Every day, Americans walk into hospitals trusting that the machines keeping watch over their hearts are working for them. Most have no idea that some of those machines may be working for Communist China.
Last year, FDA and federal cybersecurity officials issued a warning about a patient monitor called the Contec CMS8000, a medical device used routinely in American hospitals to track heart rate, blood pressure, and electrocardiograms. Investigators found a back door built into the software. Not a simple glitch, but a highly technological avenue to siphon patient data out of our health care facilities and into outside remote servers. The company that manufactures the Contec monitor is based in China.
A machine designed to help doctors and hospitals make life or death decisions conveniently was capable of sending sensitive patient data straight home to Beijing.
This is the China playbook. I have seen it used against our transit systems, which is why I fought to pass the bipartisan STOP China Act to block U.S. tax dollars from purchasing buses and rail cars built by Chinese government-backed manufacturers. I have seen it in our homes, phones, even the power grid. I introduced the PROTECT the Grid Act because once a device tied to the CCP connects to your network, Beijing is capable of exploiting it. The same is true, and may be even more dangerous, when that technological device is sitting in a hospital’s intensive care unit.
Under Chinese law, no company in China can refuse a government data request. There are no exceptions, workarounds, or opt-outs. Every device made by a Chinese manufacturer is a potential instrument of Beijing, no matter how simple or innocuous. Medical devices are critical because health data and records like diagnoses, medications, and biometric readings are among Americans’ most highly protected and sensitive information.
The FBI reported that in a single year period, the health care industry faced more cyberattacks than any other critical infrastructure sector in the country. A cyberattack on one of the largest hospital systems in America with 140 facilities left nurses locked out of electronic health records and nearly caused a deadly medication error involving a newborn. An Alabama mother sued her hospital after her baby died, alleging that the facility never told her it was in the middle of a ransomware attack when she went into labor. This year, a ransomware attack knocked out systems across 14 medical centers run by Kettering Health in Ohio.
These are real consequences that many have been too slow to take seriously.
The Department of Commerce has opened a national security investigation into medical devices under Section 232 of the Trade Expansion Act. That is an excellent start.
Now it is time for Congress to step up. We must cut off federal health care dollars – Medicaid, Medicare, all of it – from any hospital or clinic that purchases medical devices from Chinese companies. We must phase Chinese-made medical equipment out of every facility accepting federal funding. We must pass laws making foreign medical data espionage a criminal offense. And we must use every trade enforcement tool available to make clear that Chinese medical equipment will never again be treated as just another product on a procurement list, because it is not.
I have spent years fighting to hold Communist China accountable because I know that as our strategic adversary they want to harm Americans. They want to win, and they are willing to use your hospital room to do it.
American patients deserve better. They deserve to have confidence that the medical machines watching over them in vulnerable moments belong to American doctors and hospitals, not Beijing.
I am ready to lead the fight in the Senate to protect American health care data, and I invite my colleagues on both sides of the aisle to join me. Communist China is playing the long game. It is past time we started playing ours – and playing to win.
