Using Telemetry to Ensure Safe and Reliable Medical Device Operation: Experience with Defibrillators and Infusion Pumps

Abstract

Most medical product regulations focus on premarket activities, to assure that innovative health care tools enter the market only after their risks and benefits have been assessed. However, those products must also be monitored after market entry to ensure that they remain safe and effective over time. A special set of risks and opportunities exist for electronic devices that can transmit data by telemetry. Such devices are vulnerable to mechanical problems, software errors or cyber-attack but these risks can often be monitored and mitigated using telemetered data to trigger corrective actions. This exploratory study assessed how device telemetry is currently being collected and monitored by defibrillator and infusion pump companies to ensure the safe and effective operation of their devices. A survey was designed based on a modified implementation framework and was disseminated to medical device industry professionals involved in different aspects of product development or field operations. The results from this survey indicate that many manufacturers are monitoring performance aspects of their products using telemetry data without specific requirements from regulators. However, adoption of this capability is not universal. Further, telemetered data appears to be rarely used to detect cyber intrusions, despite much regulatory attention to this vulnerability. Results suggest that regulators could add value by clarifying and perhaps expanding their expectations related to device telemetry usage related to risk management, cybersecurity and post-market surveillance.