,,ii #aai? ,,congress #b;d ,session ,s4 #dici ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$ ,,/ates ,june #bd1 #bjbf ,mr4 ,cotton introduc$ ! foll[+ bill2 :i* 0 read twice & ref]r$ to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ,a ,,bill ,to require ! ,secret>y ( ,heal? & ,human ,s]vices to review c]ta9 m$ical devices manufactur$ 9 ! ,p's ,republic ( ,*9a = pot5tial cyb]security issues1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,c\nt]+ ,*9ese ,cyb]?reats = ,pati5ts ,act or ! ,c\nt]+ ,,ccp ,act4 #b4 ,review & recall ( c]ta9 m$ical devices manufactur$ 9 ! ,p's ,republic ( ,*9a 7a7 ,review ( c]ta9 devices 7#a7 ,9 g5]al ,! ,secret>y ( ,heal? & ,human ,s]vices1 act+ ?r\gh ! ,commission] ( ,food & ,drugs 7ref]r$ to 9 ?is section z ! ,secret>y71 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all review ea* cov]$ device = pot5tial cyb]security issues4 7#b7 ,reque/ = in=mation 7,a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all reque/ f ea* cov]$ manufactur] ( a cov]$ device su* in=mation z is necess>y to conduct ! review "u p>agraph 7#a71 includ+-- 7i7 a s(tw>e bill ( mat]ials = ! cov]$ device1 includ+ comm]cial1 op5-s\rce1 & (f-!-%elf s(tw>e compon5ts1 & data mapp+ & ar*itecture docum5tation2 7ii7 locations ( entities1 in=mation sy/ems1 & s]v]s hold+ pati5t data2 & 7iii7 any o!r in=mation ! ,secret>y det]m9es necess>y4 7,b7 ,requirem5ts ,9 det]m9+ ! =m & scope ( in=mation to reque/ "u subp>agraph 7,a71 ! ,secret>y1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all analyze cov]$ devices & seek in=mation1 includ+ in=mation on any processes & proc$ures ( ! cov]$ manufactur]1 t1 z det]m9$ by ,secret>y1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy-- 7i7 w\ld provide a reasonable assurance t ! cov]$ device & relat$ sy/ems are & w rema9 cyb]secure2 & 7ii7 w\ld provide a reasonable assurance t pati5t data w\ld n be /or$ or transf]r$ ?r\gh sy/ems or s]v]s locat$ 91 own$1 or controll$ by entities headqu>t]$ or subject to jurisdiction ( ! ,p's ,republic ( ,*9a4 7b7 ,recall au?ority 7#a7 ,9 g5]al ,subject to p>agraph 7#c71 n lat] ?an #ah mon?s aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y %all issue = all cov]$ devices t are det]m9$ pursuant to ! review "u subsection 7a7 to pose a cyb]security risk an ord] requir+ ! appropriate p]son 7includ+ ! manufactur]s1 import]s1 di/ributors1 or retail]s ( ! cov]$ device7-- 7,a7 to imm$iately cease di/ribution ( su* cov]$ device2 7,b7 to imm$iately notify heal? pr(essionals & device us] facilities ( ! ord] & to in/ruct su* pr(essionals & facilities to cease use ( su* cov]$ device2 & 7,c7 to notify all individuals subject to ! risks associat$ ) ! use ( su* cov]$ device4 7#b7 ,recall 9 cases ( failure to provide in=mation ,subject to p>agraph 7#c71 = any cov]$ device = :i* ! cov]$ manufactur] fails to submit ! in=mation reque/$ "u subsection 7a77#b77;,a7 by ! date t is #ahj days aft] ! date on :i* su* cov]$ manufactur] receiv$ su* reque/1 ! ,secret>y %all issue = su* cov]$ device an ord] requir+ ! appropriate p]son 7includ+ ! manufactur]s1 import]s1 di/ributors1 or retail]s ( ! cov]$ device7-- 7,a7 to imm$iately cease di/ribution ( su* cov]$ device2 7,b7 to imm$iately notify heal? pr(essionals & device us] facilities ( ! ord] & to in/ruct su* pr(essionals & facilities to cease use ( su* cov]$ device2 & 7,c7 to notify all individuals subject to ! risks associat$ ) ! use ( su* cov]$ device4 7#c7 ,exemption ,! ,secret>y may exempt f an ord] "u p>agraph 7#a7 or 7#b7 a cov]$ device = :i* a recall w\ld1 z det]m9$ by ! ,secret>y1 create a %ortage t w\ld pose a dang] to pati5t heal?4 7c7 ,report ,n lat] ?an #b ye>s aft] ! date ( enactm5t ( ?is ,act1 ! ,secret>y1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy1 %all submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions & ! ,committee on ,homel& ,security & ,gov]nm5tal ,affairs ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce & ! ,committee on ,homel& ,security ( ! ,h\se ( ,repres5tatives a report t includes-- 7#a7 a description ( ! cyb] prep>$ness & data security ( ! device indu/ry 9 ! ,unit$ ,/ates2 7#b7 an analysis ( ! m>ket %>e ( devices us$ 9 ! ,unit$ ,/ates ( manufactur]s headqu>t]$ 9 ! ,p's ,republic ( ,*9a2 7#c7 an analysis ( data security requirem5ts & protections ( devices us$ 9 ! ,unit$ ,/ates ( manufactur]s headqu>t]$ 9 or subject to ! jurisdiction ( ! ,p's ,republic ( ,*9a2 & 7#d7 recomm5dations = me?ods to bol/] ! cyb] prep>$ness ( ! device indu/ry 9 ! ,unit$ ,/ates4 7d7 ,def9itions ,9 ?is section3 7#a7 ,cov]$ device ,! t]m cov]$ device means a network$ device t 0 manufactur$ by a cov]$ manufactur] & 0 cle>$1 au?oriz$1 approv$1 or exempt$ "u section #eaj7k71 #eac7;f77#b71 #eae1 or #ebj7m7 ( ! ,f$]al ,food1 ,drug1 & ,cosmetic ,act 7#ba ,u4,s4,c4 #cfj7k71 #cfj;c7f77#b71 #cfj;e1 #cfj;j7m77 on or be=e ,m>* #bh1 #bjbc4 7#b7 ,cov]$ manufactur] 7,a7 ,9 g5]al ,! t]m cov]$ manufactur] means a manufactur]-- 7i7 headqu>t]$ 9 ! ,p's ,republic ( ,*9a2 or 7ii7 t is own$ or controll$ by-- 7,i7 ! ,p's ,republic ( ,*9a2 or 7,,ii7 #a or m individuals or entities ( ! ,p's ,republic ( ,*9a4 7,b7 ,exclusion ,! t]m cov]$ manufactur] does n include a manufactur] t has op]ations1 subsidi>ies1 or publicly trad$ securities 9 ! ,p's ,republic ( ,*9a if su* manufactur] is n o!rwise a manufactur] describ$ 9 subp>agraph 7,a74 7#c7 ,cyb]security risk ,! t]m cyb]security risk means ?reats to & vuln]abilities ( in=mation or in=mation sy/ems & any relat$ consequ5ces caus$ by or result+ f unau?oriz$ access1 use1 disclosure1 degradation1 disruption1 modification1 or de/ruction ( su* in=mation or in=mation sy/ems1 includ+ su* relat$ consequ5ces caus$ by an act ( t]rorism4 7#d7 ,network$ ,! t]m network$1 ) respect to a device1 means t ! device includes s(tw>e t has ! ability to connect to ! int]net4