,,ii #aaeth ,,congress #ast ,session ,s4 #afef ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #bg1 #bjag ,mr4 ,blumenthal introduced the following bill2 which was read twice and referred to the ,committee on ,health1 ,education1 ,labor1 and ,pensions ,a ,,bill ,to amend the ,federal ,food1 ,drug1 and ,cosmetic ,act to provide cybersecurity protections for medical devices4 #a4 ,short title ,this ,act may be cited as the ,medical ,device ,cybersecurity ,act of #bjag4 #b4 ,cybersecurity for medical devices 7a7 ,in general ,chapter ,v of the ,federal ,food1 ,drug1 and ,cosmetic ,act 7#ba ,u4,s4,c4 #cea et seq47 is amended by inserting after section #ebj 7#ba ,u4,s4,c4 #cfj;j7 the following-- #ebj;,a4 ,cybersecurity for devices 7a7 ,definitions ,in this section3 7#a7 ,cyber device ,the term cyber device means any device that has network or ,internet connectivity 7such as near field communication 7,,nfc71 ,bluetooth1 or ,wi,fi71 connects to an external storage device or external media 7such as a universal serial bus 7,,usb7 or a compact disk71 or has any other cyber capability4 7#b7 ,cybersecurity fix or update ,the term cybersecurity fix or update means any modification to a cyber device that addresses a software1 firmware1 or hardware error or known vulnerability1 or a security update1 and does not change the therapeutic or diagnostic function of the device4 7b7 ,transparency of risk prior to marketing 7#a7 ,report card 7,a7 ,in general ,the ,secretary1 in coordination with the entities described in subparagraph 7,b71 shall develop a report card for indicating the cybersecurity functions of cyber devices4 ,the report card shall contain the contents described in paragraph 7#b7 and be disclosed in accordance with paragraph 7#c74 7,b7 ,coordination ,the entities described in this subparagraph are the following3 7i7 ,the ,national ,institute of ,standards and ,technology4 7ii7 ,the ,secretary of ,homeland ,security4 7iii7 ,the ,national ,coordination ,office supporting the ,networking and ,information ,technology ,research and ,development ,program4 7iv7 ,the ,federal ,trade ,commission4 7v7 ,any other relevant agency1 or cybersecurity or medical device industry group1 as determined by the ,secretary4 7#b7 ,contents of report card ,each report card shall contain each of the following3 7,a7 ,information pertaining to all essential elements described in the most recent version of the ,manufacturer ,disclosure ,statement for ,medical ,device ,security1 as set forth by the ,healthcare ,information and ,management ,systems ,society and the ,national ,electrical ,manufacturers ,association4 7,b7 ,a traceability matrix1 accepted by the ,secretary1 that-- 7i7 redacts content that is confidential1 as determined by the ,secretary2 and 7ii7 establishes design components and traces such components to design compensating controls4 7,c7 ,a description of any manufacturer compensating controls that-- 7i7 effectively address known common vulnerabilities and exposures2 and 7ii7 provide providers with industry standard compensating controls for improving cybersecurity4 7,d7 ,a description of-- 7i7 any cybersecurity evaluation conducted on the device1 including any testing1 validation1 or verification of the device2 7ii7 who conducted such evaluation2 and 7iii7 the results of such evaluation4 7,e7 ,a cybersecurity risk assessment conducted by the manufacturer1 or a third party1 explaining the risk of the device to patient safety and clinical hazards4 7,f7 ,an indication of whether the device is capable of being remotely accessed4 ,if the device is capable of being remotely accessed1 an indication of any security measures and access protocols the device has in place to secure such access4 7#c7 ,disclosure of report card 7,a7 ,clearance or approval ,the manufacturer of any cyber device shall include the report card in any notification to the ,secretary under section #eaj7k7 or any application for premarket approval under section #eae7;c71 as applicable4 7,b7 ,public accessibility 7i7 ,in general ,the ,secretary shall provide a copy of the report card to any entity described in clause 7ii7 that submits a request for such copy to the ,secretary4 7ii7 ,entities permitted access ,an entity described in this clause is-- 7,i7 any health care industry entity1 consisting of any provider1 device manufacturer1 the ,federal ,government1 health care information security researchers1 and health care academia2 and 7,,ii7 any entity determined by the ,secretary to have a valid interest in the report card4 7,c7 ,updated report card ,for as long as the cyber device receives technical support from the manufacturer or any other third party authorized by the manufacturer1 the manufacturer shall submit to the ,secretary an annual update to the report card4 7c7 ,protecting remote access to managed solutions 7#a7 ,in general ,a manufacturer of a cyber device shall3 7,a7 ,in order to remotely access such device after selling1 or otherwise transferring ownership of1 the device1 obtain consent for such access from the provider owning or operating the device and from any patient on which the device is used4 ,such consent may be in the form of an agreement entered into between the provider and the manufacturer at the time the device is sold to the provider1 and may be for the manufacturer to remotely access the device at times specified in such agreement or by an agreement between the manufacturer and provider entered into thereafter4 ,in the case of an agreement described in the previous sentence1 consent of the patient may be obtained through the provider notifying the patient of such agreement4 7,b7 ,for any cyber device that the manufacturer may remotely access in accordance with subparagraph 7,a73 7i7 ,notify the provider when the manufacturer accesses the device remotely1 including the name of the person with such access1 the kinds of tasks that can be performed through such access1 and the software used to access the device4 ,such notification can be in the form of an audit log described in clause 7ii7 if the audit log is readily available to the provider4 7ii7 ,maintain an audit log for each time the manufacturer accesses the device remotely and make such log accessible to the provider4 7,c7 ,except as provided in paragraph 7#b71 for any cyber device that has the capability to be accessed remotely by the manufacturer or any other entity3 7i7 ,implement multi-factor authentication for accessing any cyber capability of the device4 7ii7 ,secure data in motion and data at rest with data encryption1 and other best practices1 approved by the ,national ,institute of ,standards and ,technology4 7iii7 ,install automated tools to track access1 or identify attempts at unauthorized access1 to any cyber capability of the device4 7iv7 ,adopt whitelisting approaches and changeable passwords for accessing any cyber capability of the device4 7v7 ,comply with the remote access provisions recommended by the ,national ,institute of ,standards and ,technology1 in the document entitled ,security for ,telecommuting and ,broadband ,communications 7,,nist ,special ,publication #hjj-df71 published in ,august #bjjb4 7#b7 ,exceptions ,a manufacturer may submit a petition to the ,secretary to exempt a cyber device from any requirement under paragraph 7#a77;,c74 ,the ,secretary may grant such an exemption if it determines that the manufacturer can prove the exemption would pose not more than a minimal risk to patient health1 minimal risk to privacy1 and minimal risk of a cyber vulnerability4 7d7 ,cybersecurity fixes or updates 7#a7 ,re-clearance or reapproval ,unless at the request of the ,secretary due to a unique and extenuating circumstance1 any cybersecurity fix or update shall not require a new notification under section #eaj7k7 or application for premarket approval under section #eae7;c74 7#b7 ,free cybersecurity fixes or updates ,a manufacturer of a cyber device shall provide any cybersecurity fix or update to the device free of charge until-- 7,a7 the date on which any agreement to provide such fixes or updates1 entered into between the manufacturer 7or a third party authorized by the manufacturer7 and a provider1 expires2 or 7,b7 if no agreement described in subparagraph 7,a7 is in effect1 the date that is #aj years after the date on which the manufacturer discontinues marketing the device4 7e7 ,end-of-,life device ,not later than #ij days after a manufacturer declares that it will no longer sell a cyber device1 the manufacturer of such device shall-- 7#a7 shall provide any provider owning or operating the device with the report card1 as most recently updated under subsection 7b77#c77;,c72 7#b7 to the extent practicable1 inform any provider owning or operating the device that the manufacturer will no longer be manufacturing such device2 7#c7 provide notice to any provider owning or operating the device of the date on which the last cybersecurity fix or update will be provided by the manufacturer2 7#d7 notify the ,secretary of such declaration2 and 7#e7 provide any provider owning or operating the device with the following information related to the device3 7,a7 ,compensating controls on how to securely configure the cyber device if the device stays in operation past the date on which the manufacturer stops providing cybsecurity fixes or updates under subsection 7d77#b74 7,b7 ,documentation on secure preparation for recycling and disposal of the device4 7,c7 ,specific guidance regarding supporting infrastructure architecture1 including network segmentation and device isolation requirements4 7,d7 ,instructions on how to delete any personally identifiable information1 protected health information1 or other site-specific sensitive data such as configuration files4 7f7 ,applicability ,this section shall not apply with respect to any cyber device for which1 prior to the enactment of the ,medical ,device ,cybersecurity ,act of #bjag1 a notification was submitted under section #eaj7k71 or for which an application for premarket approval was submitted under section #eae7;c74 4 7b7 ,enforcement ,section #cja of the ,federal ,food1 ,drug1 and ,cosmetic ,act 7#ba ,u4,s4,c4 #cca7 is amended by adding at the end the following3 7eee7 ,the failure to comply with subsection 7b71 7c71 7d71 or 7e7 of section #ebj;,a4 4 7c7 ,expansion of ,,ics-,,cert responsibilities 7#a7 ,definitions ,in this subsection3 7,a7 ,cyber device ,the term cyber device has the meaning given the term in section #ebj;,a of the ,federal ,food1 ,drug1 and ,cosmetic ,act1 as added by subsection 7a74 7,b7 ,,ics-,,cert ,the term ,,ics-,,cert means the ,industrial ,control ,systems ,cyber ,emergency ,response ,team of the ,national ,cybersecurity and ,communications ,integration ,center established under section #bbg of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #adh74 7,c7 ,under ,secretary ,the term ,under ,secretary means the ,under ,secretary appointed under section #ajc7;a77#a77;,h7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aac7;a77#a77;,h774 7#b7 ,expansion ,not later than #ahj days after the date of enactment of this ,act1 the ,under ,secretary shall expand the duties and mission of ,,ics-,,cert to include-- 7,a7 investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or significant misuse of personal health information1 as determined necessary by ,,ics-,,cert or at the request of the ,under ,secretary2 and 7,b7 coordinating device-specific responses to cybersecurity incidents and vulnerabilities with respect to cyber devices4 7#c7 ,consultation ,in carrying out paragraph 7#b71 the ,under ,secretary shall consult with relevant agencies within the ,food and ,drug ,administration1 the ,department of ,health and ,human ,services1 the ,national ,institute of ,standards and ,technology1 the ,national ,coordination ,office for ,networking and ,information ,technology ,research and ,development1 the ,federal ,trade ,commission1 and experts in the cybersecurity and medical device industries4 7#d7 ,coordinated disclosure ,not later than #f months after the date of enactment of this ,act1 the ,secretary of ,homeland ,security shall issue rules relating to the coordinated disclosure of controlled and uncontrolled cybersecurity vulnerabilities of cyber devices1 which shall-- 7,a7 outline the roles and responsibilities of ,,ics-,,cert and manufacturers and providers of cyber devices2 7,b7 provide timelines for all required actions2 and 7,c7 provide for the enforcement of cooperation between ,,ics-,,cert and manufacturers and providers of cyber devices4 7#e7 ,report ,not later than #a year after the date of enactment of this ,act1 the ,under ,secretary shall submit to ,congress a report detailing the expanded duties and mission of ,,ics-,,cert under paragraph 7#b74