Recently uncovered vulnerabilities in some devices using Bluetooth® wireless technology, including continuous glucose monitors, have caused concern among insulin pump users.
To reassure you that Tandem Diabetes Care® products are not affected, we’ve worked directly with our engineers to shed some light on various security measures built into each Tandem insulin pump.
Device Communication & Data Security
The t:slim X2™ insulin pump is designed to exchange Bluetooth communications only with a linked compatible device. Our products adhere to the Food and Drug Administration’s (FDA) guidance for management of cybersecurity in medical devices and have been evaluated by third party penetration testing.1
We use best practices for standard Bluetooth security, as well as proprietary authentication to ensure only authorized devices can connect to the t:slim X2 pump. Devices connected to your t:slim X2 pump via Bluetooth wireless technology currently do not have the ability to control the pump. No device can connect to your t:slim X2 pump without your knowledge.
“SweynTooth” Bluetooth Cybersecurity Vulnerabilities
In response to the news about a series of Bluetooth cybersecurity vulnerabilities known as “SweynTooth” affecting some diabetes devices, including some insulin pumps made by other companies, we conducted a thorough investigation and confirmed that none of the hardware components used in our devices are affected by these vulnerabilities. Tandem conducts rigorous safety testing on all our products, including cybersecurity testing, and will continue to monitor this news as it develops.
Wireless Co-Existence and Data Security
The t:slim X2 pump and the Dexcom transmitter communicate by way of Bluetooth. While we are not aware of any studies that have been conducted specifically with the t:slim X2 insulin pump and the Dexcom CGM transmitter we have tested and verified performance of the t:slim X2 pump against all of the applicable standards that are required for use of our device.
The t:slim X2 pump is designed to work safely and effectively in the presence of wireless devices typically found at home, work, retail stores, and places of leisure where daily activities occur.
Interoperability
Control-IQ™ technology for the t:slim X2 pump is the first to receive designation as an interoperable automated glycemic controller (iAGC). With the designation, the FDA established a new device class which includes special controls outlining requirements for this and future submissions in this category, as well as describes the reliability, device interoperability, cybersecurity, and data to establish clinical relevance required to demonstrate acceptable performance.
Interoperability is important for system development and rapid innovation of system components. This can also present a challenge for cybersecurity, which is addressed in the software development and is part of the regulatory review of new systems. Even with the new “interoperable” designation, integration of additional system components requires meaningful software development.
Business relationships are also required to ensure users of these systems can receive the necessary customer support and that all safety information will be properly documented and reported to appropriate regulatory bodies. We plan to be very deliberate about how and when we partner on integrated system components to ensure our customers have the best possible experience. This will be a serious consideration as we evaluate what devices or algorithms to integrate with in the future.
1U.S. Food & Drug Administration. Content of Premarket Submissions for Management of Cybersecurity in Medical Devices. October 2014. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/content-premarket-submissions-management-cybersecurity-medical-devices
