Florida Attorney General Sues Chinese Medical Device Manufacturer Over Cybersecurity Risks and Deceptive Practices

Florida Attorney General James Uthmeier has initiated legal action against Contec, a Chinese manufacturer of patient monitors, and its Miami-based reseller, Epsimed, alleging severe cybersecurity risks and violations of Florida’s Deceptive and Unfair Trade Practices Act (FDUTPA). The lawsuit claims Contec concealed serious security flaws in its products, which could compromise sensitive patient data.

“Medical devices that record patient data must be secure and should not send data to entities controlled by the Chinese Communist Party,” said Attorney General James Uthmeier. “Protecting Americans’ sensitive, personal data from our enemies is paramount, and my office will get to the bottom of this deception.”

The investigation uncovered critical issues with the patient monitors, including a built-in “backdoor” that could allow unauthorized individuals to manipulate data displayed on the devices without the knowledge of patients or providers. Furthermore, the devices are programmed to automatically transmit patient information to an IP address owned by a university in China. These findings are particularly alarming given previous warnings from the FBI about hackers targeting American healthcare systems. Federal agencies have recommended that these specific monitors be disconnected or disabled.

Contec, a Chinese manufacturer with an American branch in Illinois, sold these monitors to American companies, including Epsimed, a Miami-based reseller. Epsimed then relabeled and sold the monitors under its own brand name.

The legal action alleges that both Contec and Epsimed may have violated FDUTPA through several deceptive practices:

• False FDA Approval: Contec allegedly represented that the monitors were FDA-approved, despite lacking such approval.
• Misrepresentation of Standards: Epsimed claimed the monitors met international standards like FDA, CE, and ISO, even though their cybersecurity vulnerabilities likely prevent them from meeting these standards.
• Compromised Product Quality: Both companies allegedly assured product quality, but the monitors contained a backdoor and transmitted patient data to China, compromising their safety and reliability.
• False OEM Claims: Epsimed misrepresented itself as a “leading OEM manufacturer” when it was simply relabeling and reselling Contec’s monitors.
• Omission of Material Facts: Contec and Epsimed are accused of concealing critical information about the monitors’ security vulnerabilities.
• Unfair Practices: Both companies allegedly engaged in unfair practices by selling monitors that transmitted patient information to China, causing consumer harm.

Attorney General Uthmeier’s legal action under FDUTPA may seek damages, civil penalties, and injunctive relief to protect consumers from future harm.