This bill requires the U.S. Food and Drug Administration, working with the Cybersecurity and Infrastructure Security Agency, to review medical devices manufactured in or controlled by China for potential cybersecurity vulnerabilities. Within 180 days of the law's enactment, manufacturers must provide detailed information about their devices' software components, where patient data is stored, and security procedures. Within 18 months, the FDA must decide whether any reviewed devices pose cybersecurity risks, and if so, must order manufacturers to stop distributing them and notify healthcare providers and patients. Manufacturers that fail to provide the requested information within 180 days will also face mandatory recall orders, though the FDA can exempt devices from recall if removing them would create dangerous shortages. The bill requires the FDA to submit a comprehensive report to Congress within two years analyzing the cybersecurity readiness of the U.S. medical device industry and the market share of Chinese-made devices.