Texas Governor orders cybersecurity audit of Chinese medical devices over data breach risks

AUSTIN, Texas - Texas Governor Greg Abbot released a letter today, directing state agencies and state-owned medical facilities in Texas to review cybersecurity policies to potentially address cybersecurity concerns that are linked to medical equipment manufactured in China.

The FDA headquarters in Washington, D.C. (iStock / Getty)

In the letter, Abbott directed health agencies and public university systems to review cybersecurity and procurement policies to protect Texans from medical information data breaches.

On Jan. 2026, the Trump Administration’s Cybersecurity and Infrastructure Security Agency (CISA) and the federal Food and Drug Administration (FDA) released a series of notices describing security vulnerabilities found in Chinese-manufactured patient monitoring devices. One of the risks includes the possibility of unauthorized actors accessing protected health information remotely.

It is the U.S. FDA's duty to regulate medical devices before and after entering the market. Once those devices are deployed, the FDA continues to monitor medical devices through post-market examination.

When risks are identified, the FDA issues alerts and recommendations to reduce harm.

According to Governor Abbott, these FDA and CISA notices underscore the need for state agencies and state-owned medical facilities to ensure they are continually operating in safe and secure environments.

The governor warns that these notices confirm the warnings of experts who have elevated the "proliferation of Chinese-manufactured smart medical devices" across the Texas healthcare system as a serious data privacy concern.

More specifically, on January 30, 2025, the FDA issued a notice raising Cybersecurity Vulnerabilities with Certain Patient Monitors from Contec and Epsimed: FDA Safety Communication, in which the FDA warned that certain patient monitors contained vulnerabilities that allow unauthorized access, manipulation of devices, and the exfiltration of sensitive patient data, creating meaningful risks for patients.

CISA similarly warned that certain Chinese-manufactured monitors contain a "backdoor" through which the device could be controlled remotely and patient data accessed.

"Maintaining Texans’ physical security and protecting their personal privacy, especially personal medical data, is of paramount importance," said Governor Abbott. "I will not let Communist China spy on Texans. State-owned medical facilities must ensure there are safeguards in place to protect Texans’ private medical data and our critical medical infrastructure."

Governor Abbott addressed health agencies and state-owned medical facilities with the following directives:

The addressed agencies are to submit reports and recommendations in response to Governor Abbott's directives by April 17, 2026.

The Source: Information in this article was provided by the Office of the Texas Governor.