“Your firm identified the hard-coded universal unlock code as a risk control measure for emergent communication. However, you failed to identify this risk control also as a hazard. Therefore, you failed to properly estimate and evaluate the risk associated with the hard-coded universal lock code in the design of your High Voltage devices,” noted the FDA.

The company's written response to these FDA findings was rejected by the agency, according to the Star Tribune. The company must now outline to the FDA the measures it will take to correct the issues with the devices.


In January, St. Jude Medical announced that its implantable cardiac devices were getting software fixes.

Calling the risk of such an exploit “extremely low,” St. Jude Medical stated at the time that, “in recognition of the changing cyber security landscape and the increased public attention on highly unlikely medical device cyber risks, we are informing the public about these ongoing actions so that patients can continue to be confident about the benefits of remote monitoring.”

The company took the step preemptively, St. Jude Medical’s Cyber Security Medical Advisory Board advisor, Ann Barron DiCamillo, said in a statement.

“We’ve partnered with agencies such as the U.S. Food and Drug Administration (FDA) and the U.S. Department of Homeland Security Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) unit, and are continuously reassessing and updating our devices and systems, as appropriate,” said Phil Ebeling, vice president and chief technology officer at St. Jude Medical.

Back to HCB News

Business Affairs Homepage