Buggy app for insulin-delivery device puts diabetes patients at risk of hypoglycemia
(2023/12/05)
- Reference: 1701806408
- News link: https://www.theregister.co.uk/2023/12/05/insulin_delivery_app_bug/
- Source link:
The maker of the Omnipod 5 insulin-delivery system is warning customers that its controller device isn't registering decimal points in every case, potentially leading to dangerous doses being administered.
Insulet says it received two reports of "adverse events" directly related to the issue, without detailing exactly what these were. It has written to customers to highlight that delivery of the wrong dose can lead to "severe hypoglycemia." The company is developing a fix, although it is not yet available.
The issue stems from the way decimal places are handled in the controller's bolus calculator – a tool for determining the correct insulin dosage alongside eating a meal.
[1]
For example, if a user eats a meal with 30 grams of carbohydrates, the app will determine how much insulin is required to be administered alongside it based on a real-time reading of the user's current glucose levels.
[2]
[3]
In the example outlined in Insulet's urgent field safety [4]notification , eating a meal with 30g of carbohydrates and a current glucose level of 6.7 mmol/L would require an additional dose of 0.3 units of insulin.
If the user entered the 0.3 value in a different way, such as .3 or .30 – any value without a zero entered before the decimal point – the device would ignore the first decimal point and issue a dose for either three or 30 units respectively.
[5]
Insulet reminded users to always check the bolus amount before confirming the dosage and said the device is still safe to use. Users can cancel dosages during administration if they catch the error in time.
"We are working diligently to correct this issue and expect a software update as soon as possible," the company said. "We will inform you via email and update our website. Once available, the update will be pushed to your device. You will not lose settings or history because of this update."
Omnipod 5 is available in the UK, Germany, and the US. The affected devices depend on the geographic location of the user.
[6]
UK and Germany [7]diabetic customers control the Omnipod 5 dosage using the Omnipod 5 Controller, a dedicated device loaded with the required software to control insulin delivery remotely.
[8]AstraZeneca bets $247M AI can create a cancer-fighting antibody
[9]Boehringer Ingelheim swaps lab coats for AI algorithms in search for new drugs
[10]Regulator says stranger entered hospital, treated a patient, took a document ... then vanished
[11]UnitedHealthcare's broken AI denied seniors' medical claims, lawsuit alleges
US-based users have access to the same application but as an Android app, which according to the US-specific field safety notice [12]posted by customers bemoaning the issues, all versions of the Android app are affected. Only the current version of the standalone Omnipod 5 Controller (1.2.0) is affected in Europe.
It appears from multiple reports that the issue isn't affecting some users, and some are only able to recreate it by following [13]specific steps .
Customers on the Omnipod Reddit community have [14]reported varying experiences. Some have said that as far back as three months ago the app would, at times, remove the leading zero when manually entering values to the bolus calculator.
Others have said they can't reproduce the issue at all, with every attempt to type a decimal point failing until a zero is typed first.
"Unfortunately often when developing software and services, many focus on testing for legitimate use cases to ensure that the feature is working correctly," Sean Wright, head of application security at Featurespace, told the The Register .
"However, many forget to test different scenarios where behavior is not normal, such as inputting invalid data into the system. Missing these test cases can have a severe and negative impact ranging from things such as security vulnerabilities to disasters.
"While it's unlikely to be able to cover all possible scenarios, it is important for development teams to try think of as many as possible and include them in their numerous tests."
According to an earnings call earlier this year, Insulet CEO Jim Hollingshead [15]said the Omnipod 5 has more than 100,000 customers out of the company's entire customer base of around 360,000 people.
Recent press material has also said following its first European launches this summer – the UK in June and Germany in August – Insulet plans to roll out Omnipod 5 to more European countries starting in 2024.
A spokesperson at Insulet told The Register : "The health and safety of our customers is our number one priority. As such, Insulet issued a voluntary Medical Device Correction for the Omnipod 5 App on compatible Android Smartphones in the United States and the Omnipod 5 Controller in the United Kingdom and Germany, related to the bolus calculator.
"We have informed all impacted users of the affected app and devices and provided instructions on how to avoid the risk of errors related to bolus delivery. It is safe for users to continue using the Omnipod 5 Automated Insulin Delivery System." ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.omnipod.com/en-gb/fsn-11-2023
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/01/18/artificial_pancreas_successful_in_type/
[8] https://www.theregister.com/2023/12/04/astrazeneca_absci_cancer/
[9] https://www.theregister.com/2023/12/01/boehringer_ingelheim_ibm_ai/
[10] https://www.theregister.com/2023/12/01/nhs_health_board_ticked_off/
[11] https://www.theregister.com/2023/11/15/unitedhealthcare_ai_medicine/
[12] https://twitter.com/morganherlocker/status/1731233846929338403
[13] https://twitter.com/morganherlocker/status/1730862135616720982
[14] https://www.reddit.com/r/Omnipod/comments/187yjjy/omnipod_5_warning/
[15] https://finance.yahoo.com/news/insulets-podd-omnipod-strategic-moves-162804712.html
[16] https://whitepapers.theregister.com/
Insulet says it received two reports of "adverse events" directly related to the issue, without detailing exactly what these were. It has written to customers to highlight that delivery of the wrong dose can lead to "severe hypoglycemia." The company is developing a fix, although it is not yet available.
The issue stems from the way decimal places are handled in the controller's bolus calculator – a tool for determining the correct insulin dosage alongside eating a meal.
[1]
For example, if a user eats a meal with 30 grams of carbohydrates, the app will determine how much insulin is required to be administered alongside it based on a real-time reading of the user's current glucose levels.
[2]
[3]
In the example outlined in Insulet's urgent field safety [4]notification , eating a meal with 30g of carbohydrates and a current glucose level of 6.7 mmol/L would require an additional dose of 0.3 units of insulin.
If the user entered the 0.3 value in a different way, such as .3 or .30 – any value without a zero entered before the decimal point – the device would ignore the first decimal point and issue a dose for either three or 30 units respectively.
[5]
Insulet reminded users to always check the bolus amount before confirming the dosage and said the device is still safe to use. Users can cancel dosages during administration if they catch the error in time.
"We are working diligently to correct this issue and expect a software update as soon as possible," the company said. "We will inform you via email and update our website. Once available, the update will be pushed to your device. You will not lose settings or history because of this update."
Omnipod 5 is available in the UK, Germany, and the US. The affected devices depend on the geographic location of the user.
[6]
UK and Germany [7]diabetic customers control the Omnipod 5 dosage using the Omnipod 5 Controller, a dedicated device loaded with the required software to control insulin delivery remotely.
[8]AstraZeneca bets $247M AI can create a cancer-fighting antibody
[9]Boehringer Ingelheim swaps lab coats for AI algorithms in search for new drugs
[10]Regulator says stranger entered hospital, treated a patient, took a document ... then vanished
[11]UnitedHealthcare's broken AI denied seniors' medical claims, lawsuit alleges
US-based users have access to the same application but as an Android app, which according to the US-specific field safety notice [12]posted by customers bemoaning the issues, all versions of the Android app are affected. Only the current version of the standalone Omnipod 5 Controller (1.2.0) is affected in Europe.
It appears from multiple reports that the issue isn't affecting some users, and some are only able to recreate it by following [13]specific steps .
Customers on the Omnipod Reddit community have [14]reported varying experiences. Some have said that as far back as three months ago the app would, at times, remove the leading zero when manually entering values to the bolus calculator.
Others have said they can't reproduce the issue at all, with every attempt to type a decimal point failing until a zero is typed first.
"Unfortunately often when developing software and services, many focus on testing for legitimate use cases to ensure that the feature is working correctly," Sean Wright, head of application security at Featurespace, told the The Register .
"However, many forget to test different scenarios where behavior is not normal, such as inputting invalid data into the system. Missing these test cases can have a severe and negative impact ranging from things such as security vulnerabilities to disasters.
"While it's unlikely to be able to cover all possible scenarios, it is important for development teams to try think of as many as possible and include them in their numerous tests."
According to an earnings call earlier this year, Insulet CEO Jim Hollingshead [15]said the Omnipod 5 has more than 100,000 customers out of the company's entire customer base of around 360,000 people.
Recent press material has also said following its first European launches this summer – the UK in June and Germany in August – Insulet plans to roll out Omnipod 5 to more European countries starting in 2024.
A spokesperson at Insulet told The Register : "The health and safety of our customers is our number one priority. As such, Insulet issued a voluntary Medical Device Correction for the Omnipod 5 App on compatible Android Smartphones in the United States and the Omnipod 5 Controller in the United Kingdom and Germany, related to the bolus calculator.
"We have informed all impacted users of the affected app and devices and provided instructions on how to avoid the risk of errors related to bolus delivery. It is safe for users to continue using the Omnipod 5 Automated Insulin Delivery System." ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://www.omnipod.com/en-gb/fsn-11-2023
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZW@rmu7KbORbeuK5kqhoOgAAAAk&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2023/01/18/artificial_pancreas_successful_in_type/
[8] https://www.theregister.com/2023/12/04/astrazeneca_absci_cancer/
[9] https://www.theregister.com/2023/12/01/boehringer_ingelheim_ibm_ai/
[10] https://www.theregister.com/2023/12/01/nhs_health_board_ticked_off/
[11] https://www.theregister.com/2023/11/15/unitedhealthcare_ai_medicine/
[12] https://twitter.com/morganherlocker/status/1731233846929338403
[13] https://twitter.com/morganherlocker/status/1730862135616720982
[14] https://www.reddit.com/r/Omnipod/comments/187yjjy/omnipod_5_warning/
[15] https://finance.yahoo.com/news/insulets-podd-omnipod-strategic-moves-162804712.html
[16] https://whitepapers.theregister.com/
ChoHag
To do that you'd need some way for people to bench test the device as a theoretical user so the product can be accepted for production.
Oh I see! Just get rid of the "bench" and the "theoretical"!
Always sanitize user input
DS999
Expecting it to be in a specific format is always a bad idea, especially when there are potential life or death consequences!
User input
Mishak
Yes, all inputs to a safety-related system should be sanitised. End of.
Unfortunately, it seems that medical devices are often developed without adequate thought being applied to safety management - though I'm not saying that's the case here.
Re: Always sanitize user input
Phil O'Sophical
And use standard, tested, library routines to parse the input. Never roll your own.
App used in Australia?
Michael Hoffmann
A purely random thought on my side, as I couldn't help wondering if the driver involved in the tragic accident that killed 5 a few weeks ago was using it. Apparently, by all current accounts, he went hypoglycaemic and blacked out, crashing into a beergarden/pub.
"focus on testing for legitimate use cases"
Mishak
Reminds me of my time at university:
Friend: "I've finished the end of year project. Can you test it for me"?
Me: "Sure
Computer: Core dumped
Friend: "It asked you to enter a number. Why did you enter qwertyuiop"?
Me: "Because you asked me to test".
2024 will be a good year ... for some.
vtcodger
For those unfamiliar with diabetes, the symptoms of of severe hypoglycemia are confusion and anxiety followed by coma and possibly death. The treatment -- Glucose. 15 or 20 grams. Perhaps followed up by more Glucose or some starchy food. The starch breaks down after a while into more Glucose.
From Honolulu to Vienna and all points in between lawyers are sharpening their pencils. And their knives. They are smiling. 2024 may be a very good year for lawyers.
2024 may not be such a good year for diabetics and for Insulet shareholders.
>>"However, many forget to test different scenarios where behavior is not normal, such as inputting invalid data into the system
If there only was a branch of Computer Science focused on tackling this kind of scenarios... I know: perhaps I can take some programmers aside and task them with testing, or assuring if you will, the quality of the software products.
I am so clever, no one ever thought of this before!