A medical device used for decades has emerged as a worrisome source of infections, apparently sickening eight patients at a central Pennsylvania hospital - four of whom died.

The device is a heater-cooler unit, widely used during heart bypass surgery to control a patient's blood temperature.

The infections at WellSpan York Hospital and elsewhere are attributed to bacteria in water that circulates within the devices. European researchers and the U.S. Food and Drug Administration both say patients can be exposed to bacteria that are aerosolized through the device's exhaust vent.

The York hospital said Monday that in the last five years, eight of its open-heart surgery patients had contracted infections that were the "probable" result of contamination in three heater-cooler units. That finding came from a joint investigation with the federal Centers for Disease Control and Prevention and the Pennsylvania Department of Health, the hospital said.

The investigation found that the infections were "likely a contributing factor" to the four deaths, the hospital said in a news release.

An internal review found that cleaning protocols "did not align perfectly" with the manufacturer's guidelines, the hospital added. Asked to clarify, WellSpan spokesman Brett Marcy said the units were sometimes not cleaned with bleach.

This month, the FDA said it had received 32 reports worldwide of contamination or infection associated with heater-cooler devices, most in Europe. The agency said it knew of four deaths and 11 serious injuries associated with the heater-coolers.

The agency does not comment on specific hospitals, but the deaths apparently were those announced by the 572-bed teaching facility in York.

The units were made by Sorin Group, an Italian device maker that recently merged into a larger company called LivaNova. This year, the manufacturer told customers that in addition to periodically cleaning the units with bleach, technicians also should fill them with filtered water that has hydrogen peroxide added.

The microbes implicated in the infections are called mycobacteria, which are commonly found in the environment but rarely make people sick.

Patients getting bypass surgery and those with weakened immune systems are more susceptible to problems such as endocarditis and surgical site infections. But the true number of infections that can be blamed on the heater-cooler devices is unclear. Symptoms can develop months after surgery, so the connection may not be readily apparent.

"It wasn't something that jumped out at you when you're only seeing one or two cases a year," said R. Hal Baker, WellSpan's senior vice president for clinical improvement.

ECRI, a Plymouth Meeting-based nonprofit that evaluates medical devices, had never seen any need to warn hospitals of infection risks associated with heater-coolers until the FDA's notice this month, said Bruce C. Hansel, the organization's executive director for accident and forensics investigation.

"It just hasn't come up," Hansel said.

But concerns were raised last year, after four patients died of similar bacterial infections at a Greenville, S.C., hospital. Investigators did not pinpoint a specific device as a culprit, but said patients could have been exposed to the microbes from tap water.

Biomedical engineer Lawrence Muscarella, an infection-control consultant based in Montgomeryville, wrote in June 2014 that among sources of tap water were the heater-cooler devices and ice machines in the operating room.

In an interview Monday, he said federal officials could have taken more steps last year. Hospitals, he said, should be looking immediately for the sources of infection.

"Why are they retrospectively looking back to identify an outbreak?" Muscarella said.

WellSpan's Baker said the York hospital's review began in July, prompted by reports of infections in Europe, a notice about enhanced cleaning steps from the heater-cooler manufacturer, and a heads-up from a Hershey Medical Center physician that two former York patients were being treated there for infection.

While infections were identified in just eight patients, WellSpan officials said that as a precaution, they had sent letters about the infections to 1,300 patients who received open-heart surgery over the last four years.

The state Health Department said it required the hospital in July to replace its heating-cooling units, immediately after a link between the devices and the infections was suspected.

The hospital "is advising current patients that there is no longer a risk of this bacterial exposure," WellSpan said in a statement.

215-854-2430@TomAvril1