,,ii  #aae? ,,congress  #a/ ,session    
,s4 #afef  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #bg1 #bjag ,mr4  
,blum5?al introduc$ ! foll[+ bill2 :i* 0
 read twice & ref]r$ to ! ,committee on 
,heal?1 ,education1 ,labor1 & ,p5sions  
,a ,,bill  ,to am5d ! ,f$]al ,food1     
,drug1 & ,cosmetic ,act to provide      
cyb]security protections = m$ical       
devices4  #a4 ,%ort title  ,?is ,act may
 be cit$ z ! ,m$ical ,device            
,cyb]security ,act ( #bjag4  #b4        
,cyb]security = m$ical devices  7a7 ,9  
g5]al ,*apt] ,v ( ! ,f$]al ,food1 ,drug1
 & ,cosmetic ,act 7#ba ,u4,s4,c4 #cea et
 seq47 is am5d$ by ins]t+ aft] section  
#ebj 7#ba ,u4,s4,c4 #cfj;j7 ! foll[+--  
#ebj;,a4 ,cyb]security = devices  7a7   
,def9itions ,9 ?is section3 7#a7 ,cyb]  
device ,! t]m cyb] device means any     
device t has network or ,int]net        
connectivity 7su* z ne> field           
communication 7,,nfc71 ,bluetoo?1 or    
,wi,fi71 connects to an ext]nal /orage  
device or ext]nal m$ia 7su* z a univ]sal

 s]ial bus 7,,usb7 or a compact disk71  
or has any o!r cyb] capability4  7#b7   
,cyb]security fix or update ,! t]m      
cyb]security fix or update means any    
modification to a cyb] device t         
addresses a s(tw>e1 firmw>e1 or h>dw>e  
error or kn[n vuln]ability1 or a        
security update1 & does n *ange !       
!rapeutic or diagno/ic function ( !     
device4  7b7 ,transp>5cy ( risk prior to
 m>ket+  7#a7 ,report c>d  7,a7 ,9 g5]al
 ,! ,secret>y1 9 coord9ation ) !        
entities describ$ 9 subp>agraph 7,b71   
%all develop a report c>d = indicat+ !  
cyb]security functions ( cyb] devices4  
,! report c>d %all conta9 ! cont5ts     
describ$ 9 p>agraph 7#b7 & be disclos$ 9
 accordance ) p>agraph 7#c74  7,b7      
,coord9ation ,! entities describ$ 9 ?is 
subp>agraph are ! foll[+3 7i7 ,!        
,national ,in/itute ( ,/&>ds &          
,te*nology4  7ii7 ,! ,secret>y ( ,homel&
 ,security4  7iii7 ,! ,national         
,coord9ation ,(fice support+ ! ,network+
 & ,in=mation ,te*nology ,rese>* &      

,developm5t ,program4  7iv7 ,! ,f$]al   
,trade ,commission4  7v7 ,any o!r       
relevant ag5cy1 or cyb]security or      
m$ical device indu/ry gr\p1 z det]m9$ by
 ! ,secret>y4  7#b7 ,cont5ts ( report   
c>d ,ea* report c>d %all conta9 ea* ( ! 
foll[+3 7,a7 ,in=mation p]ta9+ to all   
ess5tial elem5ts describ$ 9 ! mo/ rec5t 
v]sion ( ! ,manufactur] ,disclosure     
,/atem5t = ,m$ical ,device ,security1 z 
set =? by ! ,heal?c>e ,in=mation &      
,managem5t ,sy/ems ,society & !         
,national ,electrical ,manufactur]s     
,association4  7,b7 ,a traceability     
matrix1 accept$ by ! ,secret>y1 t-- 7i7 
r$acts cont5t t is confid5tial1 z       
det]m9$ by ! ,secret>y2 &  7ii7         
e/abli%es design compon5ts & traces su* 
compon5ts to design comp5sat+ controls4 
7,c7 ,a description ( any manufactur]   
comp5sat+ controls t-- 7i7 effectively  
address kn[n common vuln]abilities &    
exposures2 &  7ii7 provide provid]s )   
indu/ry /&>d comp5sat+ controls =       
improv+ cyb]security4  7,d7 ,a          

description (--  7i7 any cyb]security   
evaluation conduct$ on ! device1 includ+
 any te/+1 validation1 or v]ification ( 
! device2  7ii7 :o conduct$ su*         
evaluation2 &  7iii7 ! results ( su*    
evaluation4  7,e7 ,a cyb]security risk  
assessm5t conduct$ by ! manufactur]1 or 
a ?ird p>ty1 expla9+ ! risk ( ! device  
to pati5t safety & cl9ical haz>ds4  7,f7
 ,an indication ( :e!r ! device is      
capable ( be+ remotely access$4 ,if !   
device is capable ( be+ remotely        
access$1 an indication ( any security   
measures & access protocols ! device has
 9 place to secure su* access4  7#c7    
,disclosure ( report c>d  7,a7 ,cle>ance
 or approval ,! manufactur] ( any cyb]  
device %all include ! report c>d 9 any  
notification to ! ,secret>y "u section  
#eaj7k7 or any application = prem>ket   
approval "u section #eae7;c71 z         
applicable4  7,b7 ,public accessibility 
7i7 ,9 g5]al ,! ,secret>y %all provide a
 copy ( ! report c>d to any entity      
describ$ 9 clause 7ii7 t submits a      

reque/ = su* copy to ! ,secret>y4  7ii7 
,entities p]mitt$ access ,an entity     
describ$ 9 ?is clause is-- 7,i7 any     
heal? c>e indu/ry entity1 consi/+ ( any 
provid]1 device manufactur]1 ! ,f$]al   
,gov]nm5t1 heal? c>e in=mation security 
rese>*]s1 & heal? c>e academia2 &       
7,,ii7 any entity det]m9$ by ! ,secret>y
 to h a valid int]e/ 9 ! report c>d4    
7,c7 ,updat$ report c>d ,= z long z !   
cyb] device receives te*nical support f 
! manufactur] or any o!r ?ird p>ty      
au?oriz$ by ! manufactur]1 ! manufactur]
 %all submit to ! ,secret>y an annual   
update to ! report c>d4  7c7 ,protect+  
remote access to manag$ solutions  7#a7 
,9 g5]al ,a manufactur] ( a cyb] device 
%all3 7,a7 ,9 ord] to remotely access   
su* device aft] sell+1 or o!rwise       
transf]r+ own]%ip (1 ! device1 obta9    
cons5t = su* access f ! provid] own+ or 
op]at+ ! device & f any pati5t on :i* ! 
device is us$4 ,su* cons5t may be 9 ! =m
 ( an agreem5t ent]$ into betwe5 !      
provid] & ! manufactur] at ! "t ! device

 is sold to ! provid]1 & may be = !     
manufactur] to remotely access ! device 
at times specifi$ 9 su* agreem5t or by  
an agreem5t betwe5 ! manufactur] &      
provid] ent]$ into !reaft]4 ,9 ! case ( 
an agreem5t describ$ 9 ! previ\s s5t5ce1
 cons5t ( ! pati5t may be obta9$ ?r\gh !
 provid] notify+ ! pati5t ( su*         
agreem5t4  7,b7 ,= any cyb] device t !  
manufactur] may remotely access 9       
accordance ) subp>agraph 7,a73 7i7      
,notify ! provid] :5 ! manufactur]      
accesses ! device remotely1 includ+ ! "n
 ( ! p]son ) su* access1 ! k9ds ( tasks 
t c be p]=m$ ?r\gh su* access1 & !      
s(tw>e us$ to access ! device4 ,su*     
notification c be 9 ! =m ( an audit log 
describ$ 9 clause 7ii7 if ! audit log is
 readily available to ! provid]4  7ii7  
,ma9ta9 an audit log = ea* "t !         
manufactur] accesses ! device remotely &
 make su* log accessible to ! provid]4  
7,c7 ,except z provid$ 9 p>agraph 7#b71 
= any cyb] device t has ! capability to 
be access$ remotely by ! manufactur] or 

any o!r entity3  7i7 ,implem5t          
multi-factor au!ntication = access+ any 
cyb] capability ( ! device4  7ii7       
,secure data 9 motion & data at re/ )   
data encryption1 & o!r be/ practices1   
approv$ by ! ,national ,in/itute (      
,/&>ds & ,te*nology4  7iii7 ,in/all     
automat$ tools to track access1 or      
id5tify attempts at unau?oriz$ access1  
to any cyb] capability ( ! device4  7iv7
 ,adopt :iteli/+ approa*es & *angeable  
passwords = access+ any cyb] capability 
( ! device4  7v7 ,comply ) ! remote     
access provisions recomm5d$ by !        
,national ,in/itute ( ,/&>ds &          
,te*nology1 9 ! docum5t entitl$         
,security = ,telecommut+ & ,broadb&     
,communications 7,,ni/ ,special         
,publication #hjj-df71 publi%$ 9 ,augu/ 
#bjjb4  7#b7 ,exceptions ,a manufactur] 
may submit a petition to ! ,secret>y to 
exempt a cyb] device f any requirem5t "u
 p>agraph 7#a77;,c74 ,! ,secret>y may   
grant su* an exemption if x det]m9es t !
 manufactur] c prove ! exemption w\ld   

pose n m ?an a m9imal risk to pati5t    
heal?1 m9imal risk to privacy1 & m9imal 
risk ( a cyb] vuln]ability4  7d7        
,cyb]security fixes or updates  7#a7    
,re-cle>ance or reapproval ,unless at ! 
reque/ ( ! ,secret>y due to a unique &  
ext5uat+ circum/ance1 any cyb]security  
fix or update %all n require a new      
notification "u section #eaj7k7 or      
application = prem>ket approval "u      
section #eae7;c74  7#b7 ,free           
cyb]security fixes or updates ,a        
manufactur] ( a cyb] device %all provide
 any cyb]security fix or update to !    
device free ( *>ge until--  7,a7 ! date 
on :i* any agreem5t to provide su* fixes
 or updates1 ent]$ into betwe5 !        
manufactur] 7or a ?ird p>ty au?oriz$ by 
! manufactur]7 & a provid]1 expires2 or 
7,b7 if no agreem5t describ$ 9          
subp>agraph 7,a7 is 9 effect1 ! date t  
is #aj ye>s aft] ! date on :i* !        
manufactur] discont9ues m>ket+ ! device4
  7e7 ,end-(-,life device ,n lat] ?an   
#ij days aft] a manufactur] decl>es t x 

w no long] sell a cyb] device1 !        
manufactur] ( su* device %all--  7#a7   
%all provide any provid] own+ or op]at+ 
! device ) ! report c>d1 z mo/ rec5tly  
updat$ "u subsection 7b77#c77;,c72  7#b7
 to ! ext5t practicable1 in=m any       
provid] own+ or op]at+ ! device t !     
manufactur] w no long] be manufactur+   
su* device2  7#c7 provide notice to any 
provid] own+ or op]at+ ! device ( ! date
 on :i* ! la/ cyb]security fix or update
 w be provid$ by ! manufactur]2  7#d7   
notify ! ,secret>y ( su* decl>ation2 &  
7#e7 provide any provid] own+ or op]at+ 
! device ) ! foll[+ in=mation relat$ to 
! device3  7,a7 ,comp5sat+ controls on  
h[ to securely configure ! cyb] device  
if ! device /ays 9 op]ation pa/ ! date  
on :i* ! manufactur] /ops provid+       
cybsecurity fixes or updates "u         
subsection 7d77#b74  7,b7 ,docum5tation 
on secure prep>ation = recycl+ &        
disposal ( ! device4  7,c7 ,specific    
guidance reg>d+ support+ infra/ructure  
ar*itecture1 includ+ network segm5tation

 & device isolation requirem5ts4  7,d7  
,in/ructions on h[ to delete any        
p]sonally id5tifiable in=mation1        
protect$ heal? in=mation1 or o!r        
site-specific s5sitive data su* z       
configuration files4  7f7 ,applicability
 ,?is section %all n apply ) respect to 
any cyb] device = :i*1 prior to !       
enactm5t ( ! ,m$ical ,device            
,cyb]security ,act ( #bjag1 a           
notification 0 submitt$ "u section      
#eaj7k71 or = :i* an application =      
prem>ket approval 0 submitt$ "u section 
#eae7;c74  4  7b7 ,en=cem5t ,section    
#cja ( ! ,f$]al ,food1 ,drug1 &         
,cosmetic ,act 7#ba ,u4,s4,c4 #cca7 is  
am5d$ by add+ at ! end ! foll[+3  7eee7 
,! failure to comply ) subsection 7b71  
7c71 7d71 or 7e7 ( section #ebj;,a4  4  
7c7 ,expansion ( ,,ics-,,c]t            
responsibilities  7#a7 ,def9itions ,9   
?is subsection3  7,a7 ,cyb] device ,!   
t]m cyb] device has ! mean+ giv5 ! t]m 9
 section #ebj;,a ( ! ,f$]al ,food1      
,drug1 & ,cosmetic ,act1 z add$ by      

subsection 7a74  7,b7 ,,ics-,,c]t ,! t]m
 ,,ics-,,c]t means ! ,indu/rial ,control
 ,sy/ems ,cyb] ,em]g5cy ,response ,team 
( ! ,national ,cyb]security &           
,communications ,integration ,c5t]      
e/abli%$ "u section #bbg ( ! ,homel&    
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#adh74  7,c7 ,"u ,secret>y ,! t]m ,"u   
,secret>y means ! ,"u ,secret>y appo9t$ 
"u section #ajc7;a77#a77;,h7 ( ! ,homel&
 ,security ,act ( #bjjb 7#f ,u4,s4,c4   
#aac7;a77#a77;,h774  7#b7 ,expansion ,n 
lat] ?an #ahj days aft] ! date (        
enactm5t ( ?is ,act1 ! ,"u ,secret>y    
%all exp& ! duties & mission (          
,,ics-,,c]t to include--  7,a7          
inve/igat+ cyb]security vuln]abilities (
 cyb] devices t may cause h>m to human  
life or significant misuse ( p]sonal    
heal? in=mation1 z det]m9$ necess>y by  
,,ics-,,c]t or at ! reque/ ( ! ,"u      
,secret>y2 &  7,b7 coord9at+            
device-specific responses to            
cyb]security incid5ts & vuln]abilities )
 respect to cyb] devices4  7#c7         

,consultation ,9 c>ry+ out p>agraph     
7#b71 ! ,"u ,secret>y %all consult )    
relevant ag5cies )9 ! ,food & ,drug     
,adm9i/ration1 ! ,dep>tm5t ( ,heal? &   
,human ,s]vices1 ! ,national ,in/itute (
 ,/&>ds & ,te*nology1 ! ,national       
,coord9ation ,(fice = ,network+ &       
,in=mation ,te*nology ,rese>* &         
,developm5t1 ! ,f$]al ,trade            
,commission1 & exp]ts 9 ! cyb]security &
 m$ical device indu/ries4  7#d7         
,coord9at$ disclosure ,n lat] ?an #f    
mon?s aft] ! date ( enactm5t ( ?is ,act1
 ! ,secret>y ( ,homel& ,security %all   
issue rules relat+ to ! coord9at$       
disclosure ( controll$ & uncontroll$    
cyb]security vuln]abilities ( cyb]      
devices1 :i* %all--  7,a7 outl9e ! roles
 & responsibilities ( ,,ics-,,c]t &     
manufactur]s & provid]s ( cyb] devices2 
7,b7 provide timel9es = all requir$     
actions2 &  7,c7 provide = ! en=cem5t ( 
coop]ation betwe5 ,,ics-,,c]t &         
manufactur]s & provid]s ( cyb] devices4 
7#e7 ,report ,n lat] ?an #a ye> aft] !  

date ( enactm5t ( ?is ,act1 ! ,"u       
,secret>y %all submit to ,congress a    
report detail+ ! exp&$ duties & mission 
( ,,ics-,,c]t "u p>agraph 7#b74