,,ii  #aagth ,,congress  #b;d ,session  
,s4 #cihc  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,march #ca1    
#bjbb,mr4 ,cassidy 7for himself and ,ms4
 ,baldwin7 introduced the following     
bill2 which was read twice and referred 
to the ,committee on ,health1           
,education1 ,labor1 and ,pensions  ,a   
,,bill  ,to amend the ,federal ,food1   
,drug1 and ,cosmetic ,act to require1   
for purposes of ensuring cybersecurity1 
the inclusion in any premarket          
submission for a cyber device of        
information to demonstrate a reasonable 
assurance of safety and effectiveness   
throughout the lifecycle of the cyber   
device1 and for other purposes4  #a4    
,short title ,this ,act may be cited as 
the ,,patch ,act4  #b4 ,ensuring        
cybersecurity of medical devices  7a7   
,in general ,subchapter ,a of chapter ,v
 of the ,federal ,food1 ,drug1 and      
,cosmetic ,act 7#ba ,u4,s4,c4 #cea et   
seq47 is amended by adding at the end   
the following3  #ebd;,b4 ,ensuring      

cybersecurity of devices  7a7 ,in       
general ,for purposes of ensuring       
cybersecurity throughout the lifecycle  
of a cyber device1 any person who       
submits a premarket submission for the  
cyber device shall include such         
information as the ,secretary may       
require to ensure that the cyber device 
meets such cybersecurity requirements as
 the ,secretary determines to be        
appropriate to demonstrate a reasonable 
assurance of safety and effectiveness1  
including at a minimum the cybersecurity
 requirements under subsection 7b74 ,the
 ,secretary may establish exemptions to 
the requirements under this subsection4 
7b7 ,cybersecurity requirements ,at a   
minimum1 the manufacturer of a cyber    
device shall meet the following         
cybersecurity requirements3 7#a7 ,the   
manufacturer shall have a plan to       
appropriately monitor1 identify1 and    
address in a reasonable time postmarket 
cybersecurity vulnerabilities and       
exploits4  7#b7 ,the manufacturer       

shall-- 7,a7 have a plan and procedures 
for a ,coordinated ,vulnerability       
,disclosure to be part of submissions to
 the ,food and ,drug ,administration2   
and  7,b7 collect and maintain such     
other information as the ,secretary may 
7by order published in the ,federal     
,register or by other process7 require  
to demonstrate a reasonable assurance of
 the safety and effectiveness of the    
cyber device4  7#c7 ,the manufacturer   
shall design1 develop1 and maintain     
processes and procedures to make        
available updates and patches to the    
cyber device and related systems        
throughout the lifecycle of the cyber   
device to address-- 7,a7 on a reasonably
 justified regular cycle1 known         
unacceptable vulnerabilities2 and  7,b7 
as soon as possible out of cycle1       
critical vulnerabilities that could     
cause uncontrolled risks4  7#d7 ,the    
manufacturer shall furnish to the       
,secretary a software bill of materials1
 including commercial1 open-sourced1 and

 off-the-shelf software components that 
will be provided to users4  7c7         
,substantial equivalence ,in making a   
determination of substantial equivalence
 under section #eac7;i7 for a cyber     
device1 the ,secretary may-- 7#a7 find  
that cybersecurity information for the  
cyber device described in the relevant  
premarket submission in the cyber       
device's use environment is inadequate2 
and  7#b7 issue a nonsubstantial        
equivalence determination based on this 
finding4  7d7 ,definition ,in this      
section3 7#a7 ,the term cyber device    
means a device that-- 7,a7 includes     
software2 or  7,b7 is intended to       
connect to the internet4  7#b7 ,the term
 lifecycle of the cyber device includes 
the postmarket lifecycle of the cyber   
device4  7#c7 ,the term premarket       
submission means any submission under   
section #eaj7k71 #eac1 #eae7;c71        
#eae7;f71 or #ebj7m74  4  7b7           
,prohibited act ,section #cja7q7 of the 
,federal ,food1 ,drug1 and ,cosmetic    

,act 7#ba ,u4,s4,c4 #cca7q77 is amended 
by adding at the end the following3     
7#c7 ,the failure to comply with any    
requirement under section #ebd;,b       
7relating to ensuring the               
cybersecurity74  4  7c7 ,adulteration   
,section #eja of the ,federal ,food1    
,drug1 and ,cosmetic ,act 7#ba ,u4,s4,c4
 #cea7 is amended by adding at the end  
the following3  7k7 ,if it is a device  
with respect to which the sponsor is in 
violation of section #ebd;,b 7relating  
to ensuring cybersecurity74  4  7d7     
,misbranding ,section #ejb7t7 of the    
,federal ,food1 ,drug1 and ,cosmetic    
,act 7#ba ,u4,s4,c4 #ceb7t77 is         
amended-- 7#a7 by striking or 7#c7 and  
inserting 7#c72 and  7#b7 by inserting  
before the period at the end the        
following3 1 or 7#d7 to furnish a       
software bill of materials as required  
under section #ebd;,b 7relating to      
ensuring the cybersecurity74