Gov. Greg Abbott has directed state health agencies and public university systems to review potential cybersecurity risks associated with certain Chinese-manufactured medical devices following federal warnings that the equipment could allow unauthorized access to patient data.
The directive comes more than a year after federal regulators first warned that some internet-connected patient monitoring devices made in China contained cybersecurity vulnerabilities.
In a letter sent Monday to the Texas Health and Human Services Commission, the Texas Department of State Health Services, Texas Cyber Command, and public university system leaders, Abbott ordered officials to assess cybersecurity protections and inventory network-connected medical devices in state-owned facilities.
“Maintaining Texans’ physical security and protecting their personal privacy, especially as it relates to something as important and intimate as personal medical data, is of paramount importance,” Abbott wrote. “I will not let Communist China spy on Texans. State-owned medical facilities must ensure there are safeguards in place to protect Texans’ private medical data.”
The directive references federal warnings issued by the U.S. Food and Drug Administration and the Cybersecurity and Infrastructure Security Agency about vulnerabilities in certain Chinese-manufactured patient monitoring devices.
Specifically, the federal advisory warned that Contec CMS8000 patient monitors and Epsimed MN-120 monitors could allow unauthorized actors to remotely control the device, bypass cybersecurity protections, and access sensitive patient information if connected to the internet.
The FDA said the devices contain three cybersecurity vulnerabilities, including a potential “backdoor” that could allow unauthorized users to access the device or network and exfiltrate patient data such as personally identifiable information and protected health information.
The advisory was originally issued all the way back on January 30, 2025, though Abbott’s letter incorrectly referenced January 30, 2026. Abbott’s office told Texas Scorecard the discrepancy was a “scrivener’s error.”
Under Abbott’s directive, the Texas Health and Human Services Commission, the Department of State Health Services, and public university systems must review procurement policies to confirm that new medical device purchases comply with existing state restrictions on certain foreign technology.
Those agencies must also compile an inventory of all state-owned medical devices capable of transmitting data over a network or being accessed remotely and provide that information to Texas Cyber Command.
Texas Cyber Command will evaluate whether the devices referenced in the federal advisory—or other equipment flagged by federal safety notices—should be added to the state’s prohibited technology list.
Abbott directed agencies to submit their findings and recommendations to his office by April 17.
The governor also indicated he plans to pursue legislation addressing the issue during the next legislative session.
