What We Can Infer about Year 2000 Exposure from Medical Devices That Failed on January 1, 1999: Comments on a Recent FDA Advisory
|TO:||Medical Professional Liability Clients and Friends|
|RE:||What We Can Infer about Year 2000 Exposure from Medical Devices That Failed on January 1, 1999: Comments on a Recent FDA Advisory|
|DATE:||January 7, 1999 (links updated October 21, 1999)|
At the end of 1998, the U.S. Food and Drug Administration (“FDA”) issued an interesting advisory concerning medical devices that we would like to share with those who may have missed it. The FDA’s Center for Devices and Radiological Health is in charge of the federal government’s efforts to help hospitals and other healthcare providers prepare for the possibility that medical devices will malfunction because of software errors related to the date rollover on January 1, 2000. It takes the position that, under existing law and regulation, the manufacturers of medical devices are obligated to report and correct all date-related defects that have the potential to endanger health. Its requirements for manufacturers are summed up in Guidance for Industry: Guidance on FDA’s Expectations of Medical Device Manufacturers Concerning the Year 2000 Date Problem, May 15, 1998, in the following words:
Under the Quality Systems Regulation, device manufacturers must evaluate their entire line of medical equipment and software, not just currently produced or supported products, to identify and assess problems that could result from inaccurate date representation. This assessment should take into account date errors that might lead to device failure, such as failure to provide diagnosis or patient treatment, date misrepresentation leading to incorrect records which might impact future treatment, or any process affected by the Year 2000 date problem that, if not corrected, has the potential to present a risk to health. Should the assessment indicate a risk to patient or public health by medical equipment unable to correctly process dates, device manufacturers must report corrective action taken in accordance with Section 806 (21 CFR 806), the regulation requiring reporting of device corrections and removals. Should the date-related failure present an unreasonable risk of substantial harm to the public health and the manufacturer fails to take corrective actions, Section 518 of the Food, Drug, and Cosmetic Act (21 U.S.C. 360h) (the act) provides the authority for FDA to require the manufacturer to undertake corrective action at no charge to the device purchasers or owners.
An FDA Medical Device Malfunction Advisory dated December 29, 1998, discusses reports that have surfaced about devices that failed a year earlier than fore casted, and confirms that two products are known to have year 1999 defects. What is most interesting about these two products is that (a) neither failure affected patient safety, and (b) the details of the failures were more complicated and limited than general discussions about year 2000 issues have led most people to believe they would be.
One product, an external defibrillator sold in large numbers by Hewlett-Packard between 1985 and 1992, continues to defibrillate properly but no longer prints the date and time on the “event record” produced by the device. Instead, it prints “set clock.” The manufacturer says the device will work fine in 2000 and thereafter; only in 1999 does this error occur. It recommends resetting the clock to 1998 for the rest of this year, since the “event record” prints only month, date, and time, not year.
The second device is a multiparameter patient monitor sold by Invivo Research. If it is tested or reset at the time the year rolls over, the external time display and the internal paper record can diverge. These can be resynchronized by powering down. The problem can occur in any year, but may be avoided by not testing or resetting the device on December 31 or January 1. A software upgrade is available to fix this bug.
While it is appropriate to be cautious about drawing conclusions from a sample of two, the cited cases represent something more than mere theoretical speculation about what kind of date-related software failures your Insureds are likely to experience next year. They are our first examples of date-related bugs captured “in the wild.” It is therefore useful to compare them with expectations about year 2000 device failures.
The first characteristic is one that many have predicted: that date-related software failures are more likely to effect logging functions, those involving the creation of a record or chart, than to threaten patient safety. Even in those devices that have the capacity to injure patients, either directly or by failing when needed, the logging parts of the software may be coupled only loosely to the device’s diagnostic or therapeutic activity, so that logging can malfunction without other con sequences. This appears to be the case with the defibrillator described above. Although one example is clearly not proof that all such failures will be benign, it is comforting that the first case we know of supports the assumption that the recording of dates and times is the function of a medical device most likely to fail.
The second characteristic is that these failures do not seem to follow the common model of why devices are predicted to fail in the year 2000. We are accustomed to seeing a simplistic explanation that runs something like this: the programmer only allowed two digits of memory for storage of the year, so that when 1999 changes to 2000 the device “thinks” that it is 1900, and either shuts down or makes a mistake. This model clearly fails to describe either of the cases described above, both of which involve devices that will work in 2000 and beyond, but which fail under more limited circumstances — one in the year 1999, the other if reset or tested on the rollover date. The actual bugs that are emerging are, therefore, more complicated than we have been led to expect under the simple model of year 2000 failure, and thus may emerge more gradually than expected, instead of taking the form of a massive malfunction at midnight next New Year’s Eve.
It is well worth taking a look at the appropriate Year 2000 pages of the FDA’s site on the World Wide Web. An impressive amount of data on specific devices has been compiled there in a form that is easy for hospitals and other interested parties to find and use.
If you would like further information, please call Paul Turner at 312-923-4114.