Medtronic recalls MiniMed insulin pump models for cybersecurity risks

Medtronic is recalling certain MiniMed insulin pumps due to cybersecurity vulnerabilities identified in the device, and the FDA is recommending patients using the recalled models switch to pumps that are “better equipped to protect against potential risks,” according to an FDA press release.

The recalled pumps are Medtronic’s MiniMed 508 insulin pump and MiniMed Paradigm series insulin pumps, according to the FDA. The potential risks are related to the wireless communication between Medtronic's MiniMed insulin pumps and other devices such as blood glucose meters, continuous glucose monitoring systems, the remote controller and CareLink USB device used with these pumps. The FDA noted that someone other than a patient, caregiver or health care provider could potentially connect wirelessly to a nearby MiniMed insulin pump and change the pump’s settings. This could allow a person to over deliver insulin to a patient, leading to hypoglycemia, or, to stop insulin delivery, leading to hyperglycemia or diabetic ketoacidosis.

In the release, Suzanne Schwartz, MD, MBA, deputy director of the Office of Strategic Partnerships and Technology Innovation, stated that the FDA is not aware of any confirmed reports of patient harm related to these potential cybersecurity risks.

“The FDA urges manufacturers everywhere to remain vigilant about their medical products — to monitor and assess cybersecurity vulnerability risk, and to be proactive about disclosing vulnerabilities and mitigations to address them,” said Schwartz, also acting division director for All Hazards Response, Science and Strategic Partnerships in the FDA’s Center for Devices and Radiological Health. “This is part of the FDA’s overall effort to collaborate with manufacturers and health care delivery organizations — as well as security researchers and other government agencies — to develop and implement solutions to address cybersecurity issues throughout a device’s total product life cycle.”

Medtronic is providing alternative insulin pumps to patients with enhanced built-in cybersecurity capabilities. In the U.S., Medtronic has identified 4,000 patients who are potentially using insulin pumps that are vulnerable to this issue, the FDA stated. In addition, Medtronic is working with distributor partners to identify additional patients potentially using these pumps.

The remote controller and CareLink USB, a thumb-sized wireless device that plugs into a computer, are used with the affected insulin pumps. A patient can use the remote controller to send insulin bolus commands to the insulin pump remotely and can use the CareLink USB to download data about their glucose levels from their insulin pump to monitor their own progress and share it with their health care provider.

Medtronic is unable to adequately update the MiniMed 508 and Paradigm insulin pumps with any software or patch to address the devices’ vulnerabilities. The FDA said it is working to assure that Medtronic addresses this cybersecurity issue, including helping patients with affected insulin pumps switch to newer models with better cybersecurity controls. The FDA will keep the public informed if significant new information becomes available. – by Regina Schaffer

Disclosure: Schwartz is deputy director of the Office of Strategic Partnerships and Technology Innovation at the FDA.