ECRI publishes resources that could help device developers and manufacturers better understand healthcare risks — and potentially innovate solutions to them. [Image from Adobe Stock]
Artificial intelligence topped the list of healthcare technology hazards for 2025, as ranked by the device evaluation team at the Emergency Care Research Institute (ECRI).
Each year, the healthcare safety nonprofit identifies the top safety risks from medical devices and systems to help medical device developers, healthcare providers and policymakers understand the dangers, mitigate the risks and prevent harm — not only for patients, but for their physicians and care teams.
ECRI develops its annual list based on device-related event reports (including adverse events and near misses), lab testing, observations and assessments of hospital operations, literature reviews and conversations with clinicians, clinical engineers, device suppliers and other key stakeholders.
“The topics included in the report are not necessarily the most frequently reported problems or the ones associated with the most severe consequences — although we do consider such information in our analysis,” ECRI said. “Rather, the report reflects our judgment about which risks should be given attention now to help care providers, device manufacturers, and others prioritize their patient safety efforts.”
Related: How Medtronic’s using AI: Artificial intelligence insights and advice
The full report is only available for ECRI members (Medical Design & Outsourcing received a complimentary copy), but an executive brief can be downloaded for free here. We’ve published excerpts below to highlight the most relevant information for device engineers, designers and other medtech professionals.
ECRI offered recommendations and challenges for the medtech industry for all but the last three risks on this list. However, the executive briefing of this report has additional resources that could help device developers and manufacturers better understand all of these risks — and potentially innovate solutions for them.
1. Risks with AI-enabled health technologies
“Artificial intelligence offers the promise of increasing the efficiency and precision of medical diagnoses, treatments, and services; but improvements are not guaranteed. Placing too much trust in the AI model may lead to inappropriate patient care decisions. The potential for preventable harm exists if, for example, biases are present in the data used to train the AI model, if the model is not well matched to the target patient population, or if the model’s performance is not evaluated and then monitored over time. Further, AI solutions can yield disappointing results if organizations have unrealistic expectations, fail to define goals, provide insufficient governance and oversight, or don’t adequately prepare their data for use by the AI application.”
ECRI offered recommendations for incorporating AI in a 2024 position paper, including regulatory considerations, AI explainability and risk profile. AI developers can help healthcare providers use AI safely by providing “the number and source of the data points used to train the model” and “baseline metrics indicating the performance of the model under ideal conditions [to] help with monitoring the performance of the model over time,” as well as “an explanation of the model and how it reaches conclusions, in terms that a layperson can understand.”
2. Unmet technology support needs for home care patients
“Devices such as ventilators, dialysis machines, and infusion pumps traditionally have been used in acute care settings under clinical supervision, but increasingly are being used in the home. The safe and effective use of such devices by patients or lay caregivers requires adherence to key technology management practices. These include assessing device usability in the context of the user’s abilities, mitigating any physical or structural limitations in the intended area of use, supplying the appropriate accessories, and providing sufficient training for proper device operation and maintenance. Inattention to such practices can lead to events and errors going undetected, readings from the device being misinterpreted, or care delays and other harm from unresolved device malfunctions.”
Device developers should provide clear and concise instructions for the safe operation of these devices at home, including ” a list of basic requirements for proper operation of the device in the home, such as space, cleaning and disinfection, electrical, and internet needs” and “any safety hazards associated with the device, the use environment, and how the device operates in the use environment.”
3. Vulnerable technology vendors and cybersecurity threats
“Past instances of unauthorized access, disruption to services, or other adverse cybersecurity events that impacted a vendor have left healthcare providers without access to critical services, reliable data, or effective communications channels with their partnering care providers. Any of those eventualities can put patients in harm’s way, delaying, preventing, or degrading care and adversely affecting patient outcomes.”ECRI offered recommendations for healthcare providers and policymakers, but device developers are responsible for the cybersecurity of their products as well (read more of our cybersecurity coverage and guidance here).
4. Substandard or fraudulent medical devices and supplies
“Large-scale instances of substandard or fraudulent (e.g., counterfeit) products reaching the US market have become startlingly common, with widespread implications for patient care. Patients or staff can be harmed if medical devices or supplies (e.g., syringes, isolation gowns) do not function as intended. Substandard or fraudulent devices may be more susceptible to failure or malfunction, leading to misdiagnoses or injuries. Additionally, the disruptions and recalls that these products cause can stress the supply chain, leading to product shortages; and the need for corrective actions can cost time and money, as healthcare organizations must review inventories for affected items.”
ECRI challenged the medtech industry to confirm materials/component suppliers and third-party testing facilities are fully qualified and accredited before doing business with them, and to conduct periodic audits to confirm continued compliance.The organization also encouraged device manufacturers confirm that all points of supply are of acceptable quality, and improve traceability and tracking systems to fight counterfeiting and improve recalls of defective products.
5. Fire risk in areas where supplemental oxygen is in use
“Fires associated with the delivery of supplemental oxygen have occurred in a range of patient care areas, including the home. In the acute care setting, OR staff are typically well aware of fire risks during surgery. Outside the OR, however, ECRI’s investigations suggest that increased attention is needed to prevent fires in areas where supplemental oxygen is being delivered. The three elements needed for a fire — an oxidizer, a fuel, and an ignition source — can be present wherever oxygen is delivered. Ignition sources can range from the obvious (e.g., an electrosurgical unit pencil) to the unsuspected, such as a defibrillator, heated humidifier, fiberoptic light source, or damaged electrical cord.”
ECRI warned engineers that it has investigated incidents involving air-oxygen blenders that didn’t blend oxygen and air, but instead delivered only one or the other (both of which present risks) due to deteriorated rubber diaphragms.
6. Dangerously low default alarm limits on anesthesia units
“Certain anesthesia units can be configured such that the default alarm limits (those active whenever a new surgical case is started) will be set to zero or a similarly unsafe lower limit. In effect, this disables the alarm at the start of the case. ECRI has investigated numerous incidents in which inappropriate default alarm limits caused dangerous conditions to go undetected, in some cases leading to brain damage or death. While anesthesia providers can set lower alarm limits to zero when needed during a procedure, ECRI recommends against configuring the unit such that the lower limit to zero (or some other unsafe lower limit).”
Those unsafe lower limits should not be set as factory defaults by device manufacturers, ECRI said. The organization lauded some device developers for their efforts on this front: “The Draeger Perseus A500 sets the initial low minute volume limit automatically based on breath settings and patient size; and all Getinge and Mindray models available in the United States use a non-zero default limit for the low minute volume alarm. ECRI applauds such changes and will continue to update its reports as product improvements are made.”
7. Mishandled temporary holds on medication orders
“The need to suspend (or hold) the administration of a drug based on clinical circumstances is a common occurrence during patient care. Yet errors can arise if organizations lack carefully vetted workflows for documenting hold order parameters in the electronic health record. The Institute for Safe Medication Practices has found that errors associated with hold orders often can be attributed to uncertainty about what a hold order means, how the order should be communicated, or what process should be followed. Failure to hold a medication when indicated, or neglecting to either restart or discontinue a held medication as circumstances require, can lead to patient harm.”
ECRI had no recommendations for device makers on this risk or the next two risks on the list, but did have advice for healthcare providers to support safe practices.
8. Infection risks and tripping hazards from poorly managed infusion lines
“Failure to clean and disinfect an infusion line connector before access, touching the insertion site or tubing with contaminated gloves, or failure to follow sterile technique when preparing the infusate all can lead to healthcare-associated infections. Another circumstance that can lead to harm is if infusion lines are allowed to dwell on the floor. This creates a tripping hazard that can lead to patient or staff injuries from a fall, as well as patient harm if the infusion line becomes dislodged.”
9. Skin injuries from medical adhesive products
“Medical adhesive products are used for a variety of applications (e.g., dressing wounds, securing IV lines, attaching ECG electrodes). But not all adhesives are the same, and not all patients will respond similarly to an adhesive product. Inappropriate choices or errors in use can lead to skin tears, blisters, adverse reactions like contact dermatitis, or other forms of injury. Medical-adhesive-related skin injuries can occur in any care setting, medical specialty, and patient population. While most skin injuries resolve within a few days, they nevertheless cause unnecessary discomfort and pain; additionally, they can leave patients susceptible to infection, which can lead to more severe consequences.”
Related: Sticky business: Six wearable device adhesion tips from iRhythm CTO Mark Day
10. Incomplete investigations of infusion system incidents
“With so many patients receiving infusion therapy, adverse events associated with the use of infusion pumps are not unusual. Organizations that lack the expertise or resources to conduct a thorough investigation of such incidents will be poorly positioned to prevent future ones. Of concern is that investigations involving infusion systems can be particularly challenging due to the variety of potential contributing factors. Issues related to the pump hardware and software, the IV administration set and other accessories, and the actions of the user all must be examined. Additionally, staff must know what to do (and what not to do) to facilitate an investigation.”
Previously: Device design takes the spotlight among 2024’s top health tech hazards
link