MedFusion 4000 (infusion pump)

2022: Smiths Medical recalls defective syringe infusion pumps after death data due to them

In late July 2022, Smiths Medical announced the recall of defective Medfusion 3500 and 4000 syringe infusion pumps after the company obtained data on trams and deaths due to these products.

According to the US Department of Health, in April 2022, Smiths Medical sent out a letter to customers about urgent adjustments to medical equipment. Medfusion 3500 and 4000 syringe infusion pumps suffer from eight potential software problems, the notice said. Some of these problems affect all versions of pumps 3500 and 4000, while others concern only some devices.

Smiths Medical recalls defective Medfusion 3500 and 4000 infusion pumps

The letter describes each of the eight issues and actions buyers should take in response to them. In most cases, Smiths Medical recommends that users take troubleshooting measures or avoid certain modes and actions, and in one case, the company asks customers to return the affected devices.

Smiths Medical is asking customers to return the devices if abnormal PCB behavior causes the pump to stop. Medfusion 3500 and 4000 pumps with specific serial numbers may contain printed circuit boards that may delay or interrupt therapy and thereby result in serious harm or death to the patient. As of April 19, 2022, Smiths Medical said it had not received reports of injuries or deaths related to the issue, but asked affected users to send their pumps for service.

According to the notification of the US Department of Health for July 2022, there are seven serious injuries and one death is associated with three problems. Two patients suffered serious injuries and one died after the system was falsely triggered. The pump stops the active infusion in the event of a system malfunction alarm. Unexpected alarms about battery depletion resulted in four serious injuries. The seventh serious injury occurred when the pump continued to operate after a system failure.^[1]

2020: Recall of defective models

In mid-August 2020, Smiths Medical began recalling Medfusion 3500 and 4000 infusion pumps. The company learned that models with certain firmware versions can serve the drug in excess or insufficient volume if the administration of the drug in the form of a bolus or a loading dose was accidentally interrupted. This software error can cause serious injury or death to the patient.

Error models ON include the Medfusion 3500 infusion pump with firmware version 6.0.0 and the Medfusion 4000 infusion pump with firmware versions 1.5.0, 1.5.1, 1.6.0, 1.6.1 and 1.7.0. The regulatory authorities noted that the recall of devices belongs to class I, the most serious, since the error threatens the patient's life. Smiths Medical distributed defective models on the market between 2013 and 2020. The company received four reports related to the issue, all of which involved drug overdoses. In one case, excessive administration resulted in serious injuries. No deaths were reported.

Smiths Medical recalls infusion pumps that inject too many drugs

Smiths Medical reminds that the firmware version of the existing infusion pump can be determined when the device is turned on, since the version should be displayed on the screen. Dosing error may occur when the operator: (1) programs bolus or loading dose administration, (2) initiates bolus or loading dose administration, (3) interrupts bolus or loading dose administration, (4) starts the infusion pump, and (5) resumes bolus or loading dose administration instead of starting a new infusion. Therefore, doctors and nurses are advised to cancel the administration of bolus or loading doses, and if the device interrupted the administration of the drug, you should stop the automatic supply and start a new infusion.^[2]

2017: Vulnerability Detection

Independent information security expert Scott Gayou has identified eight serious vulnerabilities in MedFusion 4000 wireless infusion pumps, BBC News reported on September 12, 2017.^[3]

Equipment manufactured by the American company Smiths Medical is used in hospitals around the world for the dosing of liquid drugs into the human body. MedFusion 4000 infusion pumps are also used during operations and in neonatal intensive care units.

MedFusion 4000 infusion pump

The vulnerabilities discovered by the expert allow hackers to gain remote access to the device and affect its operation, for example, to change the dosage of drugs administered to the patient. It is also noted that attackers can disrupt the normal functioning of the communication and therapeutic modules of the pumps.

In connection with the findings of Scott Guy, a group of computer security specialists from the ICS-CERT organization under the Ministry of Homeland Security USA issued a warning.^[4]

Although the ministry noted that cases of unauthorized access to MedFusion 4000 infusion pumps are unknown, hospitals are advised to assess the risks associated with the use of these devices. The warning applies to Medfusion 4000 Wireless Syringe Infusion Pump, v.1.1, 1.5 and 1.6 models.

Smiths Medical plans to fix the flaws in January 2018 by releasing updated software for the device (firmware 1.6.1). According to the manufacturer, the risk that vulnerabilities can be exploited by hackers to cause harm is very small, since this requires a number of difficult and unlikely conditions.

Before the release of the update, which will fix the vulnerabilities, the company made recommendations for changing the settings of infusion pumps to limit the likelihood of unauthorized access.

Notes