The Nuffield Council on Bioethics has published a new briefing note on ethical issues surrounding medical implants

Medical implants are “vulnerable” to cyber attacks and should be developed with security in mind to help protect patients, experts have said.

Connected devices placed inside the body can communicate with external devices and be exposed to breaches or be hacked if not properly secured.

However, current regulations do not require manufacturers to show medical implants are cyber secure before they receive approval, the council said.

Connected implants, such as pacemakers and implantable defibrillators, monitor and automatically deliver treatment in response to changes in the body.

There have been no known cyber attacks on devices to date, but researchers have demonstrated that it would be possible to target cardiac defibrillators, pacemakers, and insulin pumps.

In 2017, a vulnerability discovered in pacemakers used in nearly half a million US patients showed it was possible for an unauthorised user to reprogram pacemakers and cause battery loss or inappropriate pacing.

The implants also raise privacy issues. In a recent US criminal court case, data collected by a defendant’s pacemaker were obtained by prosecutors using a search warrant and used as evidence to convict him for fraud.

“The emergence of connected implants opens up possibilities for improving patient care through data gathering and use,” it said in a briefing note for policy-makers.

“However, these implants are vulnerable to error and attack and raise privacy issues.

“It will be important that their development is accompanied by security measures and efforts to ensure data use is in-line with the expectations of patients.”

The briefing note also highlights the safety of devices and implications of their long-term presence in the body as other potential challenges.