Health Law Daily Wrap Up, MEDICAL DEVICES NEWS—Cotton Warns FDA About Cyber Vulnerabilities in Chinese-Made Medical Devices, (May 27, 2026)

By Tom Leithauser

Data contains sensitive medical information that could lead to identify theft and other scams.

Medical devices manufactured in China pose privacy and cybersecurity risks to U.S. patients and should receive special scrutiny from the Food and Drug Administration, according to Sen. Tom Cotton (R., Ark.), chairman of the Senate Intelligence Committee.

“American patients' exposure to compromised Chinese-made medical devices poses a risk to both national security and public health,” Sen. Cotton said in a letter sent yesterday to Kyle Diamantas, the FDA’s acting commissioner.

Sen. Cotton noted that the FDA started requiring medical device manufacturers “to demonstrate enhanced cybersecurity safeguards to receive FDA pre-market clearance in 2023” (CPR, Sept. 27, 2023).

“But this requirement did not extend to medical devices on the market prior to the enactment of the enhanced cybersecurity requirements. Thus, more must be done to protect Americans from compromised medical devices,” he said.

In 2025, the FDA and Cybersecurity and Infrastructure Security Agency issued a warning about data security vulnerabilities in a Chinese-made heart monitoring device, Sen. Cotton recalled.

“The FDA found the device would automatically extract personally identifiable patient health information when connected to the internet. Data exfiltration of sensitive medical information can lead to widespread identity theft, insurance fraud, extortion, and more sophisticated scams against American patients,” Sen. Cotton told Mr. Diamantas.

“CISA also warned the device was programmed to allow unverified users to remotely control the device without a health provider's knowledge. This gave malign Chinese actors an opportunity to directly manipulate how the device operates and displays data, potentially leading to dangerous misdiagnoses of heart failure, arrhythmias, and hypertension,” he said.

“I respectfully ask the FDA and CISA to review Chinese-made medical devices cleared prior to March 29, 2023,” Sen. Cotton requested. “Protecting Americans' privacy and ensuring their health data isn't accessible to cybercriminals in adversarial nations is of utmost importance.”

IndustryNews: NewsStory AgencyNews MDNews FDCActNews MDeviceNews