Secure Software Updates for Medical Devices?

[In April 2010, I wrote the following incomplete draft post about software updates for medical devices after the automatic anti-virus snafu in hospitals.  More than two years later, I figure it's time to release this paragraph warts and all.]

Software updates are hard to write well. One example is the McAfee update that reportedly caused thousands of computers to get stuck repeatedly rebooting. I am often asked why it's hard to automatically securely update software on a medical device. I think the example from McAfee is illustrative: what does a person do when a software update goes awry? For a desktop computer, one can call tech support and grab a cup of coffee until the computer is repaired. With a medical device, there is much less room for error and the consequences of downtime (or erroneous operation) potentially higher. Software updates are hard to get right for personal computing, and software updates for medical devices have less wiggle room for error.