,,ii  #aagth ,,congress  #b;d ,session  
,s4 #dccf  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,may #bf1      
#bjbb,ms4 ,rosen 7for herself and ,mr4  
,young7 introduced the following bill2  
which was read twice and referred to the
 ,committee on ,health1 ,education1     
,labor1 and ,pensions  ,a ,,bill  ,to   
require the ,secretary of ,health and   
,human ,services1 in consultation with  
the ,director of the ,cybersecurity and 
,infrastructure ,security ,agency1 to   
annually review and as appropriate      
update guidance for industry and ,food  
and ,drug ,administration staff on      
medical device cybersecurity1 and for   
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,strengthening 
,cybersecurity for ,medical ,devices    
,act4  #b4 ,guidance for industry and   
,,fda staff on medical device           
cybersecurity  7a7 ,in general ,not     
later than #b years after the date of   
enactment of this ,act1 and every #b    
years thereafter1 the ,secretary of     

,health and ,human ,services 7referred  
to in this ,act as the ,secretary71 in  
consultation with the ,director of the  
,cybersecurity and ,infrastructure      
,security ,agency1 shall review and1 as 
appropriate and after soliciting and    
receiving feedback from medical device  
manufacturers1 health care providers1   
and patient advocates1 update the       
guidance entitled ,content of ,premarket
 ,submissions for ,management of        
,cybersecurity in ,medical ,devices 7or 
a successor document74  7b7 ,updating   
specific provisions ,in updating the    
guidance under subsection 7a71 the      
,secretary may update specific          
provisions of the guidance1 after notice
 and comment1 without reissuing the     
guidance4  #c4 ,resources regarding     
cybersecurity of medical devices ,not   
later than #ahj days after the date of  
enactment of this ,act1 and not less    
than annually thereafter1 the ,secretary
 shall update public information        
provided by the ,food and ,drug         

,administration1 including through the  
webpage on medical devices on the       
website of the ,food and ,drug          
,administration1 with information       
regarding improving cybersecurity of    
medical devices4 ,such information shall
 include information on identifying and 
addressing cyber vulnerabilities for    
health care providers1 health systems1  
and medical device manufacturers1 and   
how such entities may access support    
through the ,cybersecurity and          
,infrastructure ,security ,agency and   
other ,federal entities1 including the  
,department of ,health and ,human       
,services1 to improve cybersecurity of  
medical devices4  #d4 ,,gao report ,not 
later than #a year after the date of    
enactment of this ,act1 the ,comptroller
 ,general of the ,united ,states shall  
publish a report identifying challenges 
in cybersecurity for medical devices1   
including legacy devices that may not   
support certain software security       
updates4 ,through such report1 the      

,comptroller ,general shall examine--   
7#a7 challenges for medical device      
manufacturers1 health care providers1   
health systems1 and patients in         
accessing ,federal support to address   
vulnerabilities across ,federal         
agencies2 and  7#b7 how ,federal        
agencies can strengthen coordination to 
better support cybersecurity for medical
 devices4