Texas Gov. Orders State Review of Chinese-Made Medtech

Texas Gov. Greg Abbott ordered state agencies to review foreign-made connected medical devices – especially those from Chinese manufacturers – used in state-owned facilities for cybersecurity issues that could pose risks to patients and healthcare infrastructure.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The March 9 order is part of a wider campaign by the Republican governor “to protect Texans from hostile foreign adversaries like the Chinese Communist Party.”

The directive instructs the state department of health, state university chancellors and the Texas Cyber Command Center to review whether Chinese-made Contec CMS8000 and Epsimed MN-120 patient monitors are in use at state facilities and whether they should be added to the state’s list of banned technologies.

Those patient monitors were at the center of Food and Drug Administration and Cybersecurity Infrastructure and Security Agency alerts in January 2025 after researcher found the devices contain a “hidden backdoor” (see: Alarming Backdoor Hiding in 2 Chinese Patient Monitors).

“The FDA warned that certain patient monitors contained vulnerabilities that allow unauthorized access, manipulation of devices and the exfiltration of sensitive patient data, creating meaningful risks for patients,” Abbott said.

CISA similarly “warned that certain Chinese-manufactured monitors contain a ‘backdoor’ through which the device could be controlled remotely and patient data accessed,” Abbot wrote.

Abbott’s office did not immediately respond to Information Security Media Group’s request for comment on why the governor issued the review of the Contec and Epsimed monitors on March 9, considering that federal officials warned about the risks more than a year ago.

In addition to reviewing whether the Contec CMS8000 and Epsimed MN-120 patient monitors are in use at state healthcare and educational facilities, Abbott ordered the agencies to take several other steps to review connected medical devices that could pose potential cyber risks.

That includes ordering state health and higher education agencies to catalog and transmit to the Texas Cyber Command an inventory of all state-owned medical devices capable of transmitting data via a network or that can be accessed remotely. Agencies must also review cyber policies implemented to protect personal health information at state-owned medical facilities.

While the Texas efforts could help the state to better identify and monitor medical devices for potential cybersecurity issues, the Health Information Sharing and Analysis Center has seen no evidence indicating a rising foreign threat targeting medical devices, said Phil Englert, vice president of medical device security at Health-ISAC.

The Health sector organization supports efforts to bring medical practices and cybersecurity experts together, he said. “Health-ISAC supports this type of collaborative approach and encourages agencies to pair inventory efforts with basic protections that strengthen resilience across medical devices and IoT systems,” Englert said.

Important medical device security practices all healthcare entities should implement include maintaining an accurate device inventory, segmenting and isolating devices based on risk, strengthening identity and access controls, applying patches or compensating controls, monitoring device communication patterns and establishing incident response plans tailored to medical device groups, Englert said.

Contec Medical Systems, which manufactures both the Contec and Epsimed patient monitors that are the subject of Abbott’s review, did not immediately respond to a request for comment.

The Contec CMS8000 and the Epsimed MN-120 patient monitors in 2022 was also identified by researchers as having other serious vulnerabilities in those same products, including flaws that could facilitate equipment denial of service and device tampering (see: CISA Warns of Contec Patient Monitoring Device Flaws).

The FDA, in an updated advisory in July 2025, said that Contec had issued patches to address the vulnerabilities.