Countering CCP Act
- Sponsor
- Sen. Cotton, Tom [R-AR]
- Committees
- Health, Education, Labor, and Pensions Committee (primary)
- Last action
- Jun 24, 2026
Bottom line
This bill aims to enhance patient safety and national security by identifying and removing potentially vulnerable Chinese-manufactured medical devices from the U.S. healthcare system, but could lead to supply chain disruptions.
What it actually does
This bill mandates the Secretary of Health and Human Services, acting through the FDA and in consultation with CISA, to review networked medical devices manufactured by entities headquartered in or controlled by the People's Republic of China for potential cybersecurity issues. It grants the Secretary authority to order recalls for devices found to pose a cybersecurity risk or for which manufacturers fail to provide requested information, with an exemption for recalls that would create a dangerous shortage to patient health.
Proponents argue
Proponents argue the bill is crucial for national security and patient safety, protecting sensitive patient data and critical healthcare infrastructure from potential cyberattacks or espionage originating from the People's Republic of China. They would assert that the current reliance on foreign-manufactured devices, especially from geopolitical rivals, poses an unacceptable risk, and this bill provides necessary oversight and recall authority to mitigate those threats.
Opponents contend
Opponents might contend that the bill could disrupt the supply chain for essential medical devices, potentially leading to shortages, increased costs, and delayed patient care, especially if a broad recall is implemented without sufficient alternatives. They might also argue that it could be seen as protectionist or discriminatory, potentially inviting retaliatory measures from China, and that existing regulatory frameworks might be sufficient with enhancements.
The bill is short and relatively straightforward, allowing for a quick and informed assessment by interested parties.
Section 2(a)
Mandatory Cybersecurity Review of Covered Devices
This provision requires the Secretary of Health and Human Services, through the FDA and in consultation with CISA, to review all 'covered devices' for potential cybersecurity issues. It mandates requesting specific information from manufacturers, including software bills of materials and data storage locations, to ensure devices are cybersecure and patient data is not stored or transferred through systems in or controlled by the People's Republic of China.
Supporters argue
Supporters argue this review is essential to identify and mitigate cybersecurity vulnerabilities in critical medical devices, protecting patient health information and national security infrastructure from foreign adversaries. They emphasize the need for transparency regarding software components and data handling.
Critics contend
Some manufacturers might argue that the information requested is proprietary and that sharing it could pose competitive disadvantages or intellectual property risks. They might also contend that existing cybersecurity standards are adequate and this adds an unnecessary layer of bureaucracy.
Tradeoffs
Balances national security and patient data protection against potential burdens on manufacturers and concerns about intellectual property disclosure.
Section 2(b)
Mandatory Recall for Cybersecurity Risks or Non-Compliance
This section grants the Secretary authority to order an immediate recall of covered devices found to pose a cybersecurity risk after the review, or if the manufacturer fails to provide the requested information. The recall order includes ceasing distribution, notifying health professionals and facilities to stop use, and notifying affected individuals. An exemption exists if a recall would create a dangerous shortage.
Section 2(c)
Congressional Report on Device Industry Cybersecurity and Market Share
This provision requires the Secretary, in consultation with CISA, to submit a report to relevant Congressional committees within two years. The report must detail the cyber preparedness of the U.S. device industry, analyze the market share of Chinese-headquartered manufacturers, examine data security requirements for Chinese-made devices, and recommend ways to bolster U.S. industry cyber preparedness.
Defines "covered device" as a networked device manufactured by a "covered manufacturer" that was cleared, authorized, approved, or exempted under specific sections of the Federal Food, Drug, and Cosmetic Act on or before March 28, 2023. This means it applies to existing devices, not new ones after that date, and only those that are "networked."
Section 2(d)(1)
Why it matters:Standard legislative practice to define terms precisely, but the implications of the date and "networked" criteria are significant.
Case for: Supporters would argue that focusing on existing devices ensures immediate action on current risks, while the "networked" criteria targets devices most vulnerable to cyber threats. The cutoff date prevents the bill from being seen as an immediate ban on future devices.
Case against: Critics might argue that limiting it to devices cleared by a specific date misses newer, potentially equally vulnerable devices. The "networked" definition could also be seen as too narrow, as non-networked devices can still be compromised if connected to vulnerable systems.
Estimated impact: Limits the scope of the review and recall to a specific subset of devices, potentially reducing immediate market disruption but also limiting the comprehensiveness of the cybersecurity assessment.
Defines "covered manufacturer" as one headquartered in the People's Republic of China (PRC) or owned/controlled by the PRC or individuals/entities of the PRC. Crucially, it excludes manufacturers with operations, subsidiaries, or publicly traded securities in the PRC if they are not otherwise described in the primary definition.
Section 2(d)(2)
Why it matters:Standard legislative practice for precise definitions, but the exclusion clause is a key political compromise or clarification.
Case for: Proponents would argue this definition targets entities with direct ties to the PRC government or its influence, while avoiding penalizing companies that merely have a presence there for manufacturing or market access, thus focusing on genuine national security concerns.
Case against: Critics might argue that the exclusion is too broad, potentially allowing entities with significant PRC ties to evade scrutiny if their ultimate control isn't directly from the PRC government or its citizens, thereby creating loopholes.
Estimated impact: Significantly limits the number of manufacturers and devices subject to the bill's provisions, focusing the regulatory effort on a more targeted group.
The Secretary may exempt a covered device from a recall order if the recall would "create a shortage that would pose a danger to patient health."
Section 2(b)(3)
Why it matters:This is a crucial practical carve-out, likely included to address concerns about patient access and avoid unintended negative health consequences, balancing security with immediate patient needs.
Case for: Proponents would highlight this as a responsible safeguard, demonstrating that the bill prioritizes patient health by allowing flexibility to prevent critical device shortages, ensuring that security measures do not inadvertently harm patients.
Case against: Critics might argue that this exemption could be exploited or broadly applied, undermining the bill's intent to remove risky devices. They might question the criteria for determining "danger to patient health" and the transparency of such exemption decisions.
Estimated impact: Provides a critical safety valve for the healthcare system, potentially preventing widespread disruption and ensuring continued access to essential medical devices even if they are deemed cyber-risky.