Insulation Failure, Battery Failure and Cyber Hacking - A Triple Threat for Pacemaker Patients

August 24, 2017, 7:00PM. By Anne Wallace

Washington, DC: Premature insulation failure in recalled St. Jude Medical Riata defibrillator (ICD) leads may be only the tip of the iceberg for heart patients with ICDs, more commonly known as “pacemakers.”

In 2011 St. Jude Medical Inc. recalled the electrical leads used to connect the Riata pacemaker to patients’ hearts because of flaws in the protective insulation. Failure of the insulation on an electrical lead can cause a pacemaker to deliver inappropriate stimulation to the user’s heart. For cardiac patients with abnormal heart rhythms, the disruption can be fatal. In addition, the exposure of the electrical lead has been linked to polymicrobial endocarditis, a serious bacterial infection of the heart. St Jude stopped marketing the defective leads in 2010, but thousands remain implanted in chests of patients in the United States.

The problems with St. Jude ICDs aren’t limited to the electrical leads. In 2016, the FDA issued a safety warning about the lithium batteries used to power them.

The ICDs are designed to alert patients to seek medical intervention to replace the battery approximately three months before it fails. St Jude has reported, however, that deposits of lithium, known as “lithium clusters,” can form within the battery, creating abnormal electrical connections that cause the battery to fail quickly. In some cases, full battery drainage has occurred in as a little as a day, leaving the patient with little or no time to get medical attention.

Finally, cybersecurity researchers at the University of Leuven in Belgium and the University of Birmingham in England have reported that they were able to successfully hack into ten different ICDs using relatively inexpensive, easily obtainable electronic components and a radio antenna.

In January 2017, the FDA warned that vulnerabilities in St. Jude Medical's ICDs might allow a hacker to deplete the battery or administer incorrect pacing or shocks. The hacker’s access point is a remote device programmer, intended to allow doctors and other medical professionals to adjust the settings on the pacemaker from up to five meters away.

St. Jude thereafter developed a patch to fix the devices’ susceptibility, but a later FDA warning letter suggests that the patch, itself, has not been adequately tested.

Patients who have an ICD manufactured by St. Jude Medical, Inc. would do well to seek medical advice about their risks and options.