  |
LifeCare PCA3 and PCA5 Infusion Pump Systems by Hospira: FDA Safety Communication - Security Vulnerabilities
AUDIENCE:Pharmacy, Nursing, Risk Manager, Engineering
ISSUE: The FDA and Hospira have become aware of security vulnerabilities in Hospira’s LifeCare PCA3 and PCA5 Infusion Pump Systems. An independent researcher has released information about these vulnerabilities, including software codes, which, if exploited, could allow an unauthorized user to interfere with the pump’s functioning. An unauthorized user with malicious intent could access the pump remotely and modify the dosage it delivers, which could lead to over- or under-infusion of critical therapies. The FDA is not aware of any patient adverse events or unauthorized device access related to these vulnerabilities.
The FDA is actively investigating the situation based on current information and close engagement with Hospira and the Department of Homeland Security. As new information becomes available about patient risks and any additional steps users should take to secure these devices, the FDA will communicate publicly.
BACKGROUND: The Hospira LifeCare PCA3 and PCA5 Infusion Pump Systems are computerized infusion pumps designed for the continuous delivery of anesthetic or therapeutic drugs. These systems can be programmed remotely through a health care facility’s Ethernet or wireless network.
RECOMMENDATION:
Recommendations for Health Care Facilities:
- Follow the recommendations from the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) of the U.S.Department of Homeland in the May 13, 2015 Advisory Hospira LifeCare PCA Infusion System Vulnerabilities (Update A).
- Perform a risk assessment by examining the specific clinical use of the Hospira LifeCare PCA Infusion Pump System in your organization’s environment to identify any potential impacts of the identified vulnerabilities.
- Look for and follow risk mitigation strategies outlined in an upcoming letter from Hospira to its customers. Customers can access the instructions and other risk mitigation measures via Hospira’s Advanced Knowledge Center.
- Follow the good cybersecurity hygiene practices outlined in the FDA Safety Communication Cybersecurity for Medical Devices and Hospital Networks, posted in June 2013.
Refer to the FDA Safety Alert for detailed recommendations including a link to the ICS-CERT.
Healthcare professionals and patients are encouraged to report adverse events or side effects related to the use of these products to the FDA's MedWatch Safety Information and Adverse Event Reporting Program:
Complete and submit the report Online: www.fda.gov/MedWatch/report.htm
Download form or call 1-800-332-1088 to request a reporting form, then complete and return to the address on the pre-addressed form, or submit by fax to 1-800-FDA-0178
You are subscribed to MedWatch Safety Alerts for U.S. Food & Drug Administration (FDA). This information has recently been updated, and is now available.
Read the MedWatch safety alert, including links to the FDA Safety Communication, at: http://www.fda.gov/Safety/MedWatch/SafetyInformation/SafetyAlertsforHumanMedicalProducts/ucm446828.htm
You are encouraged to report all serious adverse events and product quality problems to FDA MedWatch at www.fda.gov/medwatch/report.htm
Update your subscriptions, modify your e-mail address, or stop subscriptions at any time on your Subscriber Preferences Page. You will need to use your email address to log in. If you have questions or problems with the subscription service, please visit subscriberhelp.govdelivery.com.
This service is provided to you at no charge by U.S. Food & Drug Administration (FDA).
| This email was sent to list-fda@xxxxxxxxxxx using GovDelivery, on behalf of: U.S. Food & Drug Administration (FDA) · 10903 New Hampshire Ave · Silver Spring, MD 20993 · 800-439-1420 |  |
