Individual patient medical devices including cardiovascular implantable electronic devices could be at risk of hacking, according to the American College of Cardiology’s Electrophysiology Council.

The researchers set out the potential risk to patients who require medical technology, suggested ways to improve cybersecurity for patients and offered advice to physicians in a recent paper.

To date there have been no clinical reports of malicious, inadvertent or malware hacking attacks affecting cardiac devices but other medical devices have been targeted.

Dhanunjaya R. Lakkireddy, MD, professor of medicine at the University of Kansas Hospital and member of the Electrophysiology Council, said: “True cybersecurity begins at the point of designing protected software from the outset, and requires the integration of multiple stakeholders, including software experts, security experts and medical advisors.”

Hackers may target medical devices for several reasons including political, financial, social and personal motives. Devices can be hacked locally or remotely and both personal devices and larger medical machinery, such as CT scanners, are at risk.  The FDA has issued both pre-market and post-market guidance for the security of medical devices and legislative proposals related to medical device security have been advanced in the US Congress.

Medical devices have been targets of hacking for over a decade. The increasing number of medical devices using software has increased the need to protect devices from intentionally harmful interference. Advanced wireless communications between healthcare providers and patients’ devices has created the theoretical possibility for the deactivation of features, the alteration of programming, and the delaying, interfering or interrupting of communications.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

Hacking a cardiac device specifically could have numerous clinical consequences. Patients with pacemakers could be at risk of hackers causing the oversensing or battery depletion of their device. For patients with implantable cardioverter-defibrillators, it is possible for hackers to interrupt wireless communications, inhibiting the value of telemonitoring and allowing any clinically relevant events to go undetected by the system. Oversensing—when electrical signals in a pacemaker are inappropriately recognised as native cardiac activity and pacing is inhibited—can inhibit pacing or cause life-threatening shocks. Battery depletion can lead to a device being unable to deliver therapies during life-threatening arrhythmias.

However, there is currently no evidence to suggest that hackers have or could successfully reprogram a cardiovascular implantable electronic device. Therefore the council members said they do not feel that enhanced monitoring or elective device replacement is necessary at this time.

Lakkireddy said: “The likelihood of an individual hacker successfully affecting a cardiovascular implantable electronic device or being able to target a specific patient is very low. A more likely scenario is that of a malware or ransomware attack affecting a hospital network and inhibiting communication.”

The council concluded that cybersecurity needs to be addressed during product testing both pre- and post-market. Because cyber vulnerabilities can emerge quickly, strong post-market processes must be in place to monitor the environment for new vulnerabilities and to respond in a timely manner. They suggest that firmware may be useful in devices with possible vulnerabilities.