Imagine a computer hacker able to hijack a human body and disrupt the meticulous order of automatic bodily functions.
The idea sounds more like a science fiction story than a real life possibility. However, recent advancements in biomedical engineering led Mayo Clinic researchers Derek O’Keefe, M.B., B.Ch., B.A.O., Ph.D., Ananada Basu, M.D., and Yogish Kudva, M.D., to worry about previously unexplored complications that arise with medical technologies.
Mayo Clinic is collaborating with the University of Virginia, the William Sansum Diabetes Center, the University of California – Santa Barbara, and the University of Padua in Italy in developing an artificial pancreas to better manage type 1 diabetes. In type 1 diabetes, the pancreas produces an insufficient amount of insulin, the hormone that regulates blood sugar levels. The artificial pancreas will control patients’ blood sugar levels with less involvement from the patient, thus a form of semi-automated control.
As an electronic device, the artificial pancreas is, hypothetically, at risk for electromagnetic wave interference and wireless attacks. This susceptibility motivated a group of researchers, including Dr. Kudva, Dr. Basu, and Dr. O’Keefe, to write the article “Cybersecurity in Artificial Pancreas Experiments,” which was published online in Diabetes Technology & Therapeutics. In the article, the doctors urge funding agencies, researchers, and regulators to pay more attention to the cybersecurity of medical devices, specifically the artificial pancreas, and to support security testing in clinical trials.
Currently, patients with type 1 diabetes monitor their blood sugar levels by taking blood samples several times each day and then self-injecting the proper dose of insulin. The artificial pancreas devices, however, will automatically monitor glucose levels and deliver the necessary amount of insulin below the skin of the patient. This device has potential to free diabetic patients from the inconvenience of finger pricks and self-injections. Ideally, the patient would only be responsible for supplying the pump with insulin.
The artificial pancreas is a closed-loop system, which means that communication only exists between a glucose sensor and an insulin pump. “The device itself is like a Samsung Nexus phone, but doesn’t work as a phone: it works as an artificial pancreas hub. It’s easy to carry,” says Dr. Kudva. The sensor relays glucose levels to the control device, which in turn dispenses insulin below the skin. If, however, an outside signal could send the wrong glucose data to the handheld device, the resulting incorrect dose could be dangerous and even fatal.
The U.S. Food and Drug Administration does not currently regulate the cybersecurity of medical devices. In October of 2014, the FDA called a conference on cybersecurity of medical devices, and sent out a news release that recommended manufacturers consider cybersecurity risks while designing devices.
“There is no such thing as a threat-proof medical device,” said Suzanne Schwartz, M.D., M.B.A., director of the FDA Emergency Preparedness/Operations and Medical Countermeasures, in the news release. “It is important for medical device manufacturers to remain vigilant about cybersecurity and to appropriately protect patients from those risks.”
However, with two recent clinical trials involving 21 patients under their belt, the Mayo Clinic team is much more confident in the safety and dependability of the device. “My concern about sending patients home has progressively, over time, decreased,” says Dr. Kudva. The research of others has also boosted his confidence. Clinics around the world have developed artificial pancreases and completed their own clinical trials. “Patients [collectively] have had more than 580 days on the system around the world and it seems to be quite safe,” he says. Once the device receives FDA approval, Dr. Kudva says clinical providers could offer it to patients, but tracking patient use post-marketing would still be important.
The next step for the Mayo team is a third clinical trial. This time, patients will be observed for three nights, and can then take the artificial pancreas home for two weeks. Dr. Kudva says he hopes that future trials may include ‘extension periods,’ in which patients are allowed to use their devices longer than the official clinical trial periods. This trial design is being increasingly pursued. Dr. Kudva says that in the artificial pancreas clinical trials, patients are appreciative. He says, “When the control is given to a system that seems to work reasonably well, they’re really grateful.”
July 20, 2015