H. R. 2617—1374 
(c) SUNSET.—This section shall cease to be effective on October 
1, 2027. 
SEC. 3303. GAO REPORT ON THIRD-PARTY REVIEW. 
Not later than September 30, 2026, the Comptroller General 
of the United States shall submit to the Committee on Energy 
and Commerce of the House of Representatives and the Committee 
on Health, Education, Labor, and Pensions of the Senate a report 
on the third-party review program under section 523 of the Federal 
Food, Drug, and Cosmetic Act (21 U.S.C. 360m). Such report shall 
include— 
(1) a description of the financial and staffing resources 
used to carry out such program; 
(2) a description of actions taken by the Secretary pursuant 
section 523(b)(2)(C) of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 360m(b)(2)(C)); and 
(3) the results of an audit of the performance of select 
persons accredited under such program. 
SEC. 3304. CERTIFICATES TO FOREIGN GOVERNMENTS. 
Section 801(e)(4) of the Federal Food, Drug, and Cosmetic Act 
(21 U.S.C. 381(e)(4)) is amended— 
(1) in subparagraph (E), by striking clause (iii); and 
(2) by adding at the end the following: 
‘‘(F)(i) This paragraph applies to requests for certification under 
this subparagraph of a device manufactured by a device establish-
ment located outside of the United States that is registered under 
section 510, if the device is listed pursuant to section 510(j), the 
device has been cleared, approved, or is not required to submit 
a premarket report pursuant to subsection (l) or (m) of section 
510, and the device is imported or offered for import into the 
United States. 
‘‘(ii) The Secretary shall issue the certification as described 
in clause (iii) if the device or devices for which certification is 
requested under this subparagraph meet the applicable require-
ments of this Act. 
‘‘(iii)(I) A certification for a device described in clause (i) shall 
be subject to the fee described in subparagraph (B). 
‘‘(II) Notwithstanding subparagraph (C), a certification for a 
device described in clause (i) shall address and include the same 
material information as a ‘Certificate to Foreign Government’ and 
shall have a document title including the words ‘Certificate to 
Foreign Government’. 
‘‘(iv) The requirements and procedures of subparagraph (E) 
shall apply to a denial of a certification under this subparagraph.’’. 
SEC. 3305. ENSURING CYBERSECURITY OF MEDICAL DEVICES. 
(a) IN GENERAL.—Subchapter A of chapter V of the Federal 
Food, Drug, and Cosmetic Act (21 U.S.C. 351 et seq.) is amended 
by adding at the end the following: 
‘‘SEC. 524B. ENSURING CYBERSECURITY OF DEVICES. 
‘‘(a) IN GENERAL.—A person who submits an application or 
submission under section 510(k), 513, 515(c), 515(f), or 520(m) for 
a device that meets the definition of a cyber device under this 
section shall include such information as the Secretary may require 
to ensure that such cyber device meets the cybersecurity require-
ments under subsection (b).
H. R. 2617—1375 
‘‘(b) CYBERSECURITY
REQUIREMENTS.—The sponsor of an 
application or submission described in subsection (a) shall— 
‘‘(1) submit to the Secretary a plan to monitor, identify, 
and address, as appropriate, in a reasonable time, postmarket 
cybersecurity vulnerabilities and exploits, including coordinated 
vulnerability disclosure and related procedures; 
‘‘(2) design, develop, and maintain processes and procedures 
to provide a reasonable assurance that the device and related 
systems are cybersecure, and make available postmarket 
updates and patches to the device and related systems to 
address— 
‘‘(A) on a reasonably justified regular cycle, known 
unacceptable vulnerabilities; and 
‘‘(B) as soon as possible out of cycle, critical 
vulnerabilities that could cause uncontrolled risks; 
‘‘(3) provide to the Secretary a software bill of materials, 
including commercial, open-source, and off-the-shelf software 
components; and 
‘‘(4) comply with such other requirements as the Secretary 
may require through regulation to demonstrate reasonable 
assurance that the device and related systems are cybersecure. 
‘‘(c) DEFINITION.—In this section, the term ‘cyber device’ means 
a device that— 
‘‘(1) includes software validated, installed, or authorized 
by the sponsor as a device or in a device; 
‘‘(2) has the ability to connect to the internet; and 
‘‘(3) contains any such technological characteristics vali-
dated, installed, or authorized by the sponsor that could be 
vulnerable to cybersecurity threats. 
‘‘(d) EXEMPTION.—The Secretary may identify devices, or cat-
egories or types of devices, that are exempt from meeting the 
cybersecurity requirements established by this section and regula-
tions promulgated pursuant to this section. The Secretary shall 
publish in the Federal Register, and update, as appropriate, a 
list of the devices, or categories or types of devices, so identified 
by the Secretary.’’. 
(b) PROHIBITED ACT.—Section 301(q) of the Federal Food, Drug, 
and Cosmetic Act (21 U.S.C. 331(q)) is amended by adding at 
the end the following: 
‘‘(3) The failure to comply with any requirement under section 
524B(b)(2) (relating to ensuring device cybersecurity).’’. 
(c) RULE OF CONSTRUCTION.—Nothing in this section, including 
the amendments made by this section, shall be construed to affect 
the Secretary’s authority related to ensuring that there is a reason-
able assurance of the safety and effectiveness of devices, which 
may include ensuring that there is a reasonable assurance of the 
cybersecurity of certain cyber devices, including for devices approved 
or cleared prior to the date of enactment of this Act. 
(d) EFFECTIVE DATE.—The amendments made by subsections 
(a) and (b) shall take effect 90 days after the date of enactment 
of this Act. An application or submission submitted before such 
effective date shall not be subject to the requirements under sub-
section (a) or (b) of section 524B of the Federal Food, Drug, and 
Cosmetic Act, as added by this section. 
(e) GUIDANCE FOR INDUSTRY AND FDA STAFF ON DEVICE CYBER-
SECURITY.—Not later than 2 years after the date of enactment 
of this Act, and periodically thereafter as appropriate, the Secretary,
H. R. 2617—1376 
in consultation with the Director of the Cybersecurity and Infra-
structure Security Agency, shall review and, as appropriate and 
after soliciting and receiving feedback from device manufacturers, 
health care providers, third-party-device servicers, patient advo-
cates, and other appropriate stakeholders, update the guidance 
entitled ‘‘Content of Premarket Submissions for Management of 
Cybersecurity in Medical Devices’’ (or a successor document). 
(f) RESOURCES REGARDING CYBERSECURITY OF DEVICES.—Not 
later than 180 days after the date of enactment of this Act, and 
not less than annually thereafter, the Secretary shall update public 
information provided by the Food and Drug Administration, 
including on the website of the Food and Drug Administration, 
with information regarding improving cybersecurity of devices. Such 
information shall include information on identifying and addressing 
cyber vulnerabilities for health care providers, health systems, and 
device manufacturers, and how such entities may access support 
through the Cybersecurity and Infrastructure Security Agency and 
other Federal entities, including the Department of Health and 
Human Services, to improve the cybersecurity of devices. 
(g) GAO REPORT.—Not later than 1 year after the date of 
enactment of this Act, the Comptroller General of the United States 
shall publish a report identifying challenges in cybersecurity for 
devices, including legacy devices that may not support certain soft-
ware security updates. Through such report, the Comptroller Gen-
eral shall examine— 
(1) challenges for device manufacturers, health care pro-
viders, health systems, and patients in accessing Federal sup-
port to address vulnerabilities across Federal agencies; 
(2) how Federal agencies can strengthen coordination to 
better support cybersecurity for devices; and 
(3) statutory limitations and opportunities for improving 
cybersecurity for devices. 
(h) DEFINITION.—In this section, the term ‘‘device’’ has the 
meaning given such term in section 201(h) of the Federal Food, 
Drug, and Cosmetic Act (21 U.S.C. 321(h)). 
SEC. 3306. BANS OF DEVICES FOR ONE OR MORE INTENDED USES. 
(a) IN GENERAL.—Section 516(a) of the Federal Food, Drug, 
and Cosmetic Act (21 U.S.C. 360f(a)) is amended— 
(1) in paragraph (1), by inserting ‘‘for one or more intended 
uses’’ before the semicolon at the end; and 
(2) in the matter following paragraph (2), by inserting 
‘‘or to make such intended use or uses a banned intended 
use or uses. A device that is banned for one or more intended 
uses is not a legally marketed device under section 1006 when 
intended for such use or uses’’ after ‘‘banned device’’. 
(b) RULE OF CONSTRUCTION.—Nothing in this section shall be 
construed to limit the authority of the Secretary to amend, in 
accordance with section 516 of the Federal Food, Drug, and Cos-
metic Act (21 U.S.C. 360f), as amended by this section, and chapter 
5 of title 5, United States Code, regulations promulgated pursuant 
to such section 516, as amended by this section. 
SEC. 3307. THIRD PARTY DATA TRANSPARENCY. 
(a) IN GENERAL.—To the extent the Secretary relies on any 
data, analysis, or other information or findings provided by entities 
that has been funded in whole or in part by, or otherwise performed
H. R. 2617—1377 
under contract with, the Food and Drug Administration, in regu-
latory decision-making with respect to devices, the Secretary shall— 
(1) request access to the datasets, inputs, clinical or other 
assumptions, methods, analytical code, results, and other 
components underlying or comprising the analysis, conclusions, 
or other findings upon which the Secretary seeks to rely; and 
(2) in the event that information described in paragraph 
(1) is used to support regulatory decision-making, and as other-
wise appropriate, to the extent practicable, provide the manu-
facturer or manufacturers subject to such decision a summary 
of such information, subject to protection of confidential 
commercial information or trade secret information or person-
ally identifiable information. 
(b) REPORT.—Not later than September 30, 2023, and biennially 
thereafter, the Secretary shall submit to the Committee on Health, 
Education, Labor, and Pensions of the Senate and the Committee 
on Energy and Commerce of the House of Representatives, and 
publish on the website of the Food and Drug Administration, a 
report on the number of postmarket device signals communications 
issued by the Secretary, the sources of data for such signals, and 
how such signals were revised or resolved. 
(c) RULE OF CONSTRUCTION.—Nothing in this section shall be 
construed to require the delay of any regulatory decision-making 
or other action of the Food and Drug Administration. 
SEC. 3308. PREDETERMINED CHANGE CONTROL PLANS FOR DEVICES. 
(a) IN GENERAL.—Chapter V of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 351 et seq.) is amended by inserting after 
section 515B (21 U.S.C. 360e–3) the following: 
‘‘SEC. 515C. PREDETERMINED CHANGE CONTROL PLANS FOR DEVICES. 
‘‘(a) APPROVED DEVICES.— 
‘‘(1) IN GENERAL.—Notwithstanding section 515(d)(5)(A), a 
supplemental application shall not be required for a change 
to a device approved under section 515, if such change is 
consistent with a predetermined change control plan that is 
approved pursuant to paragraph (2). 
‘‘(2) PREDETERMINED
CHANGE
CONTROL
PLAN.—The Sec-
retary may approve a predetermined change control plan sub-
mitted in an application, including a supplemental application, 
under section 515 that describes planned changes that may 
be made to the device (and that would otherwise require a 
supplemental application under section 515), if the device 
remains safe and effective without any change. 
‘‘(3) SCOPE.—The Secretary may require that a change 
control plan include labeling required for safe and effective 
use of the device as such device changes pursuant to such 
plan, notification requirements if the device does not function 
as intended pursuant to such plan, and performance require-
ments for changes made under the plan. 
‘‘(b) CLEARED DEVICES.— 
‘‘(1) IN GENERAL.—Notwithstanding section 510(k), a pre-
market notification shall not be required for a change to a 
device cleared under section 510(k), if such change is consistent 
with an established predetermined change control plan granted 
pursuant to paragraph (2).