Over-The-Air Updates Could Turn Millions Of Inexpensive Devices Into Much-Needed Ventilators To Treat Seriously-Ill COVID-19 Patients -- If Manufacturer Helps

from the profits-before-people dept

Last week we wrote about attempts to repair much-needed ventilators for serious coronavirus cases being stymied by manufacturers' refusal to allow hospital technicians to carry out the necessary work. Trammell Hudson, who describes himself as "a programmer, photographer, frequent hacker and occasional watchmaker", has come up with another approach to supplying ventilators to hospitals. It involves taking the inexpensive and widely-used Constant Positive Air Pressure (CPAP) devices typically used for sleep apnea, and turning them into emergency ventilators suitable for COVID-19 patients. These are known as Bi-level Positive Airway Pressure (BiPAP) machines. BiPAP devices are more sophisticated than CPAP ones: they apply higher pressure when the patient tries to breathe in, and lower pressure when they start to breathe out. In investigating the popular Airsense 10 CPAP device manufactured by ResMed, Hudson made a remarkable discovery:

Our work indicates that the actual difference between a low-end CPAP device and a high-end iVAPS [intelligent volume-assured pressure support] device is just a software upgrade. The CPAP machines have many of the same sensors as the more expensive models, and the Airsense 10 CPAP devices include in their firmware all of the other modes, such as iVAPS and BiPAP-ST [spontaneous/timed mode]. When we unlock that mode in software, the CPAP device functions like a much more capable and expensive iVAPS device.

This idea, that the difference between CPAP and BiPAP machines is a software change rather than a hardware change, is at the root of our work. If the common, highly distributed CPAP devices could have a software upgrade that turns them into iVAPS or BiPAP-ST devices capable of ventilating COVID patients, that would be a huge boon to the hospitals and health care workers around the world who are struggling with a lack of ventilators or alternatives to treat the influx of COVID patients.

Following his discovery, Hudson wrote a firmware patch that can be applied to the Airsense 10 CPAP device in order to access its more advanced features. However, he stresses:

We want to be very clear here: this modified firmware should not be flashed on CPAP machines and used to treat COVID patients immediately. The firmware that we've developed is an effective demonstration of the capability, and while it has been reviewed and validated by expert researchers, biomedical engineers, and clinical pulmonologists, it has not yet been put through FDA approval.

Although FDA approval could be sought, Hudson points out that by far the best solution would be for ResMed itself to provide the software upgrade -- something that doesn't need FDA permission. There are two other big benefits of taking this route. First, the manufacturer could more easily provide the slightly different patches for the various models of its devices. Perhaps even more importantly, for the majority of machines, the manufacturer could use a built-in always-on cellular connection to upgrade them over the air, without even needing to open them up. Unfortunately, it seems unlikely that the manufacturer will embrace this idea. On its Web site, a FAQ specifically addresses the issue of using a CPAP machine as a ventilator:

CPAP devices are designed to provide only PAP (positive airway pressure) and would require significant rework in order to function as a ventilator.

Hudson's work suggests that is not true: a simple software upgrade is pretty much all that is required. When asked by Ars Technica whether the company would be willing to work with researchers to convert low-cost models to more capable ventilators, a representative wrote: "We are already exploring that option, but our primary focus is to maximize production of our current ventilation devices, masks, and accessories". In other words, rather than helping to save thousands of lives by carrying out over-the-air upgrades of existing machines -- millions of them in the US alone, according to Hudson -- the "primary focus" is on selling more expensive machines. As with the previous story about repairing ventilators, it seems that even during a pandemic, profits are more important than patients.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: airsense 10, bipap, covid-19, cpap, fda, hacking, ota, over the air updates, trammell hudson, ventilators
Companies: resmed

Dystopia Now: Insurance Company Secretly Spying On Sleep Apnea Patients

from the tomorrow's-dystopia,-today dept

So for years digital rights activists have worried about insurance companies getting their hands on everything from your smart car data to your pacemaker information and using that to deny you coverage, charge you more money, or make an extra buck selling said data to the highest bidder. That's especially a problem in an era where consumer privacy rights are under constant siege, alongside the right to repair and open access these devices (and any data they might store about you).

If you thought this rather dystopian future was activist hyperbole or still a decade or so out, you may be disappointed.

Propublica recently released a rather interesting story about a CPAP (continuous positive airway pressure, used to treat sleep apnea) user who found that their insurance company had been accessing sleep data generated by the device, and using it to deny coverage:

"Last March, Tony Schmidt discovered something unsettling about the machine that helps him breathe at night. Without his knowledge, it was spying on him. From his bedside, the device was tracking when he was using it and sending the information not just to his doctor, but to the maker of the machine, to the medical supply company that provided it and to his health insurer."

CPAP machines are essential to sleep apnea patients, whose health and quality of life is dramatically and negatively impacted by the fits and starts of interrupted sleep. But like so many health care sectors, these users already face all manner of hostile restrictions from their insurance companies, who often won't cover the machines if users don't rent them from specific companies at a steep premium. The insurance companies simply say they're trying to ensure that consumers actively use the machines as intended; critics say say insurance industry is simply trying to shift the cost of such services to unsuspecting patients.

"But the companies’ practices have spawned lawsuits and concerns by some doctors who say that policies that restrict access to the machines could have serious, or even deadly, consequences for patients with severe conditions. And privacy experts worry that data collected by insurers could be used to discriminate against patients or raise their costs."

“The doctors and providers are not in control of medicine anymore,” said Harry Lawrence, owner of Advanced Oxy-Med Services, a New York company that provides CPAP supplies. “It’s strictly the insurance companies. They call the shots."

In Schmidt's case, he quickly found that the device's manufacturer, ResMed, had access to his usage data. As did his supply company, Medigy. As did his health insurer, Blue Cross Blue Shield. Of course because US privacy laws remain stuck in the era of the wild west this is all perfectly legal, resulting in Schmidt running into a brick wall when he began to complain about the privacy implications of being monitored and having his medical information shared with a bevy of companies. The Better Business Bureau wouldn't help. Neither would the federal government.

Again, insurance companies say they're simply monitoring usage and denying coverage to avoid paying for CPAP machines that aren't being used (which does happen, since adjusting to sleeping with a mask and tubes is often a challenge). But as the story makes clear, a lot of the system is structured (surely entirely coincidentally!) to ensure that health care patients are paying out far, far more money than the $500 hardware actually costs. Usually courtesy of deductible structures and mandated rental requirements that can making actually having insurance more expensive than going without:

"The rental fees can surpass the retail cost of the machine, patients and doctors say. Alan Levy, an attorney who lives in Rahway, New Jersey, bought an individual insurance plan through the now-defunct Health Republic Insurance of New Jersey in 2015. When his doctor prescribed a CPAP, the company that supplied his device, At Home Medical, told him he needed to rent the device for $104 a month for 15 months. The company told him the cost of the CPAP was $2,400.

Levy said he wouldn’t have worried about the cost if his insurance had paid it. But Levy’s plan required him to reach a $5,000 deductible before his insurance plan paid a dime. So Levy looked online and discovered the machine actually cost about $500."

Levy said he called At Home Medical to ask if he could avoid the rental fee and pay $500 up front for the machine, and a company representative said no. “I’m being overcharged simply because I have insurance,” Levy recalled protesting.

Of course as the internet of broken things, wireless, and other sectors make clear, once your data is collected and sold, you're part of a system where you have little control, since using this data to make an extra buck takes absolute priority over security, privacy, or consumer welfare. And as more and more sectors begin to gobble up your daily data (from driving habits to how many times you opened your smart refrigerator), there's an ocean of problems just over the horizon that current privacy laws and regulatory agencies are utterly ill-equipped (and usually unwilling) to address.

Filed Under: insurance, privacy, sleep apnea, surveillance
Companies: blue cross blue shield, health republic, home medical, medigy, resmed