for any covered device for which the covered manufacturer fails to submit the information requested under subsection (a)(2)(A) by the date that is 180 days after the date on which such covered manufacturer received such request, the Secretary shall issue for such covered device an order requiring the appropriate person... to immediately cease distribution of such covered device.
Require recalls and immediate distribution stoppages for covered Chinese-made medical devices if the manufacturer fails to provide requested cybersecurity-review information within 180 days.
Occurrences
Evidence
Cotton's office says he introduced the Countering Chinese Cyberthreats for Patients Act to have FDA review and recall Chinese-made networked medical devices.
The bill text requires HHS/FDA, with CISA, to request cybersecurity-review information from covered Chinese manufacturers and issue orders to immediately cease distribution when a manufacturer misses the 180-day response deadline.
Cotton asked FDA and CISA to review Chinese-made medical devices cleared before March 29, 2023, citing cybersecurity vulnerabilities and patient-data risks.
FDA says current section 524B cybersecurity requirements apply to cyber-device premarket submissions and do not apply to applications submitted before March 29, 2023.
FDA identified Contec/Epsimed patient-monitor vulnerabilities, including remote-control risk, a backdoor, and patient-data exfiltration, and advised some users to unplug and stop using affected devices.
FDA's recall database lists a Class 2 recall for the CMS8000 Patient Monitor, initiated April 10, 2025, posted May 14, 2025, and still open/classified.
Assessments
Cotton introduced the Countering Chinese Cyberthreats for Patients Act in June 2026, and the bill text closely matches the promise by requiring HHS/FDA and CISA review of covered Chinese-made networked medical devices and immediate cease-distribution/notification orders if manufacturers fail to provide requested cybersecurity information within 180 days. However, the record provided and current public evidence show proposed legislation and related pressure on FDA, not enactment of a binding federal recall-and-stoppage requirement. Existing FDA actions and a Contec recall address narrower device-specific risks but do not deliver the broader statutory mechanism promised.