US security agency reports that China-made hospital patient monitors contain a backdoor that sends confidential monitoring data to a third-party university.