Case file
- What happened: Guidant continued selling implantable cardioverter-defibrillators with a known electrical short-circuit flaw while a corrected version was already in production. Physicians learned of the defect only after a young patient died.
- Scale: Multiple ICD models affected across an installed patient population; the flaw could cause the device to fail silently when a life-saving shock was needed.
- Root cause: Not a design failure. The failure mode was identified, investigated and corrected at the engineering level. The breakdown was in field-action governance — the commercial decision to keep shipping known-defective inventory without notifying physicians or regulators.
- The bill: About $296 million in criminal penalties — the first criminal conviction of a medical-device manufacturer for misleading the FDA.
~$296MCriminal penalty — first for a device maker
2005Year the silence broke
1stDevice firm criminally convicted for misleading FDA
The situation
Guidant built implantable cardioverter-defibrillators. The devices sit inside a human chest, monitor heart rhythm, and deliver a shock when a lethal arrhythmia starts. These are not consumer electronics. When one fails, someone collapses on a sidewalk. The short-circuit flaw in certain Guidant models was not a mystery. Field returns and engineering analysis had identified it. An internal arc could bridge components and disable the therapy delivery circuit. Guidant developed a design correction, validated it, moved it into production. New units coming off the line were clean. The engineering problem was solved. The governance problem was just beginning.How it unfolded
With corrected units in production, Guidant faced a question every manufacturer recognises: what do we do with the old stock? Flawed units sat in inventory, in distribution channels, in patients. A field action — physician notification, recall, even a targeted advisory — would have been expensive, disruptive and damaging to the brand. The company chose silence. Doctors implanting the devices had no idea the unit in their hands carried a documented, corrected flaw. They found out the way no physician should: a device failed to fire, and a young patient died. A cardiologist asking questions after that death — not an internal audit, not a regulator, not a whistleblower — broke the silence open. The Department of Justice pursued criminal charges. Guidant, by then part of Boston Scientific, pleaded guilty to misleading the FDA. The penalty, about $296 million, was unprecedented for a device maker. Not because the engineering was unusual. Because the silence was.Root-cause anatomy
Technically, the failure mode is clean: an internal short disables the defibrillation circuit at the exact moment the patient needs it. The engineering investigation was thorough. The corrective action was real. None of that is in dispute. Organisationally, this is a textbook case of how field-action decisions get orphaned. Nobody needs to say let us hide this. The escalation dies through structural ambiguity instead. Engineering raises the issue and initiates a design change — their job is done. The change enters validation and production, milestone closed. Somebody in quality, regulatory or commercial is theoretically responsible for legacy inventory disposition. But ownership is diffuse, timelines are soft, and the commercial pressure to keep shipping is concrete. The field-action question lands in a grey zone between departments. Nobody picks it up. Nobody is forced to. Known defects survive not through conspiracy but through the absence of a forced escalation trigger. The system allows silence because nobody designed it to prevent silence.Where the quality system failed
The PFMEA for these devices almost certainly listed the short-circuit mode with a catastrophic severity rating — patient death. That RPN demanded action, and action was taken at the design level. The quality system then failed at the junction between design correction and field disposition. The CAPA was opened, addressed and closed. Its effectiveness check apparently did not extend to the question that mattered: are uncorrected units still reaching patients? Change control governed the new product without triggering a parallel review of legacy stock. No internal audit, no management review, no external surveillance forced the escalation. The bridge between we fixed it and we told everyone affected had no structural support.A PFMEA without an escalation protocol is just paperwork waiting to become exhibit A.
What would have caught it
Several concrete mechanisms, any one of which could have forced the call Guidant deferred. A mandatory field-action gate in change control: when a design change addresses a catastrophic-severity failure mode, the system auto-generates a field-impact assessment for all inventory and installed units. No documented field-action decision, no change closure. A severity-driven notification threshold: for failure modes rated catastrophic, field notification is binary. If the mode exists and uncorrected units are in the field, the notification goes — occurrence rate is irrelevant when severity is death. A CAPA effectiveness review that covers the supply chain end to end: a corrective action that fixes new production while old stock ships is not effective, full stop. And audit scrutiny on the field-action decision path itself — auditors asking to see the last three design changes that addressed safety-relevant modes, and walking through the field-action decision for each. If the answer is we did not make one, that is a finding.My take
I have spent two decades in aerospace and automotive quality — AS9100, EN 9100, IATF 16949. I have been in the room where someone says we know about this one and the question on the table is whether to ship. The line I draw is simple: a known defect with a safety implication is not a commercial decision. It is a quality-system decision, and the standard has already written the answer for you. At SNOP, running quality for a 900-person greenfield plant, I built escalation paths so that a field concern reached my desk within hours. At Airbus, the routing-verification framework I lead cut internal lead time by 97 percent — but the reason it holds is that there is no commercial override on the escalation. When a nonconformity is flagged, it routes. Nobody gets to sit on it. I have walked into external audits — EASA, AS9100 — and walked out clean, not because I am lucky, but because the system surfaces the uncomfortable answer before the auditor has to ask. A 50 percent drop in EASA findings in a single cycle is what happens when escalation is structural, not discretionary. Guidant's $296 million penalty is, in quality-accounting terms, the ultimate cost of poor quality. It is what happens when CoPQ is measured only in scrap and rework, and the cost of silence is left off the ledger until a coroner puts it there.What this means on your floor
- A known failure mode with a fix in production but old units still in the field is an open nonconformity — not a closed project.
- Your change-control system must have a mandatory field-action gate. If the field-action decision is "do nothing," that decision must be documented, signed, and auditable.
- For safety-critical failure modes, the notification trigger is severity, not occurrence. One known case of a lethal mode is enough.
- If your auditors are not asking to see field-action decisions tied to recent design changes, you are being under-audited — and that gap is more dangerous than any finding they could write.
