Hospitals, clinics and other users of Hospira Inc.'s Symbiq infusion pumps have been asked to pull the plug on the systems or update them with a temporary patch. This comes as the firm transitions to newer, safer pumps because the system was discovered to be vulnerable to cybersecurity attacks that could put patient lives at risk.

FDA issued a safety communication to the public July 31 warning against the use of Symbiq and urging users to immediately cease using the device (if possible) in order to prevent malicious hackers from breaking into the infusion pumps and either overdosing or underdosing patients.

"Hospira and an independent researcher confirmed that Hospira’s Symbiq Infusion System could be accessed remotely through a hospital’s network," FDA said in its alert. "This could allow an unauthorized user to control the device and change the dosage the pump delivers, which could lead to over- or under-infusion of critical patient therapies."

That independent researcher, Billy Rios, a San Francisco-based security analyst and blogger, has been writing about potential vulnerabilities with Hospira's infusion pumps for more than a year and has alerted the government about the problem, according to his blog. Rios says, as a result of his warnings and those of Hextech Security researcher Jeremy Richards, FDA issued a safety communication for Hospira's LifeCare PCA3 and PCA5 infusion pumps in May.

FDA now says that it – along with Hospira and the Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) – has become aware of the security risk posed by the Symbiq system that uses a wired or wireless Hospital Information System (HIS) to communicate over a hospital network.

While the agencies and the manufacturer are still investigating the threat, they emphasize they have not recorded any incidents so far where the vulnerability was used to change patient dosages.

"The FDA and ICS-CERT became aware of this particular concern in June 2015. ICS-CERT immediately issued a safety advisory with information on the Symbiq Infusion System that indicated this system could be accessed remotely and manipulated to start and stop the device, or change infusion pump settings," FDA spokesperson Angela Stark said. "Shortly thereafter, the FDA was able to verify the claims with both the company and the independent researcher who made the information public."

Hospira stopped making Symbiq pumps in 2013 "due to unrelated issues" according to FDA and Hospira says it has been working with users of the system to transition to other devices over the past few years. However, neither the regulators nor the company would explain what those "issues" were.

"Hospira has been working with the Department of Homeland Security and the Food and Drug Administration as we have become aware of reported vulnerabilities to illegal attacks on infusion pumps," said company spokesperson Tareta Adams in an email to The Gray Sheet." Hospira has also been working with customers for more than a year to further enhance infusion pump cybersecurity and address vulnerabilities reported that have not been seen in a clinical setting."

In February 2013, FDA did expand a ban on imports of Symbiq along with other Hospira pumps Plum A+ and LifeCare PCA that were manufactured at the company's plant in La Aurora de Heredia, Costa Rica, after the agency found major good manufacturing practice (GMP) violations. That ban was finally lifted earlier this year by FDA. (See [A#01150112015].)

Hospira says that despite the vulnerability of its Symbiq pumps, exploiting such vulnerabilities requires penetrating several layers of network security – including firewalls – that are typically part of hospital networks.

"These measures serve as the primary defense against tampering with medical devices," the company said in a release. "The cybersecurity protections on infusion pumps add an additional layer of security and play a critical role in providing safe and effective patient care."

However, Hospira did not comment on how attacks from within hospital networks could potentially be used to bypass institutional firewalls to break into the pumps. For now the company says it is continuing with its previously announced global device strategy to remove the Symbiq system from the market and encourage providers to replace them with newer systems.

"With the company's global device strategy announced in 2013, Hospira took a proactive approach to enhancing our device portfolio. Cybersecurity is one of many areas we've strengthened in developing new infusion pumps," the firm said.

"For example, our next-generation infusion systems –the Plum 360 (now available and recently FDA-cleared) and the LifeCare PCA 7.0 infusion system (pending FDA clearance) –were designed with further cybersecurity protections in place."

Adams says the company has been working with its customers for more than a year to enhance cybersecurity protections on their infusion pumps but have not so far seen exploits of the vulnerabilities in clinical settings.

"I can tell you that the number of sites using the pump is limited, since Hospira announced the retirement of the pumps two years ago," she added. "We expect the Symbiq device to be completely retired by the end of this year."

Hospira says the cybersecurity vulnerability is unique to its Symbig system and it is working with clients to update their LifeCare PCA or Plum A+ systems to fix any potential cybersecurity vulnerabilities.

For Symbiq users who are unable to switch to newer and safer infusion pumps the company has provided a patch update to close access ports to the device and add additional cybersecurity measures to prevent a potential attack. The company says it will provide another layer of security for users whose Symbiq pumps stay on the market for another few months.

-- This article was updated Aug. 4 to include comments from Hospira spokesperson Tareta Adams.

FDA Warns Of Hacking Threat From Hospira's Symbiq

More from Regulation

More from Policy & Regulation