Sen. Tom Cotton (R-AR) voiced concerns to the Food and Drug Administration (FDA) on Tuesday about cybersecurity issues with networked medical devices made in China.
“I write to express concerns regarding cybersecurity vulnerabilities associated with networked medical devices manufactured in China. American patients’ exposure to compromised Chinese-made medical devices poses a risk to both national security and public health,” Cotton wrote to Kyle Diamantas, the Acting Commissioner of the U.S. FDA.
Cotton noted that the FDA and the Cybersecurity and Infrastructure Security Agency (CISA) notified parties of cybersecurity issues associated with the Contec CMS8000, a network patient monitoring device manufactured in China. He explained the issues with such medical devices made in China:
The FDA found the device would automatically extract personally identifiable patient health information when connected to the internet. Data exfiltration of sensitive medical information can lead to widespread identity theft, insurance fraud, extortion, and more sophisticated scams against American patients. CISA also warned the device was programmed to allow unverified users to remotely control the device without a health provider’s knowledge. This gave malign Chinese actors an opportunity to directly manipulate how the device operates and displays data, potentially leading to dangerous misdiagnoses of heart failure, arrhythmias, and hypertension. On May 14, 2025, FDA issued a Class II recall of the Contee CMS8000.
He continued, “The FDA started requiring medical device manufacturers to demonstrate enhanced cybersecurity safeguards to receive FDA pre-market clearance in 2023. But this requirement did not extend to medical devices on the market prior to the enactment of the enhanced cybersecurity requirements. Thus, more must be done to protect Americans from compromised medical devices.”
Cotton requested that the FDA and CISA review Chinese-made medical devices cleared prior to March 2023.
He concluded in his letter, “Protecting Americans’ privacy and ensuring their health data isn’t accessible to cybercriminals in adversarial nations is of utmost importance. I look forward to working with you on this matter.”