I 
115TH CONGRESS 
1ST SESSION H. R. 3985 
To establish a working group of public and private entities led by the Food 
and Drug Administration to recommend voluntary frameworks and guide-
lines to increase the security and resilience of Internet of Medical Things 
devices, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 5, 2017 
Mr. TROTT (for himself and Mrs. BROOKS of Indiana) introduced the 
following bill; which was referred to the Committee on Energy and Commerce 
A BILL 
To establish a working group of public and private entities 
led by the Food and Drug Administration to recommend 
voluntary frameworks and guidelines to increase the se-
curity and resilience of Internet of Medical Things de-
vices, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Internet of Medical 
Things Resilience Partnership Act of 2017’’. 
VerDate Sep 11 2014 
00:13 Oct 11, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3985.IH
H3985
lotter on DSKBCFDHB2PROD with BILLS
SEC. 2. STUDY ON THE SECURITY AND RESILIENCE OF CER-
TAIN MEDICAL DEVICES. 
(a) STUDY.—Not later than 5 months after the date 
of enactment of this Act, the Commissioner of the Food 
and Drug Administration, in consultation with the Na-
tional Institute of Standards and Technology, shall estab-
lish a working group of public and private entities to de-
velop recommendations for voluntary frameworks and 
guidelines to increase the security and resilience of net-
worked medical devices sold in the United States that 
store, receive, access, or transmit information to an exter-
nal recipient or system for which unauthorized access, 
modification, misuse, or denial of use may result in patient 
harm. 
(b) WORKING GROUP.— 
(1) IN GENERAL.—In developing the recommen-
dations under subsection (a), the Commissioner shall 
seek input from a working group representing the 
Federal Government, industry, and academia. 
(2) CHAIRPERSON.—The Commissioner of the 
Food and Drug Administration, or a designee of the 
Commissioner, shall serve as the chairperson of the 
working group established under paragraph (1). 
(3) MEMBERSHIP.—Membership of the working 
group shall include a representative from each of the 
following: 
VerDate Sep 11 2014 
00:13 Oct 11, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3985.IH
H3985
lotter on DSKBCFDHB2PROD with BILLS
(A) The Center for Devices and Radio-
logical Health of the Food and Drug Adminis-
tration. 
(B) The Office of the National Coordinator 
for Health Information Technology of the De-
partment of Health and Human Services. 
(C) The Office of Technology Research 
and Investigation of the Federal Trade Com-
mission. 
(D) The Cybersecurity and Communica-
tions Reliability Division of the Federal Com-
munications Commission. 
(E) The National Institute of Standards 
and Technology of the Department of Com-
merce. 
(F) The National Cyber Security Alliance. 
(4) APPOINTED
MEMBERS.—The chairperson 
shall appoint to the working group a minimum of 3 
qualified representatives from each of the following 
private sector categories: 
(A) Medical device manufacturers. 
(B) Health care providers. 
(C) Health insurance providers. 
(D) Cloud computing. 
(E) Wireless network providers. 
VerDate Sep 11 2014 
00:13 Oct 11, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3985.IH
H3985
lotter on DSKBCFDHB2PROD with BILLS
(F) Enterprise security solutions systems. 
(G) Health information technology. 
(H) Web-based mobile application devel-
opers. 
(I) Software developers. 
(J) Hardware developers. 
(c) REPORT.—Not later than 18 months after the 
date of enactment of this Act, the Commissioner shall sub-
mit to Congress a report on the recommendations devel-
oped under subsection (a), including— 
(1) an identification of existing cybersecurity 
standards, guidelines, frameworks, and best prac-
tices that are applicable to mitigate vulnerabilities in 
the devices described in subsection (a); 
(2) an identification of existing and developing 
international and domestic cybersecurity standards, 
guidelines, frameworks, and best practices that miti-
gate vulnerabilities in such devices; 
(3) a specification of high-priority gaps for 
which new or revised standards are needed; and 
(4) potential action plans by which such gaps 
can be addressed. 
Æ 
VerDate Sep 11 2014 
00:13 Oct 11, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H3985.IH
H3985
lotter on DSKBCFDHB2PROD with BILLS