Dive Brief:
- Johnson & Johnson has started a Class I recall in response to the cybersecurity vulnerabilities of its automated Impella heart pump controllers.
- The Food and Drug Administration published a notice about the recall on Friday, nine days after J&J’s Abiomed unit told customers about a problem that could result in life-threatening injuries.
- No cyberattacks or harm to patients have been reported. The devices are staying on the market, with Abiomed working to disable the controllers’ network capabilities to mitigate the risks.
Dive Insight:
The FDA called the cybersecurity vulnerabilities an “unacceptable residual risk related to network and physical access.” If exploited, the vulnerabilities could result in “uncontrolled risks” affecting the device operating system, the agency said, and may affect the essential performance of the controllers. Abiomed used the same wording in its letter to customers.
J&J’s heart pump unit and the FDA both said the vulnerabilities “may potentially result in loss of device control or unexpected pump stop.” The problems could result in life-threatening injury, permanent impairment or death. While no patients have been harmed, the FDA categorized Abiomed’s action as a Class I recall because of the potential for serious injury or death.
Abiomed found the vulnerabilities through internal routine cybersecurity risk assessments. All the vulnerabilities affect the operating system within the controller and do not extend beyond the console itself. Abiomed has not identified any risks to hospital networks.
The findings led the J&J unit to tell customers to keep the affected controllers in a secure environment with restricted access whether in clinical use or not. Field representatives for Abiomed are contacting customers to arrange to disable the devices’ network capabilities. Customers can disable the capabilities themselves if they contact J&J for instructions.
Abiomed said it is working on security updates and measures to fix the cybersecurity vulnerabilities. The company plans to provide more information when it is ready to deploy its fixes and reconnect devices to the network.
The recall affects the same five products as the early alert that the FDA published last month. The early alert covered potentially fatal purge pressure issues linked to five serious injuries. FDA officials published early alerts about other issues with the controllers in July and August.
