II 

117TH CONGRESS 

2D SESSION S. 4336 

To require the Secretary of Health and Human Services, in consultation 

with the Director of the Cybersecurity and Infrastructure Security Agency, to annually review and as appropriate update guidance for industry 

and Food and Drug Administration staff on medical device cybersecurity, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MAY 26, 2022 

Ms. ROSEN (for herself and Mr. YOUNG) introduced the following bill; which 

was read twice and referred to the Committee on Health, Education, 

Labor, and Pensions 

A BILL 

To require the Secretary of Health and Human Services, 

in consultation with the Director of the Cybersecurity 

and Infrastructure Security Agency, to annually review 

and as appropriate update guidance for industry and 

Food and Drug Administration staff on medical device 

cybersecurity, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Strengthening Cyber5 security for Medical Devices Act’’. 


kjohnson on DSK79L0C42PROD with BILLS
2 

•S 4336 IS

1 SEC. 2. GUIDANCE FOR INDUSTRY AND FDA STAFF ON MED2 ICAL DEVICE CYBERSECURITY. 

3 (a) IN GENERAL.—Not later than 2 years after the 

4 date of enactment of this Act, and every 2 years there5 after, the Secretary of Health and Human Services (re6 ferred to in this Act as the ‘‘Secretary’’), in consultation 

7 with the Director of the Cybersecurity and Infrastructure 

8 Security Agency, shall review and, as appropriate and 

9 after soliciting and receiving feedback from medical device 

10 manufacturers, health care providers, and patient advo11 cates, update the guidance entitled ‘‘Content of Premarket 

12 Submissions for Management of Cybersecurity in Medical 

13 Devices’’ (or a successor document). 

14 (b) UPDATING SPECIFIC PROVISIONS.—In updating 

15 the guidance under subsection (a), the Secretary may up16 date specific provisions of the guidance, after notice and 

17 comment, without reissuing the guidance. 

18 SEC. 3. RESOURCES REGARDING CYBERSECURITY OF MED19 ICAL DEVICES. 

20 Not later than 180 days after the date of enactment 

21 of this Act, and not less than annually thereafter, the Sec22 retary shall update public information provided by the 

23 Food and Drug Administration, including through the 

24 webpage on medical devices on the website of the Food 

25 and Drug Administration, with information regarding im26 proving cybersecurity of medical devices. Such information 


kjohnson on DSK79L0C42PROD with BILLS
3 

•S 4336 IS

1 shall include information on identifying and addressing 

2 cyber vulnerabilities for health care providers, health sys3 tems, and medical device manufacturers, and how such en4 tities may access support through the Cybersecurity and 

5 Infrastructure Security Agency and other Federal entities, 

6 including the Department of Health and Human Services, 

7 to improve cybersecurity of medical devices. 

8 SEC. 4. GAO REPORT. 

9 Not later than 1 year after the date of enactment 

10 of this Act, the Comptroller General of the United States 

11 shall publish a report identifying challenges in cybersecu12 rity for medical devices, including legacy devices that may 

13 not support certain software security updates. Through 

14 such report, the Comptroller General shall examine— 

15 (1) challenges for medical device manufactur16 ers, health care providers, health systems, and pa17 tients in accessing Federal support to address 

18 vulnerabilities across Federal agencies; and 

19 (2) how Federal agencies can strengthen coordi20 nation to better support cybersecurity for medical 

21 devices. 

Æ 


kjohnson on DSK79L0C42PROD with BILLS