FDA Issues Recall Notice for GE HealthCare Centricity Universal Viewer
A class 2 recall has been issued by the U.S. Food and Drug Administration (FDA) for certain GE HealthCare Centricity medical imaging products due to a vulnerability that could potentially be exploited by an unauthorized individual to manipulate data or impact system availability. Centricity Universal Viewer is a device that displays medical images such as mammograms and data from various imaging sources. The vulnerability affects the following Centricity Universal Viewer software versions:
- Versions 5.0 SP6 through UV 5.0 SP7.1
- Versions 6.0 through 6.0 Sp10.4.1
- Versions 7.0 through 7.0 Sp2.0.1
The recall was issued as the vulnerability may cause temporary or medically reversible adverse health consequences, but where the probability of serious adverse health consequences is remote. The vulnerability is due to user login credentials being exposed on the local client workstation. As such, an unauthorized individual could obtain the credentials and potentially impact system availability and/or manipulate data; however, the potential for exploitation is limited, as direct physical access to the local workstation is required.
“Patient safety is our top priority. There have been no reports of unauthorized access to patient data as a result of this potential issue. Direct physical access to the workstation is necessary to exploit this potential vulnerability,” a GE HealthCare spokesperson told The HIPAA Journal. The vulnerability was discovered by GE Healthcare during routine testing, and the company is working on a permanent fix. GE HealthCare has issued instructions for customers to follow to allow them to continue using their devices until the fix is issued.
According to the FDA’s recall notice, in order to continue using the affected products, users must ensure that appropriate security controls are implemented, as stated in the product manuals. Network account authentication should be implemented by using Active Directory/LDAP services for user management. If network authentication is not possible, users should contact GE Healthcare to request temporary steps to mitigate the issue.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
