Factors Influencing the Decision to Proceed to Firmware Upgrades to Implanted Pacemakers for Cybersecurity Risk Mitigation
2018; Lippincott Williams & Wilkins; Volume: 138; Issue: 12 Linguagem: Inglês
10.1161/circulationaha.118.034781
ISSN1524-4539
AutoresLeslie A. Saxon, Niraj Varma, Laurence M. Epstein, Leonard I. Ganz, Andrew E. Epstein,
Tópico(s)Muscle activation and electromyography studies
ResumoHomeCirculationVol. 138, No. 12Factors Influencing the Decision to Proceed to Firmware Upgrades to Implanted Pacemakers for Cybersecurity Risk Mitigation Free AccessLetterPDF/EPUBAboutView PDFView EPUBSections ToolsAdd to favoritesDownload citationsTrack citationsPermissions ShareShare onFacebookTwitterLinked InMendeleyReddit Jump toFree AccessLetterPDF/EPUBFactors Influencing the Decision to Proceed to Firmware Upgrades to Implanted Pacemakers for Cybersecurity Risk Mitigation Leslie A. Saxon, MD, Niraj Varma, MD, PhD, Laurence M. Epstein, MD, Leonard I. Ganz, MD and Andrew E. Epstein, MD Leslie A. SaxonLeslie A. Saxon Leslie A. Saxon, MD, USC Center for Body Computing, 12015 Waterfront Drive, Los Angeles, CA 90094. E-mail E-mail Address: [email protected] University of Southern California, Keck School of Medicine, Los Angeles (L.A.S.). , Niraj VarmaNiraj Varma Cleveland Clinic, OH (N.V.). , Laurence M. EpsteinLaurence M. Epstein Northwell Health, Manhasset, NY (L.M.E.). , Leonard I. GanzLeonard I. Ganz Heritage Valley Health System, Leetsdale, PA (L.I.G.). and Andrew E. EpsteinAndrew E. Epstein University of Pennsylvania, Philadelphia (A.E.E.). Originally published24 Jul 2018https://doi.org/10.1161/CIRCULATIONAHA.118.034781Circulation. 2018;138:1274–1276Other version(s) of this articleYou are viewing the most recent version of this article. Previous versions: July 24, 2018: Ahead of Print In August of 2017, the first major recall for cybersecurity vulnerabilities in pacemakers capable of remote connectivity was released that affected 465 000 US patients.1,2 The US Food and Drug Administration approved a firmware update designed by the manufacturer of the devices as a remediation (Abbott, formally St Jude Medical). The recall was in response to the public disclosure of vulnerability by an investment firm and produced in a laboratory environment that could allow an unauthorized party in close proximity to a patient to impact the performance of the device or modify device settings through radiofrequency communication.3 Although an exploit has not occurred in a patient and requires a high degree of resources and skill to execute, if accomplished, it could pose a significant risk to device safety and essential performance and cause patient harm. The Food and Drug Administration defines this as an uncontrolled vulnerability.2 The recall recommendations were coordinated among three parties: the Food and Drug Administration, the Industrial Control Systems Cyber Emergency Response Team—a division of Homeland Security that responds to and coordinates disclosure of critical infrastructure cybersecurity vulnerabilities—and Abbott.1 All parties urged caution and shared decision making between patient and clinician as to whether to have the device firmware update, a process that requires a clinic visit to implement with a device programmer. The manufacturer bench tested the firmware update, but the only prior experience with an implanted device firmware update was a 2012 implantable cardioverter defibrillator firmware update that demonstrated a 0.197% risk of device backup mode pacing after the upgrade was performed.To evaluate the response to the recall, we analyzed remotely collected data from the week of December 10 to 16, 2017, from patient data stored in Abbott's Merlin.net database of cardiac rhythm management devices that transmit implanted device data using a home communicator.A total of 26 468 patients transmitted data and 10 854 patients (41%) were identified who had a clinic visit subsequent to the recall notification (age 79±11 years, 55% male, mean device implant time 3±2 years). A total of 2694 (25%) had the firmware upgrade performed. The majority of pacemakers were dual-chamber pacemakers (81%), the remaining were cardiac resynchronization pacemakers and single-chamber ventricular pacemakers (11%, 8%), and 19% of patients were pacemaker dependent. Institutional review board approval was not required for this study. Remote monitoring data were obtained from the manufacturer that has data use agreements in place with device centers for patient remote monitoring.Patient factors associated with performing the firmware upgrade included younger age, male sex, and residence in the southern or midwestern United States. Newer implants and pacemakers versus cardiac resynchronization devices were also more likely to be upgraded. Pacemaker-dependent patients were less likely to be upgraded (Table). Backup mode pacing was observed in 1% of upgraded patients and was resolved in all with reprogramming. There was no failure to pace observed.Table. Patient and Device Predictors of Firmware UpgradePatient and Device CharacteristicsFirmware Upgrade, % (n/N)P Value*Age, y 30, ≤4022 (10/45) >40, ≤5036 (29/81) >50, ≤6026 (113/428) >60, ≤7027 (401/1496) >70, ≤8027 (953/3568) >80, ≤9024 (968/4016) >9018 (210/1159)Sex0.018 Male25 (1183/4676) Female23 (901/3900)Region<0.001 South/Midwest29 (1945/6614) Northeast/West18 (746/4234)Time from pacemaker implant, y 1, ≤226 (586/2236) >2, ≤326 (464/1792) >3, ≤423 (313/1364) >4, ≤520 (206/1014) >5, ≤626 (199/775) >6, ≤720 (147/734) >7, ≤819 (101/520) >8, ≤912 (15/121)Pacemaker versus resynchronization device<0.001 Single-chamber ventricular27 (227/834) Dual chamber25 (2248/8840) Cardiac resynchronization19 (219/1180)Pacemaker dependent<0.001 Yes19 (2138/7815) No27 (332/1852)*χ2 test was used to calculate the P values.This analysis indicates that most patients and clinicians impacted by a cybersecurity recall react conservatively to the potential risk of an exploit and do not elect to have a firmware update but do continue to use remote connectivity for device transmissions. The advisory recall notifications did not provide patient- or device-specific recommendations, other than to have temporary pacing capability present at the time of the upgrade for pacemaker-dependent patients. This analysis indicates that younger male patients with more recent implants were more likely to have the firmware upgrade. Because men and women were equally represented, it is unclear why men were upgraded more. This is consistent with other reports demonstrating that women are offered cardiovascular testing and therapies less often than men.4 The decision to upgrade younger patients and newer implants may be based on reasoning that they face greater exposure to risk, because the devices are expected to last 5 to 10 years. The reason that upgrades occurred more in the specific regions of the country is unclear and may be related to factors such as more intensive manufacturer representative communication or specific geographical considerations for patients and their access to healthcare providers. The finding that pacemaker-dependent patients were upgraded less often indicates the concern that essential functions like pacing could be disabled. It is unclear why patients with cardiac resynchronization devices were upgraded less often; it may be that there is a lower level of clinical concern for cyber intrusions for patients who receive devices for heart failure versus bradycardia indications. As experience accumulates with firmware upgrades, these differences may diminish and clinicians and patients may elect to proceed with prophylactic firmware upgrades. It is important that the manufacturing, governmental, and clinical communities continue to track and monitor connected devices subject to firmware upgrades to help inform recall recommendations, to monitor device performance, and to help inform clinical recommendations. This is especially true as more and more diagnostic and therapeutic implantable devices are connected to the Internet and, in particular, as additional connected device and software services are offered and approved by the Food and Drug Administration for patient monitoring and management.5Sources of FundingAbbott supported the data query of the remote monitoring database with Abbott personnel.DisclosuresAll authors are paid members of the Abbott Cybersecurity Medical Advisory Board.FootnotesData sharing: The data will not be made available to researchers as it is proprietary to the manufacturer and was specifically queried for the purposes of examining the response to the firmware update advisory. The methods are clearly stated in the article.https://www.ahajournals.org/journal/circLeslie A. Saxon, MD, USC Center for Body Computing, 12015 Waterfront Drive, Los Angeles, CA 90094. E-mail [email protected]eduReferences1. US Food and Drug Administration. Cybersecurity vulnerabilities identified in St. Jude Medical's implantable cardiac devices and [email protected] transmitter/firmware update to address cybersecurity vulnerabilities identified in Abbott's (formerly St. Jude Medical's) implantable cardiac pacemakers: FDA Safety Communication.U.S. Food and Drug Administration. 2017. https://www.fda.gov/MedicalDevices/Safety/AlertsandNotices/ucm553873.htm. Accessed October 26, 2017.Google Scholar2. Postmarket Management of Cybersecurity in Medical Devices. Guidance for Industry and Food and Drug Administration Staff. Silver Spring, MD: US Food and Drug Administration; 2016. https://www.fda.gov/downloads/Medi-calDevices/DeviceRegulationandGuidance/GuidanceDocuments/UCM482022.pdf. Accessed August 17, 2017.Google Scholar3. Muddy Waters Capital, LLC. MW is Short St. Jude Medical (STJ:US). Muddy Waters Research.2016. http://www.muddywatersresearch.com/research/stj/mw-is-short-stj/.Google Scholar4. Garcia M, Mulvagh SL, Noel C, Merz B, Buring JE, Manson JE. Cardiovascular disease in women: clinical perspectives.Circ Res. 2016; 15:1273–1293. doi: 10.1161/CIRCRESAHA.116.307547LinkGoogle Scholar5. US Food and Drug Administration. Digital health innovation action plan.US Food and Drug Administration. https://www.fda.gov/downloads/MedicalDevices/DigitalHealth/UCM568735.pdf. Accessed January 5, 2018.Google Scholar Previous Back to top Next FiguresReferencesRelatedDetailsCited By Magnocavallo M, Vetta G, Bernardini A, Piro A, Mei M, Di Iorio M, Mariani M, Della Rocca D, Severino P, Quaglione R, Giunta G, Chimenti C, Miraldi F, Vizza C, Fedele F and Lavalle C (2022) Impact of COVID-19 Pandemic on Cardiac Electronic Device Management and Role of Remote Monitoring, Cardiac Electrophysiology Clinics, 10.1016/j.ccep.2021.10.010, 14:1, (125-131), Online publication date: 1-Mar-2022. Patel B and Makaryus A (2021) Cardiac implantable electronic devices and cybersecurity, Expert Review of Medical Devices, 10.1080/17434440.2021.2007075, 18:sup1, (69-77), Online publication date: 3-Dec-2021. Monteith S, Glenn T, Geddes J, Severus E, Whybrow P and Bauer M (2021) Internet of things issues related to psychiatry, International Journal of Bipolar Disorders, 10.1186/s40345-020-00216-y, 9:1, Online publication date: 1-Dec-2021. Varma N, Cygankiewicz I, Turakhia M, Heidbuchel H, Hu Y, Chen L, Couderc J, Cronin E, Estep J, Grieten L, Lane D, Mehra R, Page A, Passman R, Piccini J, Piotrowicz E, Piotrowicz R, Platonov P, Ribeiro A, Rich R, Russo A, Slotwiner D, Steinberg J and Svennberg E (2021) 2021 ISHNE / HRS / EHRA / APHRS Collaborative Statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals, European Heart Journal - Digital Health, 10.1093/ehjdh/ztab001, 2:1, (7-48), Online publication date: 4-May-2021. Varma N, Cygankiewicz I, Turakhia M, Heidbuchel H, Hu Y, Chen L, Couderc J, Cronin E, Estep J, Grieten L, Lane D, Mehra R, Page A, Passman R, Piccini J, Piotrowicz E, Piotrowicz R, Platonov P, Ribeiro A, Rich R, Russo A, Slotwiner D, Steinberg J and Svennberg E (2021) 2021 ISHNE/HRS/EHRA/APHRS collaborative statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals, Journal of Arrhythmia, 10.1002/joa3.12461, 37:2, (271-319), Online publication date: 1-Apr-2021. Varma N, Cygankiewicz I, Turakhia M, Heidbuchel H, Hu Y, Chen L, Couderc J, Cronin E, Estep J, Grieten L, Lane D, Mehra R, Page A, Passman R, Piccini J, Piotrowicz E, Piotrowicz R, Platonov P, Ribeiro A, Rich R, Russo A, Slotwiner D, Steinberg J and Svennberg E (2021) 2021 ISHNE/ HRS/ EHRA/ APHRS collaborative statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals, Annals of Noninvasive Electrocardiology, 10.1111/anec.12795, 26:2, Online publication date: 1-Mar-2021. Varma N, Marrouche N, Aguinaga L, Albert C, Arbelo E, Choi J, Chung M, Conte G, Dagher L, Epstein L, Ghanbari H, Han J, Heidbuchel H, Huang H, Lakkireddy D, Ngarmukos T, Russo A, Saad E, Saenz Morales L, Sandau K, Sridhar A, Stecker E and Varosy P (2020) HRS/EHRA/APHRS/LAHRS/ACC/AHA worldwide practice update for telehealth and arrhythmia monitoring during and after a pandemic, EP Europace, 10.1093/europace/euaa187, 23:2, (313-313), Online publication date: 5-Feb-2021. Varma N, Cygankiewicz I, Turakhia M, Heidbuchel H, Hu Y, Chen L, Couderc J, Cronin E, Estep J, Grieten L, Lane D, Mehra R, Page A, Passman R, Piccini J, Piotrowicz E, Piotrowicz R, Platonov P, Ribeiro A, Rich R, Russo A, Slotwiner D, Steinberg J and Svennberg E (2021) 2021 ISHNE/HRS/EHRA/APHRS Expert Collaborative Statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals: From the International Society for Holter and Noninvasive Electrocardiology/Heart Rhythm Society/European Heart Rhythm Association/Asia-Pacific Heart Rhythm Society, Circulation: Arrhythmia and Electrophysiology, 14:2, Online publication date: 1-Feb-2021. Varma N, Cygankiewicz I, Turakhia M, Heidbuchel H, Hu Y, Chen L, Couderc J, Cronin E, Estep J, Grieten L, Lane D, Mehra R, Page A, Passman R, Piccini J, Piotrowicz E, Piotrowicz R, Platonov P, Ribeiro A, Rich R, Russo A, Slotwiner D, Steinberg J and Svennberg E (2021) 2021 ISHNE/HRS/EHRA/APHRS Collaborative Statement on mHealth in Arrhythmia Management: Digital Medical Tools for Heart Rhythm Professionals, Cardiovascular Digital Health Journal, 10.1016/j.cvdhj.2020.11.004, 2:1, (4-54), Online publication date: 1-Feb-2021. Varma N, Marrouche N, Aguinaga L, Albert C, Arbelo E, Choi J, Chung M, Conte G, Dagher L, Epstein L, Ghanbari H, Han J, Heidbuchel H, Huang H, Lakkireddy D, Ngarmukos T, Russo A, Saad E, Saenz Morales L, Sandau K, Sridhar A, Stecker E and Varosy P (2020) HRS/EHRA/APHRS/LAHRS/ACC/AHA worldwide practice update for telehealth and arrhythmia monitoring during and after a pandemic, Journal of Arrhythmia, 10.1002/joa3.12389, 36:5, (813-826), Online publication date: 1-Oct-2020. Varma N, Marrouche N, Aguinaga L, Albert C, Arbelo E, Choi J, Chung M, Conte G, Dagher L, Epstein L, Ghanbari H, Han J, Heidbuchel H, Huang H, Lakkireddy D, Ngarmukos T, Russo A, Saad E, Saenz Morales L, Sandau K, Sridhar A, Stecker E and Varosy P (2020) HRS/EHRA/APHRS/LAHRS/ACC/AHA Worldwide Practice Update for Telehealth and Arrhythmia Monitoring During and After a Pandemic, Circulation: Arrhythmia and Electrophysiology, 13:9, Online publication date: 1-Sep-2020. Varma N, Marrouche N, Aguinaga L, Albert C, Arbelo E, Choi J, Chung M, Conte G, Dagher L, Epstein L, Ghanbari H, Han J, Heidbuchel H, Huang H, Lakkireddy D, Ngarmukos T, Russo A, Saad E, Saenz Morales L, Sandau K, Sridhar A, Stecker E and Varosy P (2020) HRS/EHRA/APHRS/LAHRS/ACC/AHA Worldwide Practice Update for Telehealth and Arrhythmia Monitoring During and After a Pandemic, Journal of the American College of Cardiology, 10.1016/j.jacc.2020.06.019, 76:11, (1363-1374), Online publication date: 1-Sep-2020. Varma N, Marrouche N, Aguinaga L, Albert C, Arbelo E, Choi J, Chung M, Conte G, Dagher L, Epstein L, Ghanbari H, Han J, Heidbuchel H, Huang H, Lakkireddy D, Ngarmukos T, Russo A, Saad E, Saenz Morales L, Sandau K, Sridhar A, Stecker E and Varosy P (2020) HRS/EHRA/APHRS/LAHRS/ACC/AHA worldwide practice update for telehealth and arrhythmia monitoring during and after a pandemic, Heart Rhythm, 10.1016/j.hrthm.2020.06.010, 17:9, (e255-e268), Online publication date: 1-Sep-2020. Saxon L, Varma N, Epstein L, Ganz L and Epstein A (2020) Rates of Adoption and Outcomes After Firmware Updates for Food and Drug Administration Cybersecurity Safety Advisories, Circulation: Arrhythmia and Electrophysiology, 13:8, Online publication date: 1-Aug-2020. Alexander B and Baranchuk A (2020) Cybersecurity and cardiac implantable electronic devices, Nature Reviews Cardiology, 10.1038/s41569-020-0372-1, 17:6, (315-317), Online publication date: 1-Jun-2020. Alexander B, Neira V, Campbell D, Crystal E, Simpson C, Enriquez A, Chacko S, Abdollah H, Redfearn D and Baranchuk A (2020) Implantable Cardioverter-Defibrillator–Cybersecurity, Circulation: Arrhythmia and Electrophysiology, 13:3, Online publication date: 1-Mar-2020. Best J (2020) Could implanted medical devices be hacked?, BMJ, 10.1136/bmj.m102, (m102) Alexander B, Haseeb S and Baranchuk A (2019) Are implanted electronic devices hackable?, Trends in Cardiovascular Medicine, 10.1016/j.tcm.2018.11.011, 29:8, (476-480), Online publication date: 1-Nov-2019. Martignani C (2019) Cybersecurity in cardiac implantable electronic devices, Expert Review of Medical Devices, 10.1080/17434440.2019.1614440, 16:6, (437-444), Online publication date: 3-Jun-2019. Woods B, Coravos A and Corman J (2019) The Case for a Hippocratic Oath for Connected Medical Devices: Viewpoint, Journal of Medical Internet Research, 10.2196/12568, 21:3, (e12568) Raj L and Saxon L (2018) Haemodynamic Monitoring Devices in Heart Failure: Maximising Benefit with Digitally Enabled Patient Centric Care, Arrhythmia & Electrophysiology Review, 10.15420/aer.2018.32.3, 7:4, (1), . September 18, 2018Vol 138, Issue 12 Advertisement Article InformationMetrics © 2018 American Heart Association, Inc.https://doi.org/10.1161/CIRCULATIONAHA.118.034781PMID: 29748188 Originally publishedJuly 24, 2018 Keywordspacemaker, artificialdefibrillators, implantableelectrophysiologyrisk evaluation and mitigationcomputer securityPDF download Advertisement SubjectsElectrophysiology
Referência(s)