffs and defendants have relied upon accepted scientific procedures, even if they have reached differing opinions, the testimony will be admissible and the responsibility of determining which testimony is most credible and reliable will be left for a jury to decide in future trials. This process is known as a Daubert challenge and must be completed by November 19, 2018.

Bellwether Trial Plan for Viagra & Cialis MDL

Judge Seeborg has also ordered the parties to present him with a bellwether trial plan, a plan for selecting the first Viagra and/or Cialis cases to be tried in the MDL, by May 1, 2018.  Once Judge Seeborg selects the cases to be prepared for trial, case-specific depositions and expert witness discovery will be completed.  These trial preparation efforts will be coordinated with the general liability and expert witness discovery discussed above. The purpose of the bellwether trial process is to complete a trial or trials of individual cases that are representative of many of the cases that are pending in the MDL, such that the parties will receive feedback as to the value of the cases, the likelihood of prevailing, etc.  In preparing the bellwether cases for trial, the MDL judge will make several rulings relating to legal issues and will also decide on the admissibility of evidence and case-specific expert witness testimony (which must also endure the Daubert challenge, similar to the generic expert witness testimony).  In this part of a case, the judge will evaluate whether the plaintiff’s treating doctors and expert witnesses have properly followed scientific and medical methodology in determining that Cialis or Viagra were the legal cause of the plaintiff’s melanoma (as opposed to other causes).

Once the bellwether trial process is complete and Judge Seeborg is ready to dismantle the MDL, it is likely that he will remand each individual case back to its respective local federal court jurisdiction for trial settings.  Since the first MDL trials will not occur until 2019, it is doubtful that the remaining cases will be set for trials until late 2019 or, more likely, 2020 and later.

But, for now, the judge and the parties will remain heavily focused on completing the generic liability discovery and the generic expert witness discovery, which must be completed prior to preparing for the first bellwether trials and potential trials in the future.

Zimmer Implantable Spinal Fusion Stimulator Recall

The FDA announced a recall of Zimmer Biomet’s SpF PLUS Mini and SpF XL IIb implantable spinal fusion stimulators.  This is due to the high levels of potentially harmful chemicals that are potentially harmful to tissues and organs (cytotoxicity). The recall of the implantable device affects certain serial numbers that were manufactured between Oct. 11, 2016 and Jan. 18, 2017 and distributed between March 28, 2017 and April 6, 2017.  This discovery was made during a routine monitoring procedure. The cytotoxicity can cause chronic infections, long-term hospitalization due to revision surgeries, paralysis, and death. On April 20th, Zimmer Biomet released an urgent Medical Device Removal notification to all of its customers to seek medical treatment to quarantine the devices.

spinal fusion stimulator

Though not the same device, this is what a spinal fusion stimulator can look like.

Spinal Fusion Stimulator Failed Cytotoxicity Tests

“A cytotoxicity test is a part of the biological evaluation of medical devices to ensure compatibility with the device and the human body,” said the FDA. “A positive cytotoxicity test (failed result) can indicate that a device contains potential harmful chemicals at amounts or levels that could be dangerous to the patient.” The FDA has labelled this as a Class 1 recall which is the most serious classification of recall. This severity of classification is only reserved for products that could be linked to serious complications or death.

These devices are used during spinal fusion surgery. They increase the possibility of permanently connecting two or more bones of the spine together. They are implanted in patients backs and provide constant electrical stimulation to the surgical site. This assists in fusing the vertebrae bones.

Zimmer Biomet will apparently schedule a time for removal of the quarantined devices from medical facilities by one of their sales representatives. Surgeons who extract these devices should conduct normal clinical monitoring for 3-6 months postoperatively for implanted patients. Hopefully the spinal fusion simulators were recalled in time to avoid adverse health effects in patients. However, with 100,000 of these devices already implanted in patients, that may not be the case.

Invokana Under New Scrutiny as FDA Publishes Further Research

Janssen Pharmaceuticals’ type 2 diabetes medication is under new scrutiny. This new scrutiny follows confirmation from the Food and Drug Administration (FDA) that use of the drug canagliflozin, sold as Invokana and Invokamet, potentially increases the risk of amputation of the feet or legs. Most of these amputations have involved the toe and middle of the foot. Amputations of the leg, both above and below the knee, have also been necessary in some cases.

New Clinical Trials Show Dangers of Invokana

invokanaThe FDA initially highlighted this alarming side effect last year following results from two clinical trials. These clinical trials indicated that Invokana and Invokamet XR potentially caused patients to be twice as likely to require an amputation than those who received a placebo. The initial trial, CANVAS, demonstrated that 5.9 of 1,000 patients taking Invokana had an amputation within a year. Meanwhile, the number of individuals who had amputations from those taking a placebo was 2.8 out of 1,000. A second trial, CANVAS-R, was conducted with similar results. Out of 1,000 people, 7.5 taking the drug had an amputation while the amount of those who received an amputation while on a placebo was 4.2.

On Tuesday, the FDA stated that these medications will now receive mandatory black box warnings. This is the strictest type of warning issued by the FDA, indicating significant health risks and detrimental side effects for patients. Janssen also announced that a majority of patients who had undergone amputations would likely require additional surgery. In response to the recent FDA studies, Janssen issued a statement saying, “Patient safety is our highest priority. We are working with the FDA to include this information in the prescribing information for canagliflozin and look forward to the presentation of the full CANVAS Program results at the American Diabetes Association Scientific Sessions in June.”

Other Side Effects Associated With Invokana

Aside from the correlation with amputations, the drug also has other negative effects. These negative side effects include decreased cardiovascular health and an increased chance of bone fractures and urinary tract infections. Researchers encourage doctors to look at pre-existing conditions that could be exacerbated when patients take the drug. The potentially exacerbated pre-existing conditions include peripheral vascular disease, neuropathy, diabetic foot ulcers, and previous amputations.

An announcement of this magnitude has many industry insiders wondering what this could mean for Invokana’s competitors. The competing drugs that fall into this specific class of diabetes treatments are known as sodium-glucose cotransporter 2 inhibitors. This class of diabetes drugs includes well-known names like Farxiga and Jardiance. Seamus Fernandez, an analyst at the healthcare-specialized investment bank Leerink Partners, has predicted that Jardiance in particular will benefit from the market losses that are projected for Invokana. Mr. Fernandez believes that many doctors will likely switch patients away from Invokana immediately.

Investors in Johnson & Johnson (J&J) are also wondering if they should be worried about this new research. Janssen is the pharmaceutical arm of the American multinational manufacturer. However, Fernandez believes that they do not have much cause for concern. He doubts that the class of drugs overall will suffer a substantial setback. Regardless, adding the FDA’s strongest safety warning to Invokana’s packaging will undoubtedly create issues for this J&J company.

JPML Hears Physiomesh Centralization Motion

The U.S. Judicial Panel on Multidistrict Litigation (“JPML” or “The Panel”) is a body of seven federal district judges who manage multidistrict litigation, meeting on a bimonthly basis to consider requests to establish MDLs. The Panel has the authority to determine whether civil actions pending in two or more federal judicial districts should be transferred to a single federal district court for pretrial proceedings.

The Panel is holding its next MDL hearing on Thursday, May 25, 2017, at the John H. Wood, Jr. United States Courthouse in San Antonio, Texas.

One noteworthy argument to be heard is in regards to MDL No. 2782, a set of products liability claims involving the Physiomesh Flexible Composite (hereinafter “Physiomesh”), a synthetic mesh hernia repair device designed, manufactured and sold by Ethicon, Inc. and Johnson & Johnson. Plaintiffs are moving to transfer 18 product liability actions pending in 9 federal district courts to the Middle District of Florida, or in the alternative, to the Southern District of Illinois, for coordinated and/or consolidated pretrial proceedings.

The argument favoring the “centralization” of multiple actions maintains that such action will promote just and efficient conduct of these actions, serve the convenience of all parties and witnesses, promote the interest of justice, conserve judicial resources, reduce litigation costs, avoid potentially inconsistent pretrial scheduling orders and substantive rulings, and will eliminate unnecessary duplicative discovery.

Physiomesh Litigation Overview


Yet another 510(k) approval under recall.

Each of these 18 actions allege that the defendants Ethicon, Inc. and Johnson & Johnson defectively designed and manufactured the Physiomesh products, and failed to provide appropriate warnings and instructions with these devices. The Physiomesh has a unique design, which has never been used in any other hernia repair product. The product was represented and promoted by the Defendants to prevent or minimize adhesion and inflammation and to facilitate incorporation and fixation of the mesh into the abdomen. However, the Plaintiffs allege that the design prevented adequate incorporation of the mesh and caused or contributed to a variety of serious complications. Plaintiffs additionally claim that the Physiomesh was insufficient to withstand normal abdominal forces. This often resulted in herniation through the mesh itself, recurrent hernia formation and/or rupture and deformation of the mesh.

The Plaintiffs people who received implants of the Physiomesh product for hernia repair, and where applicable, their spouses. All of the plaintiffs suffered serious and often permanent physical injuries from the implantation of the Physiomesh. They often required additional surgeries, additional medical expenses, and unresolved medical complications. Where applicable, plaintiffs’ spouses have alleged loss of consortium.

Defendants Withdraw Product from Market

The defendants ultimately withdrew the Physiomesh device from the market in May 2016, when Ethicon, Inc. issued an Urgent Field Safety Notice. Unpublished data from two large independent hernia repair registries indicated that recurrence and reoperation rates after laparoscopic ventral hernia repair using Ethicon Physiomesh were noticeably higher than the average rates of hernia mesh issues among other products in the market. Plaintiffs intend to establish that Ethicon’s decision to withdraw Physiomesh from the market was a direct consequence of the frequency and severity of the complications experienced with this product worldwide.

There were more than 330,000 Physiomesh devices sold worldwide and it is believed that 50% of those products were sold in the U.S. It is anticipated that hundreds of additional Physiomesh lawsuits will be initiated in the near future.

INRatio Recall and Settlement – Did Alere Get Away With Deception, Death?

After the blood monitoring device INRatio recall, a class-action lawsuit filed against the manufacturer, Alere, has settled out of court. So it is safe to say the global corporation with headquarters in Waltham, Mass., that touts itself as a leader in rapid diagnostics, likely dodged a bullet.

Class 1 INRatio Recall

By James Foster - Own work, CC BY-SA 3.0 via Wikimedia Commons.Alere recalled the device because it was producing inaccurate readings – readings that were different from those measured by similar devices – and eventually pulled it off the market. The recall was a Class 1, the most serious, and one in which injury or death could occur. The reason for the recall was that the system had the potential to generate low results in patients taking blood thinners. In such cases, if the false low results were acted on, there could be fatal bleeding.

“Alere was unable to develop an adequate modification that ensured the safety and effectiveness of the INRatio System,” according to the U.S. Food and Drug Administration.

The company invested in two years of research and development related to the software component of the device. They obviously could not find a feasible solution.

“Alere is initiating a voluntary withdrawal of the Alere INRatio® PT/INR Monitor system,” the company website states. “In certain cases an Alere INRatio® PT/INR Monitor system may provide an INR result that is clinically significantly lower than a result obtained using a reference INR system (laboratory method).”

Affected Patients of INRatio Recall

Those affected are patients who take warfarin and self-test their blood at home to keep track of the time it takes to clot. Others are affected, too. The class-action lawsuit involved a plaintiff from Virginia who had a stroke and learned that the INRatio product in use was recording higher ratings than those in a professional lab. Another plaintiff in Arizona paid $1,700 on an INRatio product that was defective.

In 2014, Alere notified users of the INRatio device that certain patients with specific medical problems should avoid having their blood monitored with the device. Following this notification, the Class 1 INRatio recall was issued on July 11, 2016.

The plaintiffs pointed out that the recall came almost two years later. Meantime, they accused Alere of deceptive-marketing and false-advertising tactics. Also, there were a reported 18,000-plus complaints between 2002 and 2014 about the defective device, three of which resulted in death.

Details of the settlement by U.S. District Judge F. Dennis Saylor IV are not public.