II 

117TH CONGRESS 

2D SESSION S. 3983 

To amend the Federal Food, Drug, and Cosmetic Act to require, for purposes 

of ensuring cybersecurity, the inclusion in any premarket submission 

for a cyber device of information to demonstrate a reasonable assurance 

of safety and effectiveness throughout the lifecycle of the cyber device, 

and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 31, 2022 

Mr. CASSIDY (for himself and Ms. BALDWIN) introduced the following bill; 

which was read twice and referred to the Committee on Health, Education, Labor, and Pensions 

A BILL 

To amend the Federal Food, Drug, and Cosmetic Act to 

require, for purposes of ensuring cybersecurity, the inclusion in any premarket submission for a cyber device 

of information to demonstrate a reasonable assurance 

of safety and effectiveness throughout the lifecycle of 

the cyber device, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘PATCH Act’’. 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•S 3983 IS

1 SEC. 2. ENSURING CYBERSECURITY OF MEDICAL DEVICES. 

2 (a) IN GENERAL.—Subchapter A of chapter V of the 

3 Federal Food, Drug, and Cosmetic Act (21 U.S.C. 351 

4 et seq.) is amended by adding at the end the following: 

5 ‘‘SEC. 524B. ENSURING CYBERSECURITY OF DEVICES. 

6 ‘‘(a) IN GENERAL.—For purposes of ensuring cyber7 security throughout the lifecycle of a cyber device, any per8 son who submits a premarket submission for the cyber de9 vice shall include such information as the Secretary may 

10 require to ensure that the cyber device meets such cyberse11 curity requirements as the Secretary determines to be ap12 propriate to demonstrate a reasonable assurance of safety 

13 and effectiveness, including at a minimum the cybersecu14 rity requirements under subsection (b). The Secretary may 

15 establish exemptions to the requirements under this sub16 section. 

17 ‘‘(b) CYBERSECURITY REQUIREMENTS.—At a min18 imum, the manufacturer of a cyber device shall meet the 

19 following cybersecurity requirements: 

20 ‘‘(1) The manufacturer shall have a plan to ap21 propriately monitor, identify, and address in a rea22 sonable time postmarket cybersecurity vulnerabilities 

23 and exploits. 

24 ‘‘(2) The manufacturer shall— 

25 ‘‘(A) have a plan and procedures for a Co26 ordinated Vulnerability Disclosure to be part of 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•S 3983 IS

1 submissions to the Food and Drug Administra2 tion; and 

3 ‘‘(B) collect and maintain such other infor4 mation as the Secretary may (by order pub5 lished in the Federal Register or by other proc6 ess) require to demonstrate a reasonable assur7 ance of the safety and effectiveness of the cyber 

8 device. 

9 ‘‘(3) The manufacturer shall design, develop, 

10 and maintain processes and procedures to make 

11 available updates and patches to the cyber device 

12 and related systems throughout the lifecycle of the 

13 cyber device to address— 

14 ‘‘(A) on a reasonably justified regular 

15 cycle, known unacceptable vulnerabilities; and 

16 ‘‘(B) as soon as possible out of cycle, crit17 ical vulnerabilities that could cause uncontrolled 

18 risks. 

19 ‘‘(4) The manufacturer shall furnish to the Sec20 retary a software bill of materials, including com21 mercial, open-sourced, and off-the-shelf software 

22 components that will be provided to users. 

23 ‘‘(c) SUBSTANTIAL EQUIVALENCE.—In making a de24 termination of substantial equivalence under section 

25 513(i) for a cyber device, the Secretary may— 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•S 3983 IS

1 ‘‘(1) find that cybersecurity information for the 

2 cyber device described in the relevant premarket 

3 submission in the cyber device’s use environment is 

4 inadequate; and 

5 ‘‘(2) issue a nonsubstantial equivalence deter6 mination based on this finding. 

7 ‘‘(d) DEFINITION.—In this section: 

8 ‘‘(1) The term ‘cyber device’ means a device 

9 that— 

10 ‘‘(A) includes software; or 

11 ‘‘(B) is intended to connect to the internet. 

12 ‘‘(2) The term ‘lifecycle of the cyber device’ in13 cludes the postmarket lifecycle of the cyber device. 

14 ‘‘(3) The term ‘premarket submission’ means 

15 any submission under section 510(k), 513, 515(c), 

16 515(f), or 520(m).’’. 

17 (b) PROHIBITED ACT.—Section 301(q) of the Fed18 eral Food, Drug, and Cosmetic Act (21 U.S.C. 331(q)) 

19 is amended by adding at the end the following: 

20 ‘‘(3) The failure to comply with any requirement 

21 under section 524B (relating to ensuring the cybersecu22 rity).’’. 

23 (c) ADULTERATION.—Section 501 of the Federal 

24 Food, Drug, and Cosmetic Act (21 U.S.C. 351) is amend25 ed by adding at the end the following: 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•S 3983 IS

1 ‘‘(k) If it is a device with respect to which the sponsor 

2 is in violation of section 524B (relating to ensuring cyber3 security).’’. 

4 (d) MISBRANDING.—Section 502(t) of the Federal 

5 Food, Drug, and Cosmetic Act (21 U.S.C. 352(t)) is 

6 amended— 

7 (1) by striking ‘‘or (3)’’ and inserting ‘‘(3)’’; 

8 and 

9 (2) by inserting before the period at the end the 

10 following: ‘‘, or (4) to furnish a software bill of ma11 terials as required under section 524B (relating to 

12 ensuring the cybersecurity)’’. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS