MV TELEGRAPH

A blood glucose control system using a smartphone and a meter that attaches to the skin.

Ute Grabowsky | photo library | Getty Images

The Internet of Things for remote monitoring and management of common health issues is growing, led by diabetes patients.

About one in ten Americans, or 37 million people, are living with diabetes. Devices like insulin pumps, which are decades old, and continuous glucose meters, which monitor blood glucose levels 24/7, are increasingly being connected to smartphones via Bluetooth. The increased connectivity brings many benefits. People with type 1 diabetes have much better control of their blood sugar levels because they can review weeks of blood sugar and insulin dosing data, making it easier to spot trends and fine-tune dosing. In recent years, diabetes patients have become so adept at remote monitoring that a DIY community of patient hackers have been manipulating devices to better manage their medical needs, and the medical device industry has learned from them.

But the ability to monitor medical conditions over the internet comes with risks, including nefarious hacking. Although medical devices that must go through FDA approval meet a higher standard than fitness equipment, there are still risks to protecting patient data and accessing the device itself. The FDA has regularly warned about the vulnerability of medical devices like insulin pumps to hackers , and product manufacturers have issued recalls related to vulnerabilities. In September that happened to me MedtronicThe MiniMed 600 series insulin pump, which the company and the FDA have warned about, has a potential issue that could allow unauthorized access, putting the pump at risk of delivering too much or too little insulin.

Sleep apnea, type 2 diabetes and remote medical care

Not only in diabetes, the medical device market offers patients new benefits of remote monitoring. For sleep apnea, which is estimated to affect up to 30 million Americans (and a billion people worldwide), C-PAP devices can now store and send data to healthcare providers without the need for a doctor’s visit.

The number of internet-connected medical devices grew during the pandemic as lockdowns sparked a major push towards treating people at home. As the number of virtual care visits increased, “it opened everyone’s eyes to medical devices used in the home to remotely monitor patients,” said Gregg Pessin, Gartner’s senior director of research.

Steady sales of continuous glucose monitors and insulin pumps have helped companies like Dexcom, IsolateMedtronic and Abbott Laboratories, and diabetes tech device sales are expected to increase. According to the Centers for Disease Control and Prevention, in addition to the 37 million people in the US who have diabetes, there are an estimated 96 million adults who are prediabetic. Manufacturers of continuous glucose meters and insulin pumps, which have been the standard of care for type 1 diabetes for years, are increasingly targeting type 2 diabetes patients as well.

Multiple forms of medical cybersecurity risk

Industry security experts categorize the cybersecurity risks of medical devices into three areas.

First, there is the risk to patient data. Many medical devices, such as insulin pumps, require patients to create online accounts in order to download data to a computer or smartphone. These accounts can contain sensitive information, not just sensitive health information but also personal details like social security numbers.

Another risk is to the medical device itself, as evidenced by headlines about the risk that hackers could break into a medical device like Medtronic’s pump and change the dosage settings, with potentially fatal consequences. A report from Unit 42, a cybersecurity company that is part of Palo Alto Networks, found that 75% of infusion pumps – including insulin pumps – had “known security vulnerabilities” that put them at risk of being compromised by attackers. May Wang, chief technology officer of Internet of Things security at Palo Alto Networks, said that in a laboratory experiment, hackers gained access to infusion pumps and changed the dosage of drugs. “So now cybersecurity isn’t just about privacy, it’s not just about data leakage. It’s more of a matter of life or death,” she said.

But Gartner’s Pessin said such risk is small in the real world. Under the controlled conditions of a lab, “it’s only a matter of time before you’ll be able to do it,” but in the real world, “it would be much more difficult,” he said.

A Medtronic spokeswoman said the company designs and manufactures medical technology to be as safe as possible, and its global product safety office continuously monitors safety products throughout their lifecycle. The company also monitors the cybersecurity landscape to address vulnerabilities and “take action to protect patients through a coordinated disclosure process and security bulletins.”

In September, Medtronic communicated to users how to eliminate the risk of accidental insulin delivery by disabling the ability to remotely dose from a separate device.

The third cybersecurity risk is the connection between the medical device and the network, be it WiFi or 5G. As medical devices become more connected, they pose an increased risk of malware, a risk that is well known in other industries and could soon emerge in healthcare as well. Wong pointed to a 2014 case where Target leaked sensitive customer data after installing a malware-infected HVAC system.

While there have not yet been any known instances of this happening from medical devices used at home, it could be a matter of time and older devices that are not regularly updated are at greater risk. In hospitals, legacy operating systems have left some medical devices vulnerable to attack. Some medical imaging systems, which can have a life cycle of over 20 years, are still running on Windows 98 without security patches, and there have been incidents where MRI scanners or X-ray machines have been hacked to perform crypto mining operations without any publicity was healthcare provider.

regulation of devices

Legislators and healthcare leaders are pushing for more guidance and regulation on medical device safety.

Last April, senators introduced the PATCH Act to require medical device manufacturers seeking FDA approval to meet certain cybersecurity requirements and maintain updates and security patches. More recently, the $1.65 trillion Omnibus Appropriations Act passed in late 2022 included new cybersecurity requirements for medical devices. Experts said the law’s provisions do not go as far as the requirements of the PATCH Act, but are nonetheless significant.

An FDA spokesman told CNBC that the new cybersecurity provisions in the omnibus act represent a significant step forward in FDA’s oversight of cybersecurity as part of a medical device’s safety and efficacy. Among other things, manufacturers must implement vulnerability disclosure plans and processes. Device manufacturers are also required to provide timely updates and security patches to devices and associated systems for “critical vulnerabilities that pose an uncontrolled risk.”

How to stay in control as a consumer

As doctors increasingly prescribe glucose meters and insulin pumps not only for type 1 diabetes but also for the much more common type 2 diabetes, consumers weighing whether or not to use such a device can first check the manufacturer’s website Seek cybersecurity statements and HIPAA compliance to protect their private health information. They can also question their doctors about safety, although cybersecurity experts say there is still work to be done to increase awareness of these risks among healthcare providers.

Consumers with an internet-connected medical device should register with the manufacturer to ensure they are informed of security updates. Maintaining basic cyber hygiene at home is also crucial as many devices are now connecting to WiFi. Make sure the WiFi network is protected with a strong password and also use a strong company website username and password when sharing or downloading data. More and more consumers are now also choosing to use a password manager to store all their internet login information. Because WiFi allows devices to interact with other devices, make sure laptops and phones are secure at home too.

Martin Shkreli, former CEO of Turing Pharmaceuticals AG, center, pauses as he speaks with members of the media with his attorney Benjamin Brafman (right) outside federal court in the borough of Brooklyn, United States, Friday, August 4. 2017

Peter Foley | Bloomberg | Getty Images

The Federal Trade Commission on Friday demanded that notorious “pharmaceutical brother” Martin Shkreli be tried for founding a new pharmaceutical company in defiance of the judge’s ban on the convicted fraudster from working in the pharmaceutical industry.

Shkreli, who was released from prison last year, was “banned directly or indirectly for life” in February.
involvement in any way in the pharmaceutical industry” as a result of the FTC’s antitrust lawsuit against him and a previous pharmaceutical company he founded.

That order followed Manhattan Federal Court Judge Denise Cote’s January 2022 decision that Shkreli oversaw an illegal scheme to maintain a monopoly on the life-saving drug Daraprim, which continued even as he was being sued for his conviction in an independent case of securities fraud in prison.

In its Friday court filing, the FTC noted that Shkreli had announced in July the formation of a new company called Druglike “which appears to be engaged in the pharmaceutical industry.”

The filing cited Druglike’s press release accompanying the announcement, which described the company as “a Web3 drug discovery software platform co-founded by Martin Shkreli.”

The FTC said the formation of the company, as well as Shkreli’s failure to pay his nearly $25 million share of a $64.6 million judgment he is owed in the lawsuit, indicate that he violated the orders of the court in this case.

The FTC and a group of states that have sued Shkreli said in the filing that he failed to comply with their requests to give them documents and submit to an interview as part of their investigation into whether his involvement in Druglike violated the order the Cote fails to ban him from the country industry.

The FTC said Shkreli was required by Cote’s order to provide the agency with that information.

“Martin Shkreli’s failure to comply with the court’s order demonstrates a clear disregard for the law,” Holly Vedova, director of the FTC’s competition bureau, said in a statement.

“The FTC will not hesitate to use the full extent of its agencies to facilitate a full investigation of possible wrongdoing,” Vedova said.

Benjamin Brafman, an attorney for Shkreli, declined to comment on the FTC application.

Shkreli gained widespread infamy in mid-2015 when his pharmaceutical company, now known as Vyera Pharmaceuticals, uncompromisingly increased the price of Daraprim, an antiparasitic drug used to treat pregnant women, babies and people living with HIV, by more than 4,000% to $17.50 per pill to $750.

In December 2015, federal prosecutors in Brooklyn, New York, criminally charged Shkreli with misleading investors in two hedge funds he previously ran and manipulating the stock of another company he founded, Retrophin, which is now known Travere Therapeutics.

Shkreli was convicted on multiple counts in that case in mid-2017. His $5 million post-trial bail was revoked weeks later after a judge offered his Facebook followers a $5,000 cash bounty if they provided him with hair samples of former Democratic presidential nominee Hillary Clinton .

Shkreli was sentenced to seven years in prison in 2018. He was released into a federal temporary shelter in May last year.

Shkreli was driven back to New York from his Pennsylvania prison by a friend, Edmund Sullivan, who had previously served on the board of Retrophin.

Sullivan is mentioned in court documents in Shkreli’s criminal case as one of seven people who, on Shkreli’s direction, received thousands of shares in a shell company that were used by Retrophin as a vehicle for its IPO. Sullivan was not charged with wrongdoing in the case.

Pro-abortion rights protesters protest outside the United States Supreme Court as the court rules in the Dobbs v. Women’s Health Organization abortion case, overturning the landmark Roe v. Wade abortion decision, in Washington, United States, June 24, 2022.

Jim Castle | Reuters

An investigation into the leak of a Supreme Court bombshell ruling overturning federal abortion rights — weeks before it was officially released — failed to identify the culprit, the court said Thursday.

The inconclusive end of the inquiry was further embarrassment for the Supreme Court, which described the leak as “one of the worst breaches of trust in its history” and “a grave assault on the judicial process”.

Investigators interviewed nearly 100 court officials in the investigation, 82 of whom had access to electronic or printed copies of Conservative Judge Samuel Alito’s draft majority opinion.

However, according to an official report, neither Alito nor the other eight judges of the court were observed during the investigation.

Politico reported on May 2 that it had received a leaked copy of an advisory opinion showing the Supreme Court was ready to overturn its five-decade-old ruling in the Roe v. Wade’s known case which found there was a constitutional right to abortion. This draft was first circulated among the judges of the court and their clerks on February 10.

After the leak, Chief Justice John Roberts directed Supreme Court Marshal Gail Curley to investigate the disclosure.

In June, the Supreme Court, in a majority opinion authored by Alito, said there was no federal right to abortion — just as the leak showed.

The opinion came in a case called Dobbs v. Jackson Women’s Health Organization, who challenged Mississippi’s restrictive abortion law.

The Supreme Court, in publishing Curley’s report on the inquiry Thursday, said: “In pursuing all available leads … the Marshal’s team conducted additional forensic analysis and conducted several follow-up interviews with certain employees.”

“But the team has not been able to identify anyone responsible through a preponderance of evidence,” the court said.

Curley’s 20-page report suggests the treat was almost certainly a member of the court staff.

She noted that “the investigation has shown that it is highly unlikely that any person outside the court accessed the court’s information technology (IT) systems unlawfully.”

Associate Justice Samuel Alito poses during a group photo of Supreme Court justices in Washington, April 23, 2021.

Erin Schaff | swimming pool | Reuters

Curley said investigators examined the court’s computer equipment, networks, printers and “available call and text logs.”

But “Investigators have found no forensic evidence to indicate who published the draft opinion,” Curley wrote.

She noted that her team of attorneys and federal investigators “conducted 126 formal interviews with 97 employees, all of whom declined to disclose comment.”

The report said that after initial interviews with court officials, each staffer was asked to sign an affidavit stating that they did not disclose Dobbs’ draft opinion to anyone not employed by the Supreme Court.

Some staffers admitted they told their spouses about the draft or the judges’ vote count in the case, the report said.

Curley also wrote that among other steps taken in the investigation, “the investigative team received outside assistance with a fingerprint analysis of an item relevant to the investigation.”

CNBC Policy

Read more about CNBC’s political coverage:

“This analysis revealed usable fingerprints but no matches to fingerprints of interest,” the report said, without disclosing the nature of the item examined.

Curley said several inquiries are pending in her investigation.

“To the extent additional investigations uncover new evidence or leads, investigators will pursue them,” she added.

In its statement, the Supreme Court said that after Curley’s investigation concluded, the court asked former federal judge, prosecutor and Secretary of Homeland Security Michael Chertoff to rule on the investigation.

Chertoff “has informed that the Marshal ‘conducted a thorough investigation’ and ‘[a]”At this time I cannot identify any additional useful investigative actions that have not been conducted or are ongoing,” the court said.

In her report, Curley wrote that the Covid-19 pandemic and the resulting increase in court staff’s ability to work from home “as well as gaps in the court’s security policies have created an environment where it has been too easy sensitive information to be removed from the building and the court’s IT networks.”

This, in turn, increases “the risk of both intentional and inadvertent disclosure of court confidential information,” the report said.

Curley wrote that “too many” court officials have access to sensitive documents and that there is “no universal written policy or guidance” to protect draft opinions.

She also asked the court to address weaknesses in the court’s current method of destroying sensitive documents. And she wrote that the court’s “information security guidelines are outdated and need to be clarified and updated.”