Rates of Adoption and Outcomes After Firmware Updates for Food and Drug Administration Cybersecurity Safety Advisories

HomeCirculation: Arrhythmia and ElectrophysiologyVol. 13, No. 8Rates of Adoption and Outcomes After Firmware Updates for Food and Drug Administration Cybersecurity Safety Advisories Free AccessReview ArticlePDF/EPUBAboutView PDFView EPUBSections ToolsAdd to favoritesDownload citationsTrack citationsPermissions ShareShare onFacebookTwitterLinked InMendeleyReddit Jump toFree AccessReview ArticlePDF/EPUBRates of Adoption and Outcomes After Firmware Updates for Food and Drug Administration Cybersecurity Safety Advisories Leslie A. Saxon, MD, Niraj Varma, MD, PhD, Laurence M. Epstein, MD, Leonard I. Ganz, MD and Andrew E. Epstein, MD Leslie A. SaxonLeslie A. Saxon Correspondence to: Leslie A. Saxon, MD, USC Center for Body Computing, 12015 Waterfront Dr, Los Angeles, CA 90094. Email E-mail Address: [email protected] https://orcid.org/0000-0002-0127-368X Department of Medicine, University of Southern California, Keck School of Medicine, Los Angeles (L.A.S.). Search for more papers by this author , Niraj VarmaNiraj Varma https://orcid.org/0000-0003-2296-2596 Department of Medicine, Cleveland Clinic, OH (N.V.). Search for more papers by this author , Laurence M. EpsteinLaurence M. Epstein Northwell Health, Manhasset, NY (L.M.E.). Search for more papers by this author , Leonard I. GanzLeonard I. Ganz Heritage Valley Health System, Beaver, PA (L.I.G.). Search for more papers by this author and Andrew E. EpsteinAndrew E. Epstein https://orcid.org/0000-0003-0433-8802 Department of Medicine, University of Pennsylvania, Philadelphia (A.E.E.). Search for more papers by this author Originally published6 Jul 2020https://doi.org/10.1161/CIRCEP.120.008364Circulation: Arrhythmia and Electrophysiology. 2020;13:e008364Other version(s) of this articleYou are viewing the most recent version of this article. Previous versions: July 7, 2020: Ahead of Print In response to Food and Drug Administration (FDA) Cybersecurity Safety Advisories affecting over 1 500 000 patients implanted globally with pacemakers (490 209 US patients) and implantable cardioverter-defibrillators (ICDs; 357 647 US patients) and related equipment, Abbott released 2 cybersecurity firmware updates between August 2017 and April 2018 for impacted pacemakers and ICDs.1,2 We previously reported on firmware update rates, complications, and predictors of upgrades in a subset of affected US patients with pacemakers.3 Firmware update adoption, requiring a clinic visit, was low, as were complications. Subsequently, in 2018 to 2019, FDA cybersecurity advisories have also impacted over 16 000 programmers and 600 000 ICDs manufactured by Medtronic and mitigations for those have also been FDA approved.1,4Before identification of these vulnerabilities, clinical and patient communities had little experience implementing device firmware updates. There was a paucity of published research and clinical experience defining the safety of performing these updates in large numbers of patients implanted over a multiyear interval with numerous device types and models.3,5 Lack of outcomes data, combined with the absence of any documented instance of actual cybersecurity intrusion to these devices or peripheral products that support device connectivity (programmer, home communicator, database, communication protocols), render the assessment of the risk-benefit of updating an individual’s device less than straightforward. Abbott Cybersecurity Medical Advisory Board expected update rates to be the highest in the affected ICD subpopulation also impacted by an October 2016 advisory for premature battery depletion because the cybersecurity firmware update also included a new battery performance alert that impacted over 175 000 US patients.1 Through a number of communications, including an FDA-convened Patient Engagement Advisory Committee meeting in September 2019, the FDA has indicated that it would like the mitigating firmware updates performed in greater numbers of patients impacted by these cybersecurity advisories.6,7 On November 22, 2019, Abbott released a clinical update reporting a 25% overall upgrade rate for affected pacemakers and ICDs associated with an aggregate complication rate of 0.032%.8 The update recommended that clinicians update more devices and indicated that Abbott will provide field support to accomplish these at scale. In January of 2020, Medtronic announced a firmware mitigation for ICDs that will automatically update firmware in impacted patients at clinic visits.4This update to our prior publication provides further detail on mitigation adoption rates for the entirety of the US patient population with implanted cardiac rhythm management devices falling under FDA cybersecurity advisories from any device manufacturer.3 We also provide limited data on known cybersecurity mitigation adoption outside of the United States. We report a unique complication resulting from introducing firmware to already implanted devices and discuss how evolving FDA policies toward firmware mitigation adoption will increasingly determine how and when updates occur.6,7 Institutional review board approval was not required for this study.Table 1 lists the characteristics of US patients with affected devices that are active on Abbott Merlin.net database as of March 1, 2020. To better understand associations predictive of receiving a firmware upgrade, we performed a multivariate regression analysis. Compared with patients <50 years of age, those >80 years of age were less likely to receive the upgrade, and men versus women had greater rates of upgrades. Upgrade rates varied according to the US region and date of implant. Resynchronization devices were less likely to receive the upgrade as were pacemaker-dependent patients. Those ICD patients additionally falling under with the battery advisory were upgraded more frequently. The number of advisory patients followed in clinic was a significant predictor of firmware upgrade adoption, particularly for pacemakers that were more often upgraded in smaller size clinics. Overall, only 24% of devices (68 215/290 244) for all groups and 22% of devices not impacted by the battery advisory (52 435/238 327) were upgraded.Table 1. Predictors of Cybersecurity Firmware Upgrade Rates in US PatientsPatient and Device CharacteristicsPacemakerICDOdds Ratio (95% CI)P ValueOdds Ratio (95% CI)P ValueAge, y (<50 vs) >50–≤801.02 (0.93–1.12)0.6441.04 (0.98–1.11)0.157 >800.87 (0.80–0.95)0.0030.87 (0.82–0.93)<0.001Sex Male1.11 (1.08–1.14)<0.0011.06 (1.03–1.10)<0.001Region (Midwest vs) Northeast0.71 (0.68–0.74)<0.0010.92 (0.88–0.96)<0.001 Southeast1.02 (0.98–1.06)0.2741.14 (1.10–1.19)<0.001 Southwest1.17 (1.12–1.22)<0.0011.17 (1.11–1.23)<0.001 West0.68 (0.65–0.71)<0.0011.07 (1.01–1.12)0.012Time from implant, y (<3 vs) 3–70.79 (0.77–0.82)<0.0011.01 (0.97–1.06)0.488 >70.68 (0.65–0.71)<0.0010.94 (0.89–1.01)0.084Device type (CRT vs) Single chamber ventricular1.32 (1.23–1.41)<0.0011.24 (1.19–1.29)<0.001 Dual chamber1.33 (1.26–1.40)<0.0011.23 (1.18–1.28)<0.001ICD early battery depletion advisory YesNA1.80 (1.73–1.87)<0.001Pacemaker dependent Yes0.65 (0.63–0.68)<0.0010.92 (0.88–0.96)<0.001Clinic size (<50 vs) 50–2500.89 (0.81–0.97)0.0060.94 (0.86–1.04)0.237 250–5000.87 (0.80–0.95)0.0020.93 (0.84–1.02)0.125 500–10000.76 (0.70–0.82)<0.0010.73 (0.67–0.80)<0.001 1000–25000.74 (0.68–0.81)<0.0010.78 (0.71–0.86)<0.001 2500–50000.77 (0.71–0.84)<0.0010.86 (0.79–0.95)0.003 >50000.78 (0.71–0.86)<0.0011.01 (0.91–1.12)0.821CRT indicates cardiac resynchronization therapy; ICD, implantable cardioverter-defibrillator; and NA, not available.Table 2 lists the date of the FDA cybersecurity advisories, type of advisory, and the number of devices impacted by manufacturer. Mitigation FDA approval dates, overall firmware upgrade adoption rates, and known complications are provided (Product Security at Medtronic, Alexander Kent, PhD, MBA, email communication, March 2020). For Abbott devices, the home communicator cybersecurity vulnerabilites were mitigated with an automatic software patch that was updated using the Merlin network link, and adoption rates were ≈100%. For the entire patient cohort with impacted pacemakers and ICDs, US and global adoption rate has remained at 24% to 35% with a low rate of complications. Most reported complications for pacemakers and ICDs were symptoms (transient palpitations, dizziness, or syncope) that resulted from the temporary change in pacing mode (to ventricular demand pacing) or transient loss of programmer telemetry while performing the upgrade (pacemaker: 107/220 500, 0.050%; ICD: 21/196 700, 0.01%). Globally, a total of 9 pacemakers (9/220 500) and 8 ICDs (8/196 700, 0.004%) required replacement as a result of performing the firmware upgrade due to irreversible reversion to backup pacing mode with loss of defibrillation therapy (ICDs). Analysis of the returned ICD pulse generators found that in 7 cases, the cause was related to a capacitor bond failure that was exposed only with extended telemetry as required by the upgrade. The failure mechanism was an isolated component failure in the remaining ICD. A programmer-based test has been recently FDA approved that can be performed prior the firmware upgrade to identify ICD devices at risk for the capacitor bond failure. A total of 256 ICDs were susceptible to loss of radiofrequency telemetry after receiving a firmware update, and this has since been mitigated with a software patch. For Medtronic programmers, the initial mitigation response to the cybersecurity advisory was to take the programmers off the network. The network connection was subsequently enhanced with more cybersecurity protections, provided to the programmers using a flash drive, so that programmers can now be secured from potential cyber intrusion when connected to the network. Medtronic ICDs are currently being upgraded. The update is being provided to impacted patients automatically when their device is interrogated with the programmer during a clinic follow-up. Medtronic is introducing the updates in phased approach expects all updates to be completed by the beginning of 2021. There are 9% or 55 000 ICDs under this advisory that cannot receive the update due to design or safety constraints.Table 2. Connected Cardiac Rhythm Management Device FDA Cybersecurity Safety Communications MitigationsDateManufacturerRadiofrequency Enabled Device(s)Number of Devices ImpactedSoftware/Firmware FDA Approved Mitigation DateUpdate Adoption Rate, %Upgrade Complications, %US/Outside USUS/Outside USWorld WideJanuary 9, 2017St. Jude Medical/AbbottHome communicators374 219/2487January 9, 2017, software patch to home communicators99/95None knownPacemakers, ICDs490 209/323 200 pacemakersAugust 29, 2017, firmware update to pacemakers24/25Symptoms, 0.05%Replacement, 0.004%*357 647/382 404 ICDsApril 17, 2018, firmware updates to ICDs†25/35Symptoms, 0.01%Replacement, 0.004%‡Potential loss of radiofrequency telemetry,§ 0.13%October 11, 2018MedtronicProgrammers that download software from Medtronic SDN Technology16 896/not providedOctober 5, 2018, software to block programmers from accessing Medtronic SDN100None knownJanuary 30, 2020, restored network connectivity with enhanced cybersecurity96None knownMarch 21, 2019MedtronicHome communicators, ICDs605 000/not providedJanuary 30, 2020, automatic firmware update to 55% of impacted ICDs requires programmer interaction to updateExpected to be 91 early 2021∥None known, firmware patch loaded to unused memory in ICD, no existing function impactedFDA indicates Food and Drug Administration; ICD, implantable cardioverter-defibrillator; SDN, software-defined networking; and US, the United States.* Eight due to backup mode pacing, 1 elective replacement, 2 US, 7 outside US.† Also contained battery alert for ICDs impacted under premature battery FDA advisory.‡ Seven known mechanism, 1 unknown failure mechanism, 2 US, 6 outside US.§ Software patch available, total ICDs at risk 256, 41 US, 15 outside US.∥ Nine percent of devices cannot be upgraded due to age of device (older).Since the 2017 Abbott advisories, advisories identifying cybersecurity vulnerabilities in pacemakers and ICDs with the potential for exploits have increased, including 2 additional FDA advisories issued for another major manufacturer, Medtronic’s connected communication products and implantable defibrillators and in the past 14 months.1 FDA pre- and postmarket guidance has also evolved with the cybersecurity research community, along with device manufactures and the clinical community increasingly engaged in public and private dialogue to coordinate disclosers and provide guidance to both the clinical and patient communities about the risk/benefits of cybersecurity mitigations, such as firmware upgrades.1–8 The ability to leverage connected device databases and continuously assess for cybersecurity vulnerabilities or exploits and to report on the safety of cybersecurity firmware upgrades is critical to enhancing patient safety. In the case of Abbott’s vulnerabilities, while complication rates associated with firmware updates are exceedingly low, it is now better appreciated that exposing dormant failure mechanisms, such as the ICD capacitor bond issue reported here, can occur and needs to be considered, as well as mitigated. It is also possible that a firmware update may corrupt an otherwise functional device, causing a random component failure, which was also documented as causal in one ICD.8 Thus far, similar to our prior publication, reporting on updates to a subset of affected pacemaker patients, the majority of the clinical and patient community has not elected to perform or receive updates for potential cybersecurity vulnerabilities.3 Our findings of age, sex, and region update adoption rates, while statistically significant, are not clinically significant because overall update rates are small. The willingness to update younger devices or ICD devices also receiving a battery depletion alert is understandable. Pacemaker-dependent status was clearly recognized as a risk factor and impacted the decision-making process not to update. That seems justifiable in light of the small number of devices that required replacement due to nonprogrammability and backup mode pacing. Smaller volume clinics updating more often may reflect the practices of a smaller number of clinicians than larger clinics. At any rate, we feel that deferring an update is a justifiable decision as there have been no reported cybersecurity breaches impacting the devices included in any of the FDA advisories issued to date. A recent report, in a smaller number of Abbott impacted pacemaker and ICD patients from Canada, reported marked differences in mitigation update adoption rates between pacemakers and ICDs. This was due to increasing and incremental clinical familiarity and comfort with performing the updates as experience and education surrounding these issues evolved.5 In the case of the Medtronic ICD mitigations, occurring 3 years after the first Abbott advisories, the FDA approved an automatic update mitigation that supports FDA’s stated intent that cybersecurity updates should be automatic.7 In many instances, this will happen without involving a discussion or decision process on the part of the patient or clinician. From a safety standpoint, the Medtronic ICD updates will likely be associated with less risk of complications, because the updates do not require the devices to revert to backup modes to receive the update. This is because the update is uploaded to unused memory on the device that is segregated from other device functions. Nonetheless, automating cybersecurity updates without processes in place for determining safety or for alerting patients or clinicians that updates have been delivered may also be associated with, as yet, unknown risks. As physicians, we routinely make risk-benefit decisions with our patients. Governmental mandates and automated upgrades remove both physicians and patients from the shared decision-making process as it relates to cybersecurity risks. In this scenario, in the event of an unintended complication, it is possible that neither the clinician nor the patient would have an awareness of the issue, and that would definitely be a disadvantage in terms of making the best clinical determination of what needed to be done. Newer generation devices and communication protocols may render cybersecurity advisory events less frequent as cybersecurity integration is considered an essential aspect of device design.The data will not be made available to researchers as they are proprietary to the manufacturer and were specifically queried for the purposes of examining the response to the firmware update advisory.Nonstandard Abbreviations and AcronymsFDAFood and Drug AdministrationICDimplantable cardioverter-defibrillatorSources of FundingAbbott supported the data query of the remote monitoring database with Abbott personnel.DisclosuresAll authors are paid members of the Abbott Cybersecurity Medical Advisory Board.FootnotesFor Sources of Funding and Disclosures, see page 872.Correspondence to: Leslie A. Saxon, MD, USC Center for Body Computing, 12015 Waterfront Dr, Los Angeles, CA 90094. Email [email protected]eduReferences1. U.S. Food & Drug Administration. Cybersecurity.2020. https://www.fda.gov/medical-devices/digital-health/cybersecurity#safety. Accessed March 24, 2020.Google Scholar2. U.S. Food & Drug Administration. U.S. Food & Drug Administration: Digital Health.2019https://www.fda.gov/medical-devices/digital-health. Accessed March 24, 2020.Google Scholar3. Saxon LA, Varma N, Epstein LM, Ganz LI, Epstein AE. Factors influencing the decision to proceed to firmware upgrades to implanted pacemakers for cybersecurity risk mitigation.Circulation. 2018; 138:1274–1276. doi: 10.1161/CIRCULATIONAHA.118.034781LinkGoogle Scholar4. Alexander B, Neira V, Campbell D, Crystal E, Simpson C, Enriquez A, Chacko S, Abdollah H, Redfearn D, Baranchuk A. Implantable cardioverter-defibrillator-cybersecurity.Circ Arrhythm Electrophysiol. 2020; 13:e008261. doi: 10.1161/CIRCEP.119.008261LinkGoogle Scholar5. U.S. Food & Drug Administration. September 10, 2019: Patient Engagement Advisory Committee Meeting Announcement.2019. https://www.fda.gov/advisory-committees/patient-engagement-advisory-committee/september-10-2019-patient-engagement-advisory-committee-meeting-announcement-09102019-09102019. Accessed March 24, 2020.Google Scholar6. Abbott. Product Advisories Archive.2020. https://www.cardiovascular.abbott/us/en/hcp/resources/product/advisories.html. Accessed March 24, 2020.Google Scholar7. Medtronic. Security Bulletins - Conexus Telemetry and Monitoring Accessories.2020. https://global.medtronic.com/xg-en/product-security/security-bulletins/conexus.html. Accessed March 24, 2020.Google Scholar8. Paulsen JE, Hazelett MB, Schwartz SB. CIED cybersecurity risks in an increasingly connected world.Circulation. 2018; 138:1181–1183. doi: 10.1161/CIRCULATIONAHA.118.035021LinkGoogle Scholar Previous Back to top Next FiguresReferencesRelatedDetailsCited By Qian X, Channels C, Gaeta S, Wish M, Matthews B, Atwater B and Kumar V (2022) Radiofrequency remote monitor software patch update without cybersecurity implantable cardioverter-defibrillator firmware update increases the risk of inappropriate implantable cardioverter-defibrillator therapies, HeartRhythm Case Reports, 10.1016/j.hrcr.2021.12.016, 8:2, (69-72), Online publication date: 1-Feb-2022. Giansanti D and Gulino R (2021) The Cybersecurity and the Care Robots: A Viewpoint on the Open Problems and the Perspectives, Healthcare, 10.3390/healthcare9121653, 9:12, (1653) August 2020Vol 13, Issue 8 Advertisement Article InformationMetrics © 2020 American Heart Association, Inc.https://doi.org/10.1161/CIRCEP.120.008364PMID: 32631098 Originally publishedJuly 6, 2020 Keywordsdefibrillators, implantableambulatory carerisk assessmentcomputer securityaccidental fallsPDF download Advertisement SubjectsCatheter Ablation and Implantable Cardioverter-DefibrillatorComplicationsQuality and Outcomes