title: Security and privacy qualities of medical devices: an analysis of FDA postmarket surveillance.
abstract: BACKGROUND
  Medical devices increasingly depend on computing functions such as wireless communication and Internet connectivity for software-based control of therapies and network-based transmission of patients' stored medical information. These computing capabilities introduce security and privacy risks, yet little is known about the prevalence of such risks within the clinical setting.
  
  
  METHODS
  We used three comprehensive, publicly available databases maintained by the Food and Drug Administration (FDA) to evaluate recalls and adverse events related to security and privacy risks of medical devices.
  
  
  RESULTS
  Review of weekly enforcement reports identified 1,845 recalls; 605 (32.8%) of these included computers, 35 (1.9%) stored patient data, and 31 (1.7%) were capable of wireless communication. Searches of databases specific to recalls and adverse events identified only one event with a specific connection to security or privacy. Software-related recalls were relatively common, and most (81.8%) mentioned the possibility of upgrades, though only half of these provided specific instructions for the update mechanism.
  
  
  CONCLUSIONS
  Our review of recalls and adverse events from federal government databases reveals sharp inconsistencies with databases at individual providers with respect to security and privacy risks. Recalls related to software may increase security risks because of unprotected update and correction mechanisms. To detect signals of security and privacy problems that adversely affect public health, federal postmarket surveillance strategies should rethink how to effectively and efficiently collect data on security and privacy problems in devices that increasingly depend on computing systems susceptible to malware.
authors: Department of Medicine, Beth Israel Deaconess Medical Center, Harvard Medical School, Boston, Massachusetts, USA. dkramer@bidmc.harvard.edu
authors: Daniel B
authors: DB
authors: Kramer
authors: Matthew
authors: M
authors: Baker
authors: Benjamin
authors: B
authors: Ransford
authors: Andres
authors: A
authors: Molina-Markham
authors: Quinn
authors: Q
authors: Stewart
authors: Kevin
authors: K
authors: Fu
authors: Matthew R
authors: MR
authors: Reynolds
mesh_terms: D016494:Computer Security / Q000331:legislation & jurisprudence / Q000592:standards*; D016208:Databases, Factual; D033161:Government Regulation; D006801:Humans; D018907:Privacy; D014481:United States; D014486:United States Food and Drug Administration