,,ii  #aaith ,,congress  #b;d ,session  
,s4 #dici  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,june #bd1     
#bjbf ,mr4 ,cotton introduced the       
following bill2 which was read twice and
 referred to the ,committee on ,health1 
,education1 ,labor1 and ,pensions  ,a   
,,bill  ,to require the ,secretary of   
,health and ,human ,services to review  
certain medical devices manufactured in 
the ,people's ,republic of ,china for   
potential cybersecurity issues1 and for 
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,countering    
,chinese ,cyberthreats for ,patients    
,act or the ,countering ,,ccp ,act4  #b4
 ,review and recall of certain medical  
devices manufactured in the ,people's   
,republic of ,china  7a7 ,review of     
certain devices  7#a7 ,in general ,the  
,secretary of ,health and ,human        
,services1 acting through the           
,commissioner of ,food and ,drugs       
7referred to in this section as the     
,secretary71 in consultation with the   

,director of the ,cybersecurity and     
,infrastructure ,security ,agency1 shall
 review each covered device for         
potential cybersecurity issues4  7#b7   
,request for information  7,a7 ,in      
general ,not later than #ahj days after 
the date of enactment of this ,act1 the 
,secretary1 in consultation with the    
,director of the ,cybersecurity and     
,infrastructure ,security ,agency1 shall
 request from each covered manufacturer 
of a covered device such information as 
is necessary to conduct the review under
 paragraph 7#a71 including-- 7i7 a      
software bill of materials for the      
covered device1 including commercial1   
open-source1 and off-the-shelf software 
components1 and data mapping and        
architecture documentation2  7ii7       
locations of entities1 information      
systems1 and servers holding patient    
data2 and  7iii7 any other information  
the ,secretary determines necessary4    
7,b7 ,requirements ,in determining the  
form and scope of information to request

 under subparagraph 7,a71 the           
,secretary1 in consultation with the    
,director of the ,cybersecurity and     
,infrastructure ,security ,agency1 shall
 analyze covered devices and seek       
information1 including information on   
any processes and procedures of the     
covered manufacturer1 that1 as          
determined by ,secretary1 in            
consultation with the ,director of the  
,cybersecurity and ,infrastructure      
,security ,agency-- 7i7 would provide a 
reasonable assurance that the covered   
device and related systems are and will 
remain cybersecure2 and  7ii7 would     
provide a reasonable assurance that     
patient data would not be stored or     
transferred through systems or servers  
located in1 owned1 or controlled by     
entities headquartered or subject to    
jurisdiction of the ,people's ,republic 
of ,china4  7b7 ,recall authority  7#a7 
,in general ,subject to paragraph 7#c71 
not later than #ah months after the date
 of enactment of this ,act1 the         

,secretary shall issue for all covered  
devices that are determined pursuant to 
the review under subsection 7a7 to pose 
a cybersecurity risk an order requiring 
the appropriate person 7including the   
manufacturers1 importers1 distributors1 
or retailers of the covered device7--   
7,a7 to immediately cease distribution  
of such covered device2  7,b7 to        
immediately notify health professionals 
and device user facilities of the order 
and to instruct such professionals and  
facilities to cease use of such covered 
device2 and  7,c7 to notify all         
individuals subject to the risks        
associated with the use of such covered 
device4  7#b7 ,recall in cases of       
failure to provide information ,subject 
to paragraph 7#c71 for any covered      
device for which the covered            
manufacturer fails to submit the        
information requested under subsection  
7a77#b77;,a7 by the date that is #ahj   
days after the date on which such       
covered manufacturer received such      

request1 the ,secretary shall issue for 
such covered device an order requiring  
the appropriate person 7including the   
manufacturers1 importers1 distributors1 
or retailers of the covered device7--   
7,a7 to immediately cease distribution  
of such covered device2  7,b7 to        
immediately notify health professionals 
and device user facilities of the order 
and to instruct such professionals and  
facilities to cease use of such covered 
device2 and  7,c7 to notify all         
individuals subject to the risks        
associated with the use of such covered 
device4  7#c7 ,exemption ,the ,secretary
 may exempt from an order under         
paragraph 7#a7 or 7#b7 a covered device 
for which a recall would1 as determined 
by the ,secretary1 create a shortage    
that would pose a danger to patient     
health4  7c7 ,report ,not later than #b 
years after the date of enactment of    
this ,act1 the ,secretary1 in           
consultation with the ,director of the  
,cybersecurity and ,infrastructure      

,security ,agency1 shall submit to the  
,committee on ,health1 ,education1      
,labor1 and ,pensions and the ,committee
 on ,homeland ,security and             
,governmental ,affairs of the ,senate   
and the ,committee on ,energy and       
,commerce and the ,committee on         
,homeland ,security of the ,house of    
,representatives a report that          
includes-- 7#a7 a description of the    
cyber preparedness and data security of 
the device industry in the ,united      
,states2  7#b7 an analysis of the market
 share of devices used in the ,united   
,states of manufacturers headquartered  
in the ,people's ,republic of ,china2   
7#c7 an analysis of data security       
requirements and protections of devices 
used in the ,united ,states of          
manufacturers headquartered in or       
subject to the jurisdiction of the      
,people's ,republic of ,china2 and  7#d7
 recommendations for methods to bolster 
the cyber preparedness of the device    
industry in the ,united ,states4  7d7   

,definitions ,in this section3  7#a7    
,covered device ,the term covered device
 means a networked device that was      
manufactured by a covered manufacturer  
and was cleared1 authorized1 approved1  
or exempted under section #eaj7k71      
#eac7;f77#b71 #eae1 or #ebj7m7 of the   
,federal ,food1 ,drug1 and ,cosmetic    
,act 7#ba ,u4,s4,c4 #cfj7k71            
#cfj;c7f77#b71 #cfj;e1 #cfj;j7m77 on or 
before ,march #bh1 #bjbc4  7#b7 ,covered
 manufacturer  7,a7 ,in general ,the    
term covered manufacturer means a       
manufacturer--  7i7 headquartered in the
 ,people's ,republic of ,china2 or  7ii7
 that is owned or controlled by--  7,i7 
the ,people's ,republic of ,china2 or   
7,,ii7 #a or more individuals or        
entities of the ,people's ,republic of  
,china4  7,b7 ,exclusion ,the term      
covered manufacturer does not include a 
manufacturer that has operations1       
subsidiaries1 or publicly traded        
securities in the ,people's ,republic of
 ,china if such manufacturer is not     

otherwise a manufacturer described in   
subparagraph 7,a74  7#c7 ,cybersecurity 
risk ,the term cybersecurity risk means 
threats to and vulnerabilities of       
information or information systems and  
any related consequences caused by or   
resulting from unauthorized access1 use1
 disclosure1 degradation1 disruption1   
modification1 or destruction of such    
information or information systems1     
including such related consequences     
caused by an act of terrorism4  7#d7    
,networked ,the term networked1 with    
respect to a device1 means that the     
device includes software that has the   
ability to connect to the internet4