Dive Brief:

• BD received a warning letter after the Food and Drug Administration found fault with the practices at a facility that manufactures Pyxis medication management system medical devices.
• The letter, which the FDA published Tuesday, lists failures to establish and implement procedures for corrective and preventive actions. Inspectors found 111 open tickets for software defects that were categorized as “catastrophic” or “severe” patient harm.
• Four tickets covered cybersecurity vulnerabilities. BD recently said in a securities filing that it had “identified incidents of unauthorized activity on a portion of our IT systems” related to products including Pyxis.

Dive Insight:

The FDA sent the warning letter in November after inspecting a BD facility in San Diego. Carefusion 303, a business that BD acquired in a $12.2 billion deal in 2015, makes devices including Pyxis at the facility. Carefusion, then part of Cardinal Health, entered into a still-active consent decree with the FDA in 2007 in relation to Alaris pumps. The FDA found Carefusion was noncompliant with the decree after inspecting a site in San Diego in 2020.

An inspection in May generated a Form 483 that listed issues related to quality system and medical device reporting regulations. The issues covered BD’s infusion system, which is the subject of the consent decree, and dispensing system, which is outside of the scope of the agreement with the FDA.

The Form 483 led to a warning letter that only describes issues with the oversight of the Pyxis dispensing system. BD recorded a $28 million liability for estimated future costs associated with the warning letter in the fourth quarter of its fiscal year 2024, which ended Sept. 30. The company will use the money to address the non-conformities. 

The FDA published the letter this week, providing a detailed look at the problems BD needs to fix. FDA inspectors found more than 92,000 complaints about delays to the delivery of medications because the system froze, shut down or malfunctioned. BD had 70 complaints for wrong medications dispensed and eight complaints of potential electrical safety issues, none of which were investigated. 

Inspectors found multiple reports of life-threatening situations involving Pyxis delays. One Pyxis system stopped responding during a cardiac arrest. Other users tried to remove medications to stop a person from drowning, but it took too long, causing the patient to be rushed to a hospital. An analysis found five electrical hazards with a severity of harm of “critical” or “catastrophic.”

In another complaint, users said a system opened the wrong medication doors after all stations were re-installed following a cyberattack. BD had “not established a process for assessing the exploitability of cybersecurity vulnerabilities and the severity of patient harm if the vulnerability were to be exploited,” the FDA said. BD recently described cybersecurity incidents in which Pyxis products were accessed in its annual report. The company ended the unauthorized access.

Inspectors found fault with BD’s reporting of complaints. The company received a complaint about a patient who sustained a serious injury linked to an unexpected reboot of a Pyxis system in October 2022, the FDA said. BD did not report the case to the FDA until June 2024. The warning letter includes examples of other complaints that BD reported to the FDA after the 30-day deadline.