Rongtao Medical releases framework for legacy ultrasound cybersecurity decisions
Rongtao Medical says its report draws on FDA, CISA and OEM records to help decide whether legacy ultrasound systems should be patched, segmented, isolated or replaced.
Rongtao Medical says it has published a report outlining how to decide whether a legacy ultrasound system should be patched, segmented, isolated or replaced.
The Guangzhou-based company says the report draws on FDA clearance records, CISA advisories, adverse-event data and OEM support notices. It says supportability, rather than age alone, should guide how hospitals and service teams handle older ultrasound equipment.
The report says many ultrasound systems remain in service after software or hardware support changes. Rongtao Medical says the issue is not just how old a machine is, but whether its software, components, security controls and physical parts can still be maintained.
What the report says
According to the release, the framework uses five timelines: clinical usefulness, OEM product support, software and component support, security-control supportability and physical serviceability.
The company says its review found 2,066 FDA 510(k) clearances for cart and console ultrasound systems from 1977 through mid-2026. It says 90.1% of those clearances came before Section 524B cyber-device requirements took effect on March 29, 2023.
Rongtao Medical also says every console cleared between 2006 and 2020 predates the statute. It describes clearance volume as flat at 55 to 83 systems per year, which it says means older systems do not simply age out on ordinary planning horizons.
The release says the company also reviewed 18 individually verified CISA medical advisories affecting imaging products. It says half left at least one named product with no software fix at the time of publication.
For ultrasound product lines, the release says all four advisories named incomplete patch coverage and relied on network restriction, physical access control or replacement.
Context and background
Rongtao Medical says the federal Known Exploited Vulnerabilities catalog has a 21-day median remediation clock and names no diagnostic-imaging manufacturer among its 276 vendors. It also says FDA adverse-event reports since 2019 include zero of 8,525 ultrasound reports mentioning ransomware, malware, cybersecurity, hacking or a virus.
The release says FDA’s recall database has one ultrasound cybersecurity recall, from 2008.
Rongtao Medical says it is not a cybersecurity vendor and does not develop patches. Instead, it says it provides physical-serviceability evidence for disposition decisions, including board-level fault isolation, tested parts availability and real-machine test documentation.
What the company said
Frank Zhu, identified in the release as general manager of Rongtao Medical, said: “The clocks are separable.” He said that when software support stops, hardware still must be maintained.
The company says it is an independent medical imaging equipment service provider that specializes in ultrasound repair, core board repair, probe solutions and tested replacement parts. It says it was founded in 2013, supports distributors, refurbishers and biomedical service teams in more than 140 countries and regions, and operates under ISO 13485:2016 and ISO 9001:2015 quality systems.
What happens next
Rongtao Medical says the full report is available on its website. The release does not say whether any outside agency has reviewed the framework or commented on its findings.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
View the Web StoryA visual, tap-through version of this reportThis is the AMP version of the article. Read the full article on Atlas Watchline.