,,ii #aahth ,,congress #b;d ,session ,s4 #dief ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,august #a1 #bjbd,mr4 ,welch 7for himself and ,mr4 ,casey7 introduced the following bill2 which was read twice and referred to the ,select ,committee on ,intelligence ,a ,,bill ,to regulate electronic medical device use in secure compartmented information facilities1 to require the ,director of the ,national ,intelligence oversee transparency reporting and related initiatives1 to encourage investment in modernization efforts for sensitive compartmented information facilities1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cleared ,locations ,enabling ,access to ,relevant ,essential ,devices ,act of #bjbd or the ,,cleared ,act of #bjbd4 #b4 ,enhancing ,national ,accessibility for ,better ,long-term ,employment ,act of #bjbd 7a7 ,definitions ,in this section3 7#a7 ,covered entity ,the term covered entity means any entity that-- 7,a7 is established under or sponsored by any branch of the ,united ,states ,government2 and 7,b7 manages a secure compartmented information facility4 7#b7 ,electronic medical device ,the term electronic medical device has the meaning given that term in ,intelligence ,community ,directive #abd4 7#c7 ,governance ,board ,the term ,governance ,board means the ,electronic ,medical ,device ,governance ,board described in ,intelligence ,community ,directive #abd4 7b7 ,device approval disclosure 7#a7 ,electronic medical device ledgers ,beginning on the date of the enactment of this ,act1 the head of any covered entity shall begin developing and maintaining1 for each secure compartmented information facility managed by such covered entity1 a ledger to track the approval and denial of requests for electronic medical device use1 which shall include-- 7,a7 a case-by-case annotation of each approval or denial of an electronic medical device2 7,b7 a justification for each such approval or denial2 7,c7 any relevant details regarding device restrictions or accommodations2 and 7,d7 statistics summarizing the number of electronic medical devices approved for unrestricted use and limited use and devices that were denied4 7#b7 ,approved electronic medical device list 7,a7 ,in general ,beginning not later than #a year after the date of the enactment of this ,act1 the head of any covered entity shall develop and maintain1 for each secure compartmented information facility managed by such covered entity1 develop and maintain a list that includes the following3 7i7 ,each electronic medical device that is approved for unrestricted use in the facility4 7ii7 ,each electronic medical device that is approved for limited use in the facility1 including-- 7,i7 any restrictions or accommodations required with respect to each such device2 7,,ii7 a description of whether such restrictions or accommodations vary from restrictions imposed or accommodations provided by other covered entities2 and 7,,iii7 if applicable1 an explanation of the variability of such restrictions or accommodations4 7iii7 ,each electronic medical device that is denied for use in the facility and the justification for such denial4 7,b7 ,form 7i7 ,access to unclassified list ,the relevant list of a covered entity developed pursuant to subparagraph 7,a7 shall be-- 7,i7 unclassified to the maximum extent practicable1 but may include a classified annex2 and 7,,ii7 provided to any applicant or employee of the covered entity who seeks a position that requires access to a secure compartmented information facility4 7ii7 ,access to classified list 7,i7 ,cleared applicants ,on the date that an applicant or employee described in clause 7i77,,ii7 receives the security clearance necessary for access to the secure compartmented information facility1 the head of the relevant covered entity shall make available to such applicant or employee the classified portion of the list described in clause 7i74 7,,ii7 ,existing employees ,not later than #a year after the date of the enactment of this ,act1 the head of each covered entity shall provide to each employee of the covered entity who has the security clearance necessary to access a secure compartmented information facility1 the list developed by the head of such covered entity with respect to such facility1 which shall be unclassified to the maximum extent practicable1 but may include a classified annex4 7#c7 ,electronic medical device policy 7,a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the head of each covered entity shall develop a policy for the use of electronic medical devices in secure compartmented information facilities1 which shall include a list of the types of electronic medical devices that are approved for use in each such facility managed by the covered entity4 7,b7 ,annual review ,the head of each covered entity shall annually review any policy developed pursuant to subparagraph 7,a74 7#d7 ,submission to ,director of ,national ,intelligence and ,governance ,board ,not later than #ahj days after the date of the enactment of this ,act1 and annually thereafter1 the head of each covered entity shall submit to the ,director of ,national ,intelligence and the ,governance ,board-- 7,a7 any ledger developed pursuant to paragraph 7#a72 7,b7 any list published pursuant to paragraph 7#b77;,a72 and 7,c7 any policy developed pursuant to paragraph 7#c77;,a74 7c7 ,review of electronic medical device security 7#a7 ,in general ,the ,governance ,board shall review electronic medical device security and equity concerns for covered agencies4 7#b7 ,duties ,the ,governance ,board shall-- 7,a7 review the policies of covered agencies regarding the use of electronic medical devices in secure compartmented information facilities2 7,b7 review each ledger or list submitted in accordance with subsection 7b77#d72 7,c7 identify and resolve discrepancies in such ledgers and lists1 with respect to both variation in justifications for restrictions and accommodations and denials within each covered entity and across all covered entities2 7,d7 facilitate and direct security research and technical risk assessments on electronic medical devices and determine threats to national security posed by such devices2 7,e7 for electronic medical devices that have been researched pursuant to subparagraph 7,d71 evaluate threat mitigation measures available and the efficacy ratings of such measures2 and 7,f7 provide recommendations for risk management of electronic medical devices in secure compartmented information facilities4 7#c7 ,electronic medical ledger database 7,a7 ,in general ,using each ledger and list submitted to the ,governance ,board in accordance with subsection 7b77#d71 the ,governance ,board shall develop and maintain a publicly accessible database of electronic medical devices that have been approved or denied for use at any secure compartmented information facility1 including1 to the extent practicable-- 7i7 approval rates2 7ii7 accommodations or restrictions for usage2 and 7iii7 for each covered entity1 specific processes for electronic medical device approval4 7,b7 ,public availability of information ,the ,governance ,board shall make available on the website of the ,office of the ,director of ,national ,intelligence the following3 7i7 ,general approval and denial rates for devices described in subparagraph 7,a7 of different types4 7ii7 ,points of contact for teams responsible for approvals and denials of devices described in subparagraph 7,a74 7,c7 ,ledger discrepancies ,the ,governance ,board shall include in such database any discrepancy identified pursuant to paragraph 7#b71 including1 for each such discrepancy-- 7i7 a detailed description of the discrepancy2 and 7ii7 proposed remediations4 7,d7 ,form ,the database shall be unclassified1 but may include a classified annex as the ,director of ,national ,intelligence considers appropriate4 7#d7 ,report 7,a7 ,in general ,not later than #a year after the date of the enactment of this ,act1 and annually thereafter1 the ,governance ,board shall submit to the ,director of ,national ,intelligence a report on the state of electronic medical device usage in secure compartmented information facilities4 7,b7 ,content ,each report submitted pursuant to subparagraph 7,a7 shall include-- 7i7 a description of the research efforts1 risk management recommendations1 and strategic approaches of the ,governance ,board to support changes or innovations that improve the use of electronic medical devices in secure compartmented information facilities2 7ii7 a description of any barriers to resolving discrepancies under paragraph 7#b77;,c72 7iii7 a summary of statistics describing approval rates gleaned from the database developed pursuant to paragraph 7#c72 and 7iv7 any other information the ,governance ,board determines is relevant for the ,director of ,national ,intelligence to consider regarding the use of electronic medical devices in secure compartmented information facilities4 7#e7 ,annual evaluations ,not later than #ahj days after receiving a report under paragraph 7#d71 the ,director of ,national ,intelligence shall-- 7,a7 evaluate the findings and recommendations of the ,governance ,board in such report2 and 7,b7 submit to ,congress a report that includes-- 7i7 the results of the evaluation conducted under subparagraph 7,a72 7ii7 a description of current approval rates for electronic medical devices2 7iii7 a description of research efforts and risk mitigation strategies with respect to electronic medical devices2 and 7iv7 recommendations for updating electronic medical device requirements in secure compartmented information facilities4 7d7 ,protection of information ,in carrying out this section1 the head of each covered entity shall ensure the protection of personally identifiable information1 including medical information1 in accordance with all applicable laws and policies with respect to confidentiality and privacy4