HEALTH
Dana Goldman has lived with Type 1 diabetes for more than 30 years, cycling through generation after generation of FDA-approved glucose monitors and insulin pumps, upgraded roughly every five years, each one covered by his insurance and blessed by federal regulators. And for 30 years, his blood sugar control slowly, stubbornly got worse anyway.
Then his own physician told him to try something the government has never approved: free, open-source software, written not by a pharmaceutical giant or medical device company but by patients who got fed up waiting. Goldman — who happens to be the founding director of the USC Schaeffer Institute for Public Policy and Government Service, and no stranger to how Washington works — downloaded it onto his iPhone. “This new code is a revelation,” he wrote this week in a striking essay for the health news outlet STAT. “It fine-tunes my insulin delivery in a manner no FDA-approved systems could. I am now meeting guidelines that had previously eluded me, and I’m feeling great. All of this is free.”
He is far from alone. Across the country, a growing underground of Type 1 diabetics has been quietly bypassing the official, FDA-regulated diabetes technology market altogether — building their own artificial pancreas systems out of open-source code, and by most accounts, thriving.
THE MOVEMENT WASHINGTON NEVER SAW COMING
The rebellion has a name — #WeAreNotWaiting — and it traces back more than a decade, to 2013, when a Type 1 diabetes patient named Dana Lewis grew tired of one specific, maddening problem: the alarm on her continuous glucose monitor wasn’t loud enough to wake her up during a dangerous overnight low. Rather than wait years for a manufacturer to fix it, Lewis and collaborator Scott Leibrand got their hands on privately shared code written by another frustrated patient, John Costik, and began building their own solution.
By 2014, using off-the-shelf hardware and homemade software, Lewis had built one of the world’s first do-it-yourself hybrid closed-loop artificial pancreas systems — a device that automatically adjusts insulin delivery based on real-time glucose readings, functioning much like a healthy pancreas would. She open-sourced the code as OpenAPS, deliberately designing it to reach patients directly rather than wait for clinical trials and regulatory sign-off that could take a decade or more.
What started as one determined patient's fix for a personal problem has since splintered into a small ecosystem of interconnected open-source projects — OpenAPS, Loop, AndroidAPS, and the newer app Trio — all built and maintained largely by volunteer patients, parents of diabetic children, and sympathetic engineers, none of them approved by the FDA as medical devices.
HOW A GROUP OF PATIENT-HACKERS BUILT A BETTER PANCREAS
These aren’t crude hobbyist hacks. Modern open-source automated insulin delivery apps like Loop, AndroidAPS and Trio are assembled from detailed, publicly available step-by-step build guides, and users don't need to know how to write a line of code to install and run them. What they offer, users and diabetes educators say, is a level of customization that commercial, FDA-cleared systems simply don't allow: adjustable algorithm targets, remote insulin dosing from a phone, temporary override settings for exercise or illness, and rapid software updates that can arrive in weeks rather than years.
According to diabetes technology researchers and clinician resources tracking the space, these systems are now in use by tens of thousands of people worldwide — patients who, in survey after survey and in real-world outcomes data, report glucose control that compares favorably with, and in many individual cases outperforms, commercially available, federally approved alternatives.
The community operates almost entirely outside the traditional health care commercial pipeline. There’s no company selling the software, no marketing budget, no sales reps calling on endocrinologists' offices. Instructions are passed along through patient forums, build documentation sites, and word of mouth — modern medicine’s answer to a barn-raising, assembled one frustrated patient at a time.
THE REGULATOR LEFT IN THE DUST
The FDA, for its part, isn't ignoring what's happening — it simply may not have the tools to keep up. The agency generally regulates medical software as a device, a process built to catch dangerous bugs and verify a product works as intended, but one that Goldman describes as fundamentally mismatched to the speed of modern software development.
“The FDA reviewers are like Ethel and Lucy at the candy factory, outmatched by the speed of the product line,” Goldman wrote, invoking the classic image of an assembly line spiraling out of control. “The pace of software updates is now so rapid that it is turning regulators into impediments to innovation.”
Lowell Schiller, a former head of policy at the FDA whom Goldman consulted for his essay, acknowledged the agency has tried to modernize — exempting certain low-risk wellness applications from review and developing frameworks that let some approved software receive updates without triggering a fresh regulatory process. But those fixes, Schiller noted, only stretch so far under a governing statute that is roughly 50 years old and was designed with physical medical hardware in mind, not iterative, often AI-assisted software development.
One potential fix already exists in blueprint form: a software “pre-certification” pilot program launched during the first Trump administration, which aimed to let the FDA certify a software developer's internal processes and quality controls up front, then grant that developer more latitude to update and iterate within an approved framework — shifting the agency's focus from reviewing every individual product update to vetting the process that produces them. The catch: the pilot could never be fully implemented under the FDA's existing legal authority. It would take an act of Congress to make it real.
IS IT SAFE?
The safety question looms over the entire movement, and it doesn't have a simple answer. The American Diabetes Association's 2026 clinical standards now formally acknowledge that a meaningful number of patients are successfully using open-source automated insulin delivery systems, urging clinicians to stay engaged and keep communication open with patients who choose that route rather than treat the choice as taboo.
Diabetes technology researchers note that, despite lacking FDA approval, open-source systems have accumulated what they describe as a strong real-world safety record over more than a decade of use, with outcomes that compare favorably to many commercial closed-loop systems in published data and patient-reported outcomes. But “strong safety record” is not the same as “FDA-verified,” and that distinction carries real weight. There's no federal recall system watching these apps, no mandatory adverse-event reporting pipeline feeding into a government database, and no guarantee that the volunteer developers maintaining the code today will still be doing so next year.
Goldman, who has spent his career studying health policy, is blunt about the trade-off he's personally making. “I am also a health economist, and I know using this software is a gamble,” he wrote. “This technology has been developed outside FDA's oversight.”
WHAT WASHINGTON COULD DO NEXT
The clock on this debate may be ticking faster than most patients realize. Next year, Congress is scheduled to reauthorize the FDA's five-year medical device user fee agreement — the negotiated deal between the agency and industry that funds roughly half of the FDA's human medical product review budget. Those negotiations, due to be submitted to Congress for debate in January, are seen by policy watchers as one of the few realistic openings to attach statutory reforms that could finally let the agency regulate fast-moving software — including open-source, patient-built code — more effectively.
Without that kind of reform, Goldman warns, the current split-track system will simply keep growing: one lane for slow, expensive, FDA-blessed commercial devices, and a parallel, unregulated lane where increasingly sophisticated patients and their doctors go around the system entirely. “It is no longer possible to ask the FDA to keep pace with software development by doing the same reviews faster, or with more people,” he wrote. “In a world of machine learning and generative AI, the FDA needs the tools to adapt.”
WHAT THIS MEANS FOR YOU
If you or a family member has Type 1 diabetes and manages it with an insulin pump and continuous glucose monitor, this is a conversation worth raising with your endocrinologist, not a decision to make alone off a forum post. Open-source systems like Loop, AndroidAPS and Trio require a genuine understanding of the risks involved, ongoing troubleshooting, and a willingness to rely on a support community rather than a manufacturer's customer service line.
The upside, according to patients like Goldman and the broader #WeAreNotWaiting community, can be real and significant: tighter glucose control, fewer dangerous overnight lows, and features that FDA-approved commercial systems still don't offer years later. The 2026 ADA standards now explicitly tell clinicians not to shut the door on patients who bring this up — a meaningful shift from a few years ago, when many doctors were reluctant to even discuss unapproved technology. If you're considering it, ask your care team whether they have experience with open-source automated insulin delivery, and lean on established patient communities and documentation rather than going it alone.
THE BOTTOM LINE
More than a decade after Dana Lewis first hacked together a louder alarm for her glucose monitor, the movement she helped spark has grown into something the federal government still hasn't figured out how to regulate — a sprawling, patient-built alternative to an entire category of federally approved medical devices, sustained not by venture capital or FDA sign-off but by volunteers, forums, and sheer necessity.
For Goldman and tens of thousands of others like him, the software has already delivered what three decades of federally blessed technology couldn't. The question now isn't really whether open-source diabetes technology works — the patients using it say it already does. It's whether Washington can rewrite half-century-old rules fast enough to catch up with the people who stopped waiting for it.
