In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

[EX Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Banking Privacy Act of 1999''.

SEC. 2. PERSONAL INFORMATION SHARING.

    (a) Depository Institutions and Subsidiaries of Depository 
Institutions.--Section 18 of the Federal Deposit Insurance Act (12 
U.S.C. 1828) is amended by adding at the end the following new 
subsection:
    ``(t) Personal Information Sharing Requirements.--
            ``(1) Information sharing prohibited if customer opts 
        out.--Notwithstanding any other provision of law and except as 
        permitted under paragraph (5), an insured depository 
        institution and a subsidiary of a depository institution may 
        not disclose or transfer customer information relating to any 
        customer to any other person, including an affiliate of the 
        depository institution, unless--
                    ``(A) the customer to whom such information relates 
                has been provided with notice in accordance with 
                paragraph (2); and
                    ``(B) the customer has not provided a written 
                directive (including a transmission by e-mail, 
                facsimile, or other form of electronic communication) 
                to the insured depository institution or subsidiary, at 
                any time before the close of business on the 6th 
                business day before such disclosure or transfer, that 
                such information shall not be disclosed or transferred, 
                except when specifically authorized by the customer in 
                connection with and pertaining to a specific 
                transaction with the depository institution or 
                subsidiary.
            ``(2) Notice.--
                    ``(A) In general.--The notice referred to in 
                paragraph (1)(A) shall fully and fairly disclose, in 
                accordance with regulations which the Federal banking 
                agencies shall jointly prescribe, what information is 
                being disclosed or transferred, the policy of the 
                insured depository institution or subsidiary of an 
                insured depository institution with regard to 
                information sharing, and the right of the customer to 
                prohibit the disclosure or transfer of such 
                information.
                    ``(B) Form of notice.--
                            ``(i) In general.--The regulations 
                        prescribed pursuant to subparagraph (A) shall 
                        require that the notice required under such 
                        subparagraph--
                                    ``(I) be prominently displayed on a 
                                document which is separate from any 
                                other document;
                                    ``(II) have the term `Privacy 
                                Notice' in prominent typeface at the 
                                top of the notice.
                            ``(ii) Notice requirements.--
                                    ``(I) Mailing.--If the notice 
                                required under subparagraph (A) is 
                                mailed to the customer, the notice 
                                shall be mailed separately from any 
                                other statement, document, or notice 
                                mailed to the customer.
                                    ``(II) In person.--If the notice 
                                required under subparagraph (A) is 
                                disclosed to the customer in person by 
                                an officer, director, or agent of the 
                                depository institution or subsidiary 
                                thereof, the officer, employee, or 
                                agent shall obtain the written 
                                acknowledgement of the customer of the 
                                receipt of such notice separately from 
                                any other signature or written 
                                acknowledgment of the customer.
            ``(3) Customer information defined.--For purposes of this 
        subsection, the term `customer information' means any 
        information acquired from a customer of the insured depository 
        institution that is personally identifiable to the customer, 
        including information relating to transactions, balances, 
        maturity dates, payouts, and payout dates, and transaction or 
        experience information.
            ``(4) Reasonable opportunity to respond to notice.--In 
        order to provide any customer of an insured depository 
        institution or any subsidiary of an insured depository 
        institution with reasonable opportunity to respond to any 
        notice referred to in paragraph (1)(A), the prohibition 
        contained in paragraph (1) on the disclosure or transfer of any 
        customer information relating to such customer to any other 
        person, including an affiliate, shall continue during the 30-
        day period beginning on the date the notice referred to in such 
        paragraph was sent or delivered to such customer, unless the 
        customer has authorized such disclosure or transfer.
            ``(5) Exceptions.--Paragraph (1) shall not apply to the 
        disclosure or transfer of customer information--
                    ``(A) in connection with processing a specific 
                financial transaction that the customer to whom the 
                information relates has authorized, if--
                            ``(i) the customer has been informed that 
                        any such transaction will necessarily involve 
                        the disclosure or transfer of such information; 
                        and
                            ``(ii) the person to whom such information 
                        is transferred or disclosed is subject to a 
                        legal or contractual obligation not to use such 
                        information for any purpose other than in 
                        connection with facilitating the transaction;
                    ``(B) in connection with any routine financial 
                transaction which does not involve marketing of 
                services or the sale of customer information, if the 
                person to whom such information is transferred or 
                disclosed is subject to a legal or contractual 
                obligation not to use such information for any purpose 
                other than in connection with effectuating the 
                transaction;
                    ``(C) in connection with clearing checks, 
                processing credit transactions or electronic fund 
                transfers, or providing mailing services, if the person 
                to whom such information is transferred or disclosed is 
                subject to a legal or contractual obligation not to use 
                such information for any purpose other than in 
                connection with clearing or processing the transaction 
                or providing the service;
                    ``(D) to a governmental, regulatory, or self-
                regulatory authority having jurisdiction over the 
                insured depository institution for examination, 
                compliance, or other authorized purposes;
                    ``(E) to a court of competent jurisdiction;
                    ``(F) to a consumer reporting agency, as defined in 
                section 603(f) of the Fair Credit Reporting Act, for 
                use solely in accordance with such Act;
                    ``(G) in the case of a default by the customer on 
                an obligation to the depository institution or 
                subsidiary, to a debt collector, as defined in section 
                803(6) of the Fair Debt Collection Practices Act, 
                counsel, or other entity involved in debt collection, 
                for use solely in accordance with such Act;
                    ``(H) in the case of any claim or litigation 
                between the customer and a depository institution or 
                subsidiary, to a counsel or other person involved in 
                the resolution of the dispute;
                    ``(I) that is not personally identifiable to the 
                customer or is public information; or
                    ``(J) that is necessary to prevent or investigate 
                fraudulent or unlawful acts which the depository 
                institution or subsidiary has a good faith belief may 
                occur or may have occurred.''.
    (b) Bank Holding Companies and Affiliates of Bank Holding 
Companies.--Section 5 of the Bank Holding Company Act of 1956 (12 
U.S.C. 1844) is amended by adding at the end the following new 
subsection:
    ``(g) Personal Information Sharing Requirements.--
            ``(1) Information sharing prohibited if customer opts 
        out.--Notwithstanding any other provision of law and except as 
        permitted under paragraph (5), a bank holding company and an 
        affiliate of a bank holding company (other than a depository 
        institution subsidiary or subsidiary of such depository 
        institution) may not disclose or transfer customer information 
        relating to any customer to any other person, including another 
        affiliate of the bank holding company, unless--
                    ``(A) the customer to whom such information relates 
                has been provided with notice in accordance with 
                paragraph (2); and
                    ``(B) the customer has not provided a written 
                directive (including a transmission by e-mail, 
                facsimile, or other form of electronic communication) 
                to the bank holding company or affiliate, at any time 
                before the close of business on the 6th business day 
                before such disclosure or transfer, that such 
                information shall not be disclosed or transferred, 
                except when specifically authorized by the customer in 
                connection with and pertaining to a specific 
                transaction with the bank holding company or affiliate.
            ``(2) Notice.--
                    ``(A) In general.--The notice referred to in 
                paragraph (1)(A) shall fully and fairly disclose, in 
                accordance with regulations which the Board shall 
                prescribe, what information is being disclosed or 
                transferred, the policy of the bank holding company or 
                affiliate of a bank holding company with regard to 
                information sharing, and the right of the customer to 
                prohibit the disclosure or transfer of such 
                information.
                    ``(B) Form of notice.--
                            ``(i) In general.--The regulations 
                        prescribed pursuant to subparagraph (A) shall 
                        require that the notice required under such 
                        subparagraph--
                                    ``(I) be prominently displayed on a 
                                document which is separate from any 
                                other document:
                                    ``(II) have the term `Privacy 
                                Notice' in prominent typeface at the 
                                top of the notice.
                            ``(ii) Notice requirements.--
                                    ``(I) Mailing.--If the notice 
                                required under subparagraph (A) is 
                                mailed to the customer, the notice 
                                shall be mailed separately from any 
                                other statement, document, or notice 
                                mailed to the customer.
                                    ``(II) In person.--If the notice 
                                required under subparagraph (A) is 
                                disclosed to the customer in person by 
                                an officer, director, or agent of the 
                                bank holding company or affiliate 
                                thereof, the officer, employee, or 
                                agent shall obtain the written 
                                acknowledgement of the customer of the 
                                receipt of such notice separately from 
                                any other signature or written 
acknowledgment of the customer.
            ``(3) Customer information defined.--For purposes of this 
        subsection, the term `customer information' means any 
        information acquired from a customer of the bank holding 
        company or affiliate that is personally identifiable to the 
        customer, including information relating to transactions, 
        balances, maturity dates, payouts, and payout dates, and 
        transaction or experience information.
            ``(4) Reasonable opportunity to respond to notice.--In 
        order to provide any customer of a bank holding company or any 
        affiliate of a bank holding company with reasonable opportunity 
        to respond to any notice referred to in paragraph (1)(A), the 
        prohibition contained in paragraph (1) on the disclosure or 
        transfer of any customer information relating to such customer 
        to any other person, including another affiliate, shall 
        continue during the 30-day period beginning on the date the 
        notice referred to in such paragraph was sent or delivered to 
        such customer, unless the customer has authorized such 
        disclosure or transfer.
            ``(5) Exceptions.--Paragraph (1) shall not apply to the 
        disclosure or transfer of customer information--
                    ``(A) in connection with processing a specific 
                financial transaction that the customer to whom the 
                information relates has authorized, if--
                            ``(i) the customer has been informed that 
                        any such transaction will necessarily involve 
                        the disclosure or transfer of such information; 
                        and
                            ``(ii) the person to whom such information 
                        is transferred or disclosed is subject to a 
                        legal or contractual obligation not to use such 
                        information for any purpose other than in 
                        connection with facilitating the transaction;
                    ``(B) in connection with any routine financial 
                transaction which does not involve marketing of 
                services or the sale of customer information, if the 
                person to whom such information is transferred or 
                disclosed is subject to a legal or contractual 
                obligation not to use such information for any purpose 
                other than in connection with effectuating the 
                transaction;
                    ``(C) in connection with clearing checks, 
                processing financial transactions or electronic fund 
                transfers, or providing mailing services, if the person 
                to whom such information is transferred or disclosed is 
                subject to a legal or contractual obligation not to use 
                such information for any purpose other than in 
                connection with clearing or processing the transaction 
                or providing the service;
                    ``(D) to a governmental, regulatory, or self-
                regulatory authority having jurisdiction over the 
                insured depository institution for examination, 
                compliance, or other authorized purposes;
                    ``(E) to a court of competent jurisdiction;
                    ``(F) to a consumer reporting agency, as defined in 
                section 603(f) of the Fair Credit Reporting Act, for 
                use solely in accordance with such Act;
                    ``(G) in the case of a default by the customer on 
                an obligation to the bank holding company or affiliate, 
                to a debt collector, as defined in section 803(6) of 
                the Fair Debt Collection Practices Act, counsel, or 
                other entity involved in debt collection, for use 
                solely in accordance with such Act;
                    ``(H) in the case of any claim or litigation 
                between the customer and a depository institution or 
                subsidiary, to counsel or any other person involved in 
                the resolution of the dispute;
                    ``(I) that is not personally identifiable to the 
                customer or is public information; or
                    ``(J) that is necessary to prevent or investigate 
                fraudulent or unlawful acts which the bank holding 
                company or affiliate has a good faith belief may occur 
                or may have occurred.''.
[EX A]: Banking Privacy Act of 1999 - Amends the Federal Deposit Insurance Act and the Bank Holding Company Act of 1956 to mandate customer notice and written consent as a prerequisite to personal information sharing between institutions under their purview (an insured depository institution or bank holding company, respectively) and other persons or affiliates. 
Delineates notice and consent procedures.

[EX Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Medical Device Cybersecurity Act of 
2017''.

SEC. 2. CYBERSECURITY FOR MEDICAL DEVICES.

    (a) In General.--Chapter V of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 351 et seq.) is amended by inserting after section 520 
(21 U.S.C. 360j) the following--

``SEC. 520A. CYBERSECURITY FOR DEVICES.

    ``(a) Definitions.--In this section:
            ``(1) Cyber device.--The term `cyber device' means any 
        device that has network or Internet connectivity (such as near 
        field communication (NFC), Bluetooth, or WiFi), connects to an 
        external storage device or external media (such as a universal 
        serial bus (USB) or a compact disk), or has any other cyber 
        capability.
            ``(2) Cybersecurity fix or update.--The term `cybersecurity 
        fix or update' means any modification to a cyber device that 
        addresses a software, firmware, or hardware error or known 
        vulnerability, or a security update, and does not change the 
        therapeutic or diagnostic function of the device.
    ``(b) Transparency of Risk Prior to Marketing.--
            ``(1) Report card.--
                    ``(A) In general.--The Secretary, in coordination 
                with the entities described in subparagraph (B), shall 
                develop a report card for indicating the cybersecurity 
                functions of cyber devices. The report card shall 
                contain the contents described in paragraph (2) and be 
                disclosed in accordance with paragraph (3).
                    ``(B) Coordination.--The entities described in this 
                subparagraph are the following:
                            ``(i) The National Institute of Standards 
                        and Technology.
                            ``(ii) The Secretary of Homeland Security.
                            ``(iii) The National Coordination Office 
                        supporting the Networking and Information 
                        Technology Research and Development Program.
                            ``(iv) The Federal Trade Commission.
                            ``(v) Any other relevant agency, or 
                        cybersecurity or medical device industry group, 
                        as determined by the Secretary.
            ``(2) Contents of report card.--Each report card shall 
        contain each of the following:
                    ``(A) Information pertaining to all essential 
                elements described in the most recent version of the 
                Manufacturer Disclosure Statement for Medical Device 
                Security, as set forth by the Healthcare Information 
                and Management Systems Society and the National 
                Electrical Manufacturers Association.
                    ``(B) A traceability matrix, accepted by the 
                Secretary, that--
                            ``(i) redacts content that is confidential, 
                        as determined by the Secretary; and
                            ``(ii) establishes design components and 
                        traces such components to design compensating 
                        controls.
                    ``(C) A description of any manufacturer 
                compensating controls that--
                            ``(i) effectively address known common 
                        vulnerabilities and exposures; and
                            ``(ii) provide providers with industry 
                        standard compensating controls for improving 
                        cybersecurity.
                    ``(D) A description of--
                            ``(i) any cybersecurity evaluation 
                        conducted on the device, including any testing, 
                        validation, or verification of the device;
                            ``(ii) who conducted such evaluation; and
                            ``(iii) the results of such evaluation.
                    ``(E) A cybersecurity risk assessment conducted by 
                the manufacturer, or a third party, explaining the risk 
                of the device to patient safety and clinical hazards.
                    ``(F) An indication of whether the device is 
                capable of being remotely accessed. If the device is 
                capable of being remotely accessed, an indication of 
                any security measures and access protocols the device 
                has in place to secure such access.
            ``(3) Disclosure of report card.--
                    ``(A) Clearance or approval.--The manufacturer of 
                any cyber device shall include the report card in any 
                notification to the Secretary under section 510(k) or 
                any application for premarket approval under section 
                515(c), as applicable.
                    ``(B) Public accessibility.--
                            ``(i) In general.--The Secretary shall 
                        provide a copy of the report card to any entity 
                        described in clause (ii) that submits a request 
                        for such copy to the Secretary.
                            ``(ii) Entities permitted access.--An 
                        entity described in this clause is--
                                    ``(I) any health care industry 
                                entity, consisting of any provider, 
                                device manufacturer, the Federal 
                                Government, health care information 
                                security researchers, and health care 
                                academia; and
                                    ``(II) any entity determined by the 
                                Secretary to have a valid interest in 
                                the report card.
                    ``(C) Updated report card.--For as long as the 
                cyber device receives technical support from the 
                manufacturer or any other third party authorized by the 
                manufacturer, the manufacturer shall submit to the 
                Secretary an annual update to the report card.
    ``(c) Protecting Remote Access to Managed Solutions.--
            ``(1) In general.--A manufacturer of a cyber device shall:
                    ``(A) In order to remotely access such device after 
                selling, or otherwise transferring ownership of, the 
                device, obtain consent for such access from the 
                provider owning or operating the device and from any 
                patient on which the device is used. Such consent may 
                be in the form of an agreement entered into between the 
                provider and the manufacturer at the time the device is 
                sold to the provider, and may be for the manufacturer 
                to remotely access the device at times specified in 
                such agreement or by an agreement between the 
                manufacturer and provider entered into thereafter. In 
                the case of an agreement described in the previous 
                sentence, consent of the patient may be obtained 
                through the provider notifying the patient of such 
                agreement.
                    ``(B) For any cyber device that the manufacturer 
                may remotely access in accordance with subparagraph 
                (A):
                            ``(i) Notify the provider when the 
                        manufacturer accesses the device remotely, 
                        including the name of the person with such 
                        access, the kinds of tasks that can be 
                        performed through such access, and the software 
                        used to access the device. Such notification 
                        can be in the form of an audit log described in 
                        clause (ii) if the audit log is readily 
                        available to the provider.
                            ``(ii) Maintain an audit log for each time 
                        the manufacturer accesses the device remotely 
                        and make such log accessible to the provider.
                    ``(C) Except as provided in paragraph (2), for any 
                cyber device that has the capability to be accessed 
                remotely by the manufacturer or any other entity:
                            ``(i) Implement multi-factor authentication 
                        for accessing any cyber capability of the 
                        device.
                            ``(ii) Secure data in motion and data at 
                        rest with data encryption, and other best 
                        practices, approved by the National Institute 
                        of Standards and Technology.
                            ``(iii) Install automated tools to track 
                        access, or identify attempts at unauthorized 
                        access, to any cyber capability of the device.
                            ``(iv) Adopt whitelisting approaches and 
                        changeable passwords for accessing any cyber 
                        capability of the device.
                            ``(v) Comply with the remote access 
                        provisions recommended by the National 
                        Institute of Standards and Technology, in the 
                        document entitled `Security for Telecommuting 
                        and Broadband Communications (NIST Special 
                        Publication 800-46)', published in August 2002.
            ``(2) Exceptions.--A manufacturer may submit a petition to 
        the Secretary to exempt a cyber device from any requirement 
        under paragraph (1)(C). The Secretary may grant such an 
        exemption if it determines that the manufacturer can prove the 
        exemption would pose not more than a minimal risk to patient 
        health, minimal risk to privacy, and minimal risk of a cyber 
        vulnerability.
    ``(d) Cybersecurity Fixes or Updates.--
            ``(1) Re-clearance or reapproval.--Unless at the request of 
        the Secretary due to a unique and extenuating circumstance, any 
        cybersecurity fix or update shall not require a new 
        notification under section 510(k) or application for premarket 
        approval under section 515(c).
            ``(2) Free cybersecurity fixes or updates.--A manufacturer 
        of a cyber device shall provide any cybersecurity fix or update 
        to the device free of charge until--
                    ``(A) the date on which any agreement to provide 
                such fixes or updates, entered into between the 
                manufacturer (or a third party authorized by the 
                manufacturer) and a provider, expires; or
                    ``(B) if no agreement described in subparagraph (A) 
                is in effect, the date that is 10 years after the date 
                on which the manufacturer discontinues marketing the 
                device.
    ``(e) End-of-Life Device.--Not later than 90 days after a 
manufacturer declares that it will no longer sell a cyber device, the 
manufacturer of such device shall--
            ``(1) shall provide any provider owning or operating the 
        device with the report card, as most recently updated under 
        subsection (b)(3)(C);
            ``(2) to the extent practicable, inform any provider owning 
        or operating the device that the manufacturer will no longer be 
        manufacturing such device;
            ``(3) provide notice to any provider owning or operating 
        the device of the date on which the last cybersecurity fix or 
        update will be provided by the manufacturer;
            ``(4) notify the Secretary of such declaration; and
            ``(5) provide any provider owning or operating the device 
        with the following information related to the device:
                    ``(A) Compensating controls on how to securely 
                configure the cyber device if the device stays in 
                operation past the date on which the manufacturer stops 
                providing cybsecurity fixes or updates under subsection 
                (d)(2).
                    ``(B) Documentation on secure preparation for 
                recycling and disposal of the device.
                    ``(C) Specific guidance regarding supporting 
                infrastructure architecture, including network 
                segmentation and device isolation requirements.
                    ``(D) Instructions on how to delete any personally 
                identifiable information, protected health information, 
                or other site-specific sensitive data such as 
                configuration files.
    ``(f) Applicability.--This section shall not apply with respect to 
any cyber device for which, prior to the enactment of the Medical 
Device Cybersecurity Act of 2017, a notification was submitted under 
section 510(k), or for which an application for premarket approval was 
submitted under section 515(c).''.
    (b) Enforcement.--Section 301 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 331) is amended by adding at the end the 
following:
    ``(eee) The failure to comply with subsection (b), (c), (d), or (e) 
of section 520A.''.
    (c) Expansion of ICS-CERT Responsibilities.--
            (1) Definitions.--In this subsection:
                    (A) Cyber device.--The term ``cyber device'' has 
                the meaning given the term in section 520A of the 
                Federal Food, Drug, and Cosmetic Act, as added by 
                subsection (a).
                    (B) ICS-CERT.--The term ``ICS-CERT'' means the 
                Industrial Control Systems Cyber Emergency Response 
                Team of the National Cybersecurity and Communications 
                Integration Center established under section 227 of the 
                Homeland Security Act of 2002 (6 U.S.C. 148).
                    (C) Under secretary.--The term ``Under Secretary'' 
                means the Under Secretary appointed under section 
                103(a)(1)(H) of the Homeland Security Act of 2002 (6 
                U.S.C. 113(a)(1)(H)).
            (2) Expansion.--Not later than 180 days after the date of 
        enactment of this Act, the Under Secretary shall expand the 
        duties and mission of ICS-CERT to include--
                    (A) investigating cybersecurity vulnerabilities of 
                cyber devices that may cause harm to human life or 
                significant misuse of personal health information, as 
                determined necessary by ICS-CERT or at the request of 
                the Under Secretary; and
                    (B) coordinating device-specific responses to 
                cybersecurity incidents and vulnerabilities with 
                respect to cyber devices.
            (3) Consultation.--In carrying out paragraph (2), the Under 
        Secretary shall consult with relevant agencies within the Food 
        and Drug Administration, the Department of Health and Human 
        Services, the National Institute of Standards and Technology, 
        the National Coordination Office for Networking and Information 
        Technology Research and Development, the Federal Trade 
        Commission, and experts in the cybersecurity and medical device 
        industries.
            (4) Coordinated disclosure.--Not later than 6 months after 
        the date of enactment of this Act, the Secretary of Homeland 
        Security shall issue rules relating to the coordinated 
        disclosure of controlled and uncontrolled cybersecurity 
        vulnerabilities of cyber devices, which shall--
                    (A) outline the roles and responsibilities of ICS-
                CERT and manufacturers and providers of cyber devices;
                    (B) provide timelines for all required actions; and
                    (C) provide for the enforcement of cooperation 
                between ICS-CERT and manufacturers and providers of 
                cyber devices.
            (5) Report.--Not later than 1 year after the date of 
        enactment of this Act, the Under Secretary shall submit to 
        Congress a report detailing the expanded duties and mission of 
        ICS-CERT under paragraph (2).
[EX A]: Medical Device Cybersecurity Act of 2017 This bill amends the Federal Food, Drug, and Cosmetic Act to require the Food and Drug Administration (FDA), in coordination with others,&nbsp;to create a cybersecurity report card for devices that have network or Internet connectivity, connect to an external drive or external media, or have any other cyber capability. Report cards must contain specified information, including: (1) information pertaining to the essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, (2) a cybersecurity risk assessment conducted by the manufacturer or third party, and (3) whether the device is capable of being accessed remotely. A cyber device manufacturer must include&nbsp;a report card in any premarket notification or application for premarket approval. The&nbsp;FDA shall provide a copy of a device's report card&nbsp;if requested&nbsp;by a health care industry entity or an entity with a valid interest in the report card.&nbsp; The bill establishes procedures, including notifications to&nbsp;providers and patients,&nbsp;for manufacturers&nbsp;when cyber devices are&nbsp;remotely accessed or no longer going to be sold. Fixes and updates to cyber devices must be free of charge for specified time periods. The bill expands the responsibilities of the Department of Homeland Security's&nbsp;Industrial Control Systems Cyber Emergency Response Team to include investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or the significant misuse of personal health information, and coordinating device-specific responses.

[EX Q]: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Child Care Facilities Financing 
Act''.

SEC. 2. TECHNICAL AND FINANCIAL ASSISTANCE GRANTS.

    (a) Definitions.--In this section:
            (1) Child care facility.--The term ``child care facility'' 
        means a center-based or home-based child care facility.
            (2) Eligible intermediary.--The term ``eligible 
        intermediary'' means a private, nonprofit intermediary 
        organization that has demonstrated experience in--
                    (A) providing technical or financial assistance for 
                the construction and renovation of physical facilities;
                    (B) providing technical or financial assistance to 
                child care providers; and
                    (C) securing private sources for capital financing 
                of child care or other low-income community 
                development.
            (3) Eligible recipient.--The term ``eligible recipient'' 
        means--
                    (A) any existing or new center-based or home-based 
                child care provider that provides services to eligible 
                children under a program carried out under the Child 
                Care and Development Block Grant Act of 1990 (42 U.S.C. 
                9858 et seq.), or another program serving low-income 
                children as determined by the Secretary; and
                    (B) any organization in the process of establishing 
                a center-based or home-based child care program or 
                otherwise seeking to provide child care services to 
                children described in subparagraph (A).
            (4) Secretary.--The term ``Secretary'' means the Secretary 
        of Health and Human Services.
    (b) Grant Authority.--The Secretary may award grants on a 
competitive basis in accordance with this section to eligible 
intermediaries to assist the intermediaries in carrying out the 
activities described in subsection (e).
    (c) Applications.--To be eligible to receive a grant under this 
section an eligible intermediary shall submit to the Secretary an 
application, in such form and containing such information as the 
Secretary may require.
    (d) Priority.--
            (1) In general.--In awarding grants under this section the 
        Secretary shall give priority to applicants under subsection 
        (c) that propose to assist eligible recipients that serve--
                    (A) low-income areas, such as--
                            (i) a community that--
                                    (I) is in a metropolitan area; and
                                    (II) has a median household income 
                                that is not more than 80 percent of the 
                                median household income of the 
                                metropolitan area; or
                            (ii) a community that--
                                    (I) is not in a metropolitan area; 
                                and
                                    (II) has a median income that is 
                                not more than 80 percent of the median 
                                household income of the State in which 
                                the community is located; or
                    (B) low-income individuals, such as an individual 
                who is an eligible child, as defined in section 658P of 
                the Child Care and Development Block Grant Act of 1990 
                (42 U.S.C. 9858m).
            (2) Definition.--In this subsection, the term 
        ``metropolitan area'' has the meaning given the term in section 
        102 of the Housing and Community Development Act of 1974 (42 
        U.S.C. 5302).
    (e) Use of Funds.--
            (1) Revolving fund.--Each eligible intermediary that 
        receives a grant under this section shall deposit the grant 
        amount into a child care revolving fund established by the 
        eligible intermediary.
            (2) Payments from fund.--Subject to subsection (f), from 
        amounts deposited into the revolving fund under paragraph (1), 
        each eligible intermediary shall provide technical and 
        financial assistance (in the form of loans, grants, 
        investments, guarantees, interest subsidies, and other 
        appropriate forms of assistance) to eligible recipients to pay 
        for the Federal share of the cost of the acquisition, 
        construction, or improvement of child care facilities or 
        equipment, or for the improvement of related management and 
        business practices, for each such recipient. The amounts may be 
        used solely for the purpose of providing technical or financial 
        assistance.
            (3) Loan repayments and investment proceeds.--Any amount 
        received by an eligible intermediary from an eligible recipient 
        in the form of a loan repayment or investment proceeds shall be 
        deposited into the child care revolving fund of the eligible 
        intermediary for redistribution to other eligible recipients in 
        accordance with this section.
    (f) Federal Share.--
            (1) In general.--The Federal share of the cost described in 
        subsection (e)(2) shall be not more than 50 percent.
            (2) Non-federal share.--The non-Federal share of the cost 
        may be provided in cash or in kind, fairly evaluated, including 
        plant, equipment, or services.
    (g) Authorization of Appropriations.--There is authorized to be 
appropriated to carry out this section $50,000,000 for each of fiscal 
years 2002 through 2006.
[EX A]:
Child Care Facilities Financing Act - Authorizes the Secretary of Health and Human Services to award competitive grants to eligible intermediaries to deposit into child care revolving funds for technical and financial assistance to eligible recipients to pay the Federal matching share of costs of acquisition, construction, or improvement of center-based or home-based child care facilities or equipment, or for the improvement of related management and business practices.