In another blow to patient confidence in pacemakers and defibrillators, Keith Weinstein of the WSJ report in Heart-Device Hacking Risks Seen, that physicians studying the vulnerability of pacemakers and defibrillators have demostrated that such devices may be prone to cyber-attacks, or hacks, that could potentially compromise patient privacy, or even worse patient safety. A massive Medtronic defibrillator recall and Boston Scientific / Guidant Pacemaker recall in 2005 has played an impoortant role in raising concerns regarding heart device safety.
According to the report, Physicians use a device called a “Programmer” to communcate with the device wirelessly. The Programmer allows the Dr. to tell the device at what rate to pace a heart, and when to send what should be life saving charges to start a heart that has fallen into a fatal arrythmia.
According to the researchers, computer hackers could transmit the same radio signals used by the programmers to a patient’s device and potentially cause a defibrillator to shock or shut down, or reveal confidential patient data.
The study, urges Medtronic, Boston Scientific, and St. Jude to develop secure methods to “stop unauthorized people from hacking into the implanted medical devices that receive instructions via radio waves, a growing category that also includes spinal-cord stimulators and drug-delivery pumps.”
“This report demonstrates that you can obtain private information without authorization. You can reprogram the device without authorization,” according to William Maisel,from Harvard. Dr. Maisel further stated “our report is a theoretical risk, not an actual risk” and said there was no reason for anybody to consider deferring an implantation or removing a defibrillator.
“I find it absolutely terrifying, the idea of having computer-controlled devices implanted in us,” said Aviel Rubin, a professor of computer science at Johns Hopkins University who wasn’t involved in the research. “If you can imagine what you might do in a very busy area, sending out a signal that would cause all of the people in the local area’s implanted devices to start operating incorrectly, it’s a really scary future we’re headed towards.”
According to the WSJ report, Dr. Maisel and his collaborators — Kevin Fu of the University of Massachusetts, and Tadayoshi Kohno of the University of Washington, both computer-science professors — emphasized that the findings are as yet limited to one model of defibrillator made by Medtronic, the Medtronic Maximo, which was subject to a previous Medtronic recall related to a defective medtronic battery.
