Medtronic MiniMed Insulin Pump: “MaxiRisk”

Washington, DCWhile most Americans with type 1 or type 2 diabetes can control their condition with medication, those with more serious and debilitating forms of diabetes require constant monitoring, together with regular infusions of insulin to not only keep their blood glucose at appropriate levels, but to also keep them alive. Such functions, in recent years, have increasingly fallen within the purview of medical devices designed to monitor and infuse as needed, silently and automatically. However, the presence of a Medtronic lawsuit - two, in fact - suggests underlying problems that allegedly are costing people their lives.

The two Medtronic Insulin Pump lawsuits allege failure of the devices to properly warn patients of an imbalance in their blood glucose levels, together with failure to administer the correct amount of insulin at critical periods to correct the imbalance. To a patient suffering from diabetes mellitus, such a correction performed accurately and properly timed is a key to survival.

In each Medtronic Insulin Pump lawsuit, there was a death. The mother of one of the victims and the executrix of the estate of the other victim are suing Medtronic for negligence. Allegations in each Medtronic lawsuit include lapses in good manufacturing practices and inadequate testing protocol.

And now there is a new wrinkle: the potential for device software to be hacked, further limiting the device’s integrity, or so it is alleged. According to the San Fernando Valley Business Journal (3/21/16), a former employee of IBM Corp., who served as a senior threat intelligence analyst while working for “Big Blue,” managed to hack into his own insulin pump and was able to manipulate levels of insulin delivered by the pump to his body at levels that could be potentially fatal.

The hacker, identified as Jay Radcliffe, is reported to have presented his findings at the Black Hat security conference in Las Vegas in 2011 without identifying the manufacturer, only to later reveal the manufacturer as Medtronic, and referencing four of its insulin pumps.

The report did not specifically break out what the four models were, and Radcliffe acknowledged that the probability of someone actually hacking into an insulin pump for sinister purposes is low, but he remains concerned so long as the capability is there.

And if the two plaintiffs in their respective Medtronic Insulin Pump lawsuits are already citing departures from good manufacturing practices and poor testing protocols, what related vulnerabilities might emerge at the software level?

The US Food and Drug Administration (FDA) has already taken Medtronic to task for violations in quality control protocols at Medtronic’s manufacturing facility located in Puerto Rico. Additionally, it was three years ago this month that Medtronic and the FDA issued a Class 1 Recall of Medtronic MiniMed Paradigm Insulin Infusion Sets over concerns that the pumps had the “potential for over or under delivery of insulin if insulin or other fluids contact the inside of Medtronic Paradigm Tubing Connectors,” effectively blocking vents integral for the priming function of the pump.

A similar recall in July of 2009 affected certain lots of the Medtronic MiniMed Paradigm insulin pumps that failed to properly vent air pressure integral to the accuracy of the pump. Over- or under-delivery of insulin could foster hypoglycemia or hyperglycemia, both of which can be fatal.

One of the current Medtronic Insulin Pump lawsuits alleges that the MiniMed pump worn by Charles Slack Jr. failed to deliver the appropriate dose of insulin while Slack was asleep, and failed to alert Slack that a life-threatening issue may have been developing. The victim was discovered hours later, lying unconscious in his urine-soaked bed. Remaining in a coma for several weeks, Slack ultimately did not survive. Amongst the allegations brought against the defendant by the executrix of Slack’s estate, were that Medtronic relied on underqualified individuals having only completed high school to test the device. It is alleged that these individuals failed to follow strict testing procedures and protocols when determining the safety and reliability of the device.

The Medtronic lawsuit is Hassan v. Medtronic MiniMed Inc. et al, Case No. 3:15-cv-2788, US District Court for the District of New Jersey.