China Device Bill Shows How FDA Cybersecurity Rules Apply to Connected Devices

The US Senate may soon consider a bill that would have regulators review China-made medical devices for cybersecurity risks, In Compliance Magazine reported on July 16. The magazine said the Countering Chinese Cyberthreats for Patients Act would require FDA and the Cybersecurity and Infrastructure Security Agency to evaluate legacy China-made networked devices and recall those found to pose a risk.

The bill's cutoff date is the key to how it fits with existing law. It reaches devices cleared before FDA's current cybersecurity requirements took effect.

What the bill would do

According to the introduced text, S. 4939 was filed by Sen. Tom Cotton on June 24, 2026, and referred to the Committee on Health, Education, Labor, and Pensions. It defines a covered device as a networked device made by a manufacturer headquartered in, or owned or controlled by, the People's Republic of China, and cleared, authorized, approved or exempted through the 510(k), De Novo, premarket approval or humanitarian device exemption pathways on or before March 28, 2023.

Within 180 days of enactment, HHS, acting through FDA and in consultation with CISA, would request information from each covered manufacturer, including a software bill of materials and the locations of entities, systems and servers holding patient data. Within 18 months, FDA would have to order a halt to distribution of devices found to pose a cybersecurity risk and notification of health professionals and affected individuals. The same order would apply to a device whose maker failed to supply the information within 180 days. HHS could exempt a device if a recall would create a shortage posing a danger to patient health.

The March 2023 line

The date tracks a change in federal law. FDA's cybersecurity FAQ page explains that the Consolidated Appropriations Act, 2023, signed on Dec. 29, 2022, added section 524B to the Federal Food, Drug, and Cosmetic Act. Its requirements do not apply to submissions made before March 29, 2023. A previously authorized device comes under them only when a change requires a new premarket submission.

Section 524B applies to a cyber device, which FDA describes as one that includes software, can connect to the internet, and has technological characteristics that could be vulnerable to cybersecurity threats. Sponsors of 510(k), De Novo, premarket approval, product development protocol and humanitarian device exemption submissions for such devices, including supplements, must do three things:

• submit a plan to monitor, identify and address postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure;
• design, develop and maintain processes that give reasonable assurance the device and related systems are cybersecure, and make updates and patches available; and
• provide a software bill of materials covering commercial, open-source and off-the-shelf components.

FDA says a temporary policy of not refusing incomplete submissions expired on Oct. 1, 2023. Since then, a 510(k) filed through the agency's eSTAR template can be put on a technical screening hold if its cybersecurity section lacks accurate responses and attachments.

The legacy device problem

Devices on the market before 2023 were not reviewed against those requirements. In a safety communication first issued on Jan. 30, 2025, FDA said software on Contec CMS8000 patient monitors, and Epsimed MN-120 monitors relabeled from them, “includes a backdoor.” The agency said that once connected to the internet the monitor begins gathering patient data and sending it outside the health care environment. FDA also said it was not aware of any cybersecurity incidents, injuries or deaths related to the vulnerabilities. A July 2025 update reported a Contec patch that removes the monitors' networking functions.