Attorney General James Uthmeier Issues Subpoenas to Companies Selling Medical Devices Sending Patient Data to Communist China

TALLAHASSEE, Fla.—Attorney General James Uthmeier is taking legal action against a Chinese manufacturer over potential cybersecurity risks and alleged violations of Florida's Deceptive and Unfair Trade Practices Act. There is evidence that Contec, a Chinese manufacturer of patient monitors that has conducted business in the U.S. for over a decade, concealed serious security problems in its products. 

"Medical devices that record patient data must be secure and should not send data to entities controlled by the Chinese Communist Party," said Attorney General James Uthmeier. "Protecting Americans’ sensitive, personal data from our enemies is paramount, and my office will get to the bottom of this deception."

Issues include a built-in "backdoor" that could allow bad actors to manipulate data shown on the devices without the patient or provider's knowledge and programming that automatically transmits patient information to an IP address owned by a university in China. These problems are especially concerning given that the FBI has warned on previous occasions that hackers are targeting American healthcare systems. Federal agencies have recommended that these monitors be disconnected or disabled.

Contec is a Chinese manufacturer with an American branch in Illinois and sold by American companies, including Epsimed, a Miami-based reseller that has relabeled and sold the monitors at issue under its brand name.

Contec and Epsimed may have violated FDUTPA by: 

• Contec representing that the monitors were FDA-approved, even though the monitors were not FDA-approved;
• Epsimed representing that the monitor “meets international standards such as FDA, CE and ISO,” even though the monitor did not appear to meet any of those standards due to its serious cybersecurity vulnerabilities;
• Representing that the monitor had assurance on product quality when the product did not have the quality, safety and reliability that would be expected, and instead contained a backdoor and transmitted patient information to China;
• Epsimed representing that it was a “leading OEM manufacturer,” when in fact Epsimed was simply selling Contec’s monitor after relabeling it as Epsimed’s own brand;
• Contec and Epsimed omitting material facts about the monitor’s security vulnerabilities; and
• Contec and Epsimed engaging in unfair practices causing consumer harm, such as by selling a monitor that transmitted patient information to China.

Attorney General Uthmeier's action under FDUTPA against Contec and Epsimed may seek damages, civil penalties, and injunctive relief to protect consumers in the future.

# # #