RegulatoryOfficial

Health Canada flags cybersecurity flaw in GE HealthCare's Centricity Universal Viewer in Type II recall

🇨🇦 Health Canada · Thu 12 Nov 2026

Health Canada has listed a recall of Centricity Universal Viewer software over a vulnerability that could allow unauthorised access to patient data when launched from third-party applications.

Health Canada has published a Type II recall for GE HealthCare's Centricity Universal Viewer, citing a cybersecurity vulnerability. The notice, identified as RA-82948, was published on 12 November 2026, with a recall date of 30 October 2026.

According to the notice, the vulnerability affects Centricity Universal Viewer (UV) and Centricity PACS-IW (PACS-IW) when they are launched from third-party applications using an unencrypted URL method. The regulator says an unauthorised individual could gain access to the system and potentially view and manipulate patient data. Such access could also expose protected health information.

The affected product is listed as Universal Viewer - System Feature software version 7.0 through UV7.0 SP2.0.1, with the identifier 00840682145794. The manufacturer is named as GE HealthCare IITS USA Corp, also doing business as GE HealthCare, of Chicago, Illinois. The device falls under the radiology category of medical devices, and the issue is classed as a performance problem.

The notice directs healthcare users to contact the manufacturer if they need additional information. It does not describe a corrective action, a fix or a software update, and it does not report any incidents or harm to patients.

For context, a Type II recall in Canada generally covers situations where use of the product may cause temporary or medically reversible health effects, or where the likelihood of serious harm is remote.

What it means for your team

  • Healthcare organisations running Universal Viewer versions 7.0 to UV7.0 SP2.0.1 should check whether third-party applications launch the viewer through unencrypted URLs, and contact GE HealthCare for further information.
  • Quality and device-vigilance teams should note the recall as a cybersecurity-driven performance issue, with possible exposure of protected health information.
  • The Health Canada notice gives no remediation details, so teams should seek manufacturer guidance rather than assume a fix is available.

Official source: Health Canada ↗

Article written by VigiEye from the official source (Health Canada). AI-assisted; check the source before acting.

More Regulatory All →