Build it and they will steal. Med-tech companies spend billions developing new technologies and devices, only to discover later that many of the one-time-use disposables and peripheral parts are handily cloned and counterfeited.

On the one hand, it's a financial loss to the vendors. On the other, it's a huge safety concern for end users the patients.

As an example, FDA issued an alert not long ago for counterfeit blood glucose test strips being sold in the U.S. for use with various models of One Touch Blood Glucose Monitors from LifeScan (Milpitas, California) (Medical Device Daily, Oct. 18, 2006).

One company that's targeting the elimination of this practice is Cryptography Research (CR; Santa Clara, California). Originally focused on developing tamper resistance, content protection, network security and financial security services, CR now is aiming its security weapons at the medical device sector.

"There are three threats currently facing the device industry: remanufacturing, outright counterfeiting and modification of equipment," Benjamin Jun, VP of technology for CR, told Medical Device Daily.

Many device companies sell equipment to hospitals at a loss, making their financial gains via disposable patient interface supplies.

Jun gives the example of patient monitoring equipment. Monitors typically interface with patients via a disposable probe kit, which is a calibrated and sterile package of electrodes and sensors. Most systems require that a new probe kit be used for each patient. This is important for patient safety, but can be expensive.

Jun said his company is seeing more and more of these disposables "cloned" and sold to hospitals at a huge discount.

"Obviously this creates tremendous patient safety issues because they are potentially being treated with inferior, non-certified equipment," he said.

"Our primary security motivation is to make counterfeits difficult to create," Jun said. "We make devices that track their usage properly."

Solutions created by CR can be used in any device or peripheral disposable that already includes a silicon chip. "They have to make a chip anyway, so we can just sprinkle our technology onto the chip," he said.

The security technology basically authenticates the disposable with the device via embedded keys and a challenge-response protocol technology that Jun said is "as old as the hills."

He gave an example of how CR's security technology works with patient-monitoring equipment used at hospitals. Authentication occurs at the patient bedside. A healthcare professional will attempt to use a disposable, and if the monitor in question is armed with the security technology, a warning or error message will be displayed indicating that the equipment doesn't match up.

Jun said counterfeiters will typically spend $500,000 to $1 million researching methods to clone devices. "There's no way to make a $50 consumable withstand a $1 million-backed attack. The real issue is to make repeated attacks not commercially viable," he said. "We can't completely stop it, but we're trying to make it commercially unprofitable to do it."

Cryptography Research's technology is customized for each medical device. But within the next year, the company will hone the tool to become more generic, applicable to any kind of device or equipment.

The security system costs about $500,000 to integrate into a device and CR also charges fees for every device used, but Jun declined to release a figure associated with those add-on fees.

"The return on investment is stopping the flow of counterfeit products," he said. "When a device company hits a certain level of success, it's hard to lock out all counterfeit devices — it's a very challenging environment."

A sign of the times was the FDA's creation four years ago of the Counterfeit Alert Network, a coalition of health professional and consumer groups that:

• Disseminate alert messages about specific counterfeit drug and device incidents in the U.S. and measures to take to minimize exposure (recall information, for example).

• Develop educational information about the roles and responsibilities that consumers, pharmacists, other health professionals and wholesalers should play to identify and report.

• Develop a network of national organizations, consumer groups and industry representatives to help distribute the information, with member groups ranging from the American Medical Association (Chicago) to the Healthcare Distribution Management Association (Arlington, Virginia).