Alternate Controller Enabled Insulin Infusion Pump（QFG）

A software anomaly can occur when the pump is paired with the Instinct sensor. Under certain circumstances, the pump unexpectedly stops delivering insulin and displays two error messages back-to-back: Pump Error 53 followed immediately by Pump Error 23. Insulin delivery will stop which may lead to delayed therapy and an increased risk of hyperglycemia or diabetic ketoacidosis (DKA).

External soft cannula damage during manufacturing that results in insulin leaking around the Pod instead of being delivered to the user regardless of basal or bolus delivery. The primary failure mode is pump under-delivery due to loss of insulin to an external leak. If insulin is not delivered properly, users may experience high blood glucose levels due to under-delivery of insulin. In the most severe cases, prolonged and persistent high blood glucose levels can lead to diabetic ketoacidosis (DKA), hyperglycemic hyperosmolar syndrome (HHS), or even death.

insulin pump software versions 1.4.2, and 1.4.3 issue with Dexcom Continuous Glucose Monitoring (CGM) G7 sensor may result in delayed CGM reading then switch to non-CGM dosing, leading to only basal/requested meal doses provided, no correction doses/insulin reductions/suspensions for high/low glucose unless blood glucose entered for sensor life or replacement. Potential health risks to users include severe hyperglycemia with and without DKA and severe hypoglycemia.

Due to a manufacturing defect, certain Omnipod 5 Pods from 49 lots have an internal soft cannula tear that results in insulin leaking into the Pod instead of being delivered to the user regardless of basal or bolus delivery. This defect results from damage to the unexposed portion of the soft cannula during manufacturing, which would result in a compromised fluid path. The primary failure mode is pump under-delivery due to loss of insulin to an internal leak; in some cases, the defect may also lead to pump shutoff and cessation of insulin delivery when leaked insulin contacts Pod circuity in a manner that results in an electrical short. Under-delivery of insulin (both basal and bolus insulin) or cessation of insulin put users at risk of hyperglycemia, and complications from acute and chronic hyperglycemia, including dehydration, blurry vision, nausea, vomiting, altered mental status, diabetic ketoacidosis (DKA), hyperglycemic hyperosmolar syndrome (HHS), or even death. Users may require hospitalization or medical intervention to treat severe adverse health consequences. Not all devices with the defect will issue an alarm or alert the user. If there is sufficient leakage of insulin to cause a short in the circuity, the Pod will issue a Hazard Alarm that stops all insulin delivery and alerts the user to replace their Pod. In addition, if a user s glucose is trending high and is not responding to insulin delivery, the system may reach the maximum amount of insulin microboluses allowed by the system and trigger the Automated Delivery Restriction (ADR) alert that tells users to check their blood glucose and take appropriate actions (i.e., ADR is a response to persistent hyperglycemia and maximum automated delivery constraints rather than a direct detection of the leak). The magnitude of under-delivery is unknown and based on multiple factors, including how much insulin is being delivered, whether an alarm and/or alert triggers, whether and when the user recognizes the device defect, the duration of Pod use, and the size of the tear.

All Medtronic MiniMed infusion pumps (Paradigm series, 600 series, and BLE 700 series) were found to be affected by unintended over- and under-delivery of insulin when the pump is elevated or lowered relative to the infusion site, respectively, because of changes in gravitational force impacting hydrostatic and hydrodynamic pressures. Insulin over-delivery, which can occur when the pump is elevated relative to the infusion site, can result in severe hypoglycemia, altered mental status, seizure, coma, or death. An under-delivery of insulin, which can occur at lowered pump height conditions relative to the infusion site, can result in severe hyperglycemia, dehydration, diabetic ketoacidosis, or death.

The Czech language user guide contained multiple translation errors. The most significant error was that it incorrectly instructs users to verify that the infusion set is connected to the body, when it should instead direct users to confirm that the infusion set is not connected to the body. Following this instruction could result in unintended insulin delivery, potentially leading to a hypoglycemic event.

Three software defects (Pump Error 53, BG check, and Critical Pump Error (Open Book Image)) that occurred as a result of software updates (versions 6.60, 6.61, and 6.62), which could result in a risk of hypoglycemia or hyperglycemia due to inaccuracies in insulin delivery (either under-delivery, over-delivery, or cessation of delivery).

Insulin pump includes a vibration motor that gives tactile feedback for any alerts, alarms, or malfunctions. Pump may exhibit false vibration motor failure due to a software issue causing Malfunction 12: "Pump cannot operate, the mobile app can no longer receive data from the pump. Insulin delivery and any active CGM Sessions have been stopped", which could result in hyperglycemia.

The reason for the recall is: it was found in version 3.3.6 of the iLet ACE Pump firmware and all previous releases that a screen unlock failure could occur when the user successfully slides the unlock slider on the Lock Screen, no screen transition occurs, and the user remains on the Lock Screen. Because the user cannot exit the Lock Screen, the user is unable to perform a cartridge change or meal announcement. If this occurs and therapy is in progress, therapy will continue normally until the insulin cartridge is depleted. The user will be unable to perform a cartridge change or a meal announcement and will be stuck on the screen until the battery fully drains. This can lead to hyperglycemia.

it was found that in versions 1.3.7, 1.4.2, and 1.4.3, the Lock Screen and Limited Access Passcode Screen on the iLet graphical user interface (GUI) include certain icons displayed in the status bar that are active, thereby allowing the user to bypass those screens when those icons on the status bar are pressed, allowing unauthorized access while the device is in Limited Access Mode. A Health Risk associated with Limited access mode includes severe hypoglycemia due to unauthorized access to the iLet if someone were to make unauthorized meal announcements or stopped insulin delivery.

A software defect in versions 7.9.0.1 and 7.10.1 of the pump software for Tandem t:slim X2 and version 7.9.0.1 of the Tandem Mobi pump with Control-IQ+ technology that are paired with a G7 sensor may result in an unexpected automatic insulin correction bolus (autobolus ) which could result in hypoglycemia.

Insulin pumps manufactured with speakers from Revision A and B may malfunction ("Malfunction 16") which prevents audible alerts and causes the pumps to become inoperable and stop infusing insulin which could result in a hyperglycemic event, which may lead to injury and/or hospitalization.

an app defect that occurs when the phone is set to a right-to-left language, which causes app-pump pairing issues and graphical defects, which can potentially lead to incorrect therapy decisions and subsequent hypoglycemia or hyperglycemia.

A software defect in Version 7.9 of the pump software for Tandem t:slim X2 and Tandem Mobi pumps, when used with Control IQ+ technology, will cause the pump to incorrectly interpolate glucose trends when the Estimated Glucose Value (EGV) is above 255 mg/dL at the start or end of a gap in data collection due to a lapse in connection from a paired continuous glucose monitor (CGM) sensor, which can lead to under-delivery or over-delivery of insulin based on inaccurate result leading to severe cases of hypoglycemia or hyperglycemia.

A software defect in Version 7.9 of the pump software for Tandem t:slim X2 and Tandem Mobi pumps, when used with Control IQ+ technology, will cause the pump to incorrectly interpolate glucose trends when the Estimated Glucose Value (EGV) is above 255 mg/dL at the start or end of a gap in data collection due to a lapse in connection from a paired continuous glucose monitor (CGM) sensor, which can lead to under-delivery or over-delivery of insulin based on inaccurate result leading to severe cases of hypoglycemia or hyperglycemia.

During normal use, the mobile app version 2.7 may crash and be automatically relaunched by the iOS operating system. This cycle intermittently repeats, which leads to excessive Bluetooth communication that may result in pump battery drain and may lead to the pump shutting down sooner than typically expected. Pump shutdown will cause insulin delivery to suspend, which could lead to an under-delivery of insulin and may result in hyperglycemia, including severe hyperglycemia.

The bolus calculator is not recording the decimal point if it is the first value entered when changing a bolus dose. This may lead to an over-delivery of insulin to the user if the user does not recognize the error on the bolus calculator screen or the confirmation screen prior to starting the bolus.

An error message was received when using the Omnipod 5 App on compatible smartphones that prevented phone control users from controlling the Omnipod 5 Automated Insulin Delivery System from their Omnipod 5 App which may cause a delay in therapy. To reduce the volume of inquiries Insulet was receiving from customers, an email was sent to all phone control users and the cause of the error message was resolved by reverting to prior certificates on the Insulet cloud to secure communications between the Omnipod 5 App sotware and the Insulet Cloud. This issue was limited to only certain compatible Android smartphones and did not affect the Omnipod 5 Pods or the dedicated locked-down Controller provided by Insulet. All other Omnipod 5 users were still able to manage their insulin with the device without use of the smartphone app and affected users were able to switch to the locked-down control provided to all users when they initiated the device during the time the App was unavailable to them. Further, the Omnipod itself continued to deliver insulin as per its pre-programmed settings so although affected users who did not have the locked-down controller readily available may not have been able to command insulin boluses during this time, they continued to receive basal insulin without interruption. Lastly, users of the Omnipod 5 were advised during training to always have backup supplies ready in the event of a device malfunction which would include alternative means to deliver insulin subcutaneously until the issue is resolved to minimize disruption to their insulin regimen. There were 2,168 complaints received out of 7,838 users with the Android compatible smartphones affected and 9 MDRs were submitted, however, there were no serious injuries reported or reports of erroneous results as the primary issue was a delay in therapy. This defect cannot cause false results that could negatively impact patients.

The firm has become aware of an issue with the Omnipod 5 Controller where the Controller charging port and charging cable are melting, deforming, or discoloring due to heat generated by increased resistance in the Controller port. The excess heat may cause minor burns if touched, and the Omnipod 5 Controller may fail to charge, requiring the user to switch to their backup insulin plan.