In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

Ex Input:
SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Medical Device Cybersecurity Act of 
2017''.

SEC. 2. CYBERSECURITY FOR MEDICAL DEVICES.

    (a) In General.--Chapter V of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 351 et seq.) is amended by inserting after section 520 
(21 U.S.C. 360j) the following--

``SEC. 520A. CYBERSECURITY FOR DEVICES.

    ``(a) Definitions.--In this section:
            ``(1) Cyber device.--The term `cyber device' means any 
        device that has network or Internet connectivity (such as near 
        field communication (NFC), Bluetooth, or WiFi), connects to an 
        external storage device or external media (such as a universal 
        serial bus (USB) or a compact disk), or has any other cyber 
        capability.
            ``(2) Cybersecurity fix or update.--The term `cybersecurity 
        fix or update' means any modification to a cyber device that 
        addresses a software, firmware, or hardware error or known 
        vulnerability, or a security update, and does not change the 
        therapeutic or diagnostic function of the device.
    ``(b) Transparency of Risk Prior to Marketing.--
            ``(1) Report card.--
                    ``(A) In general.--The Secretary, in coordination 
                with the entities described in subparagraph (B), shall 
                develop a report card for indicating the cybersecurity 
                functions of cyber devices. The report card shall 
                contain the contents described in paragraph (2) and be 
                disclosed in accordance with paragraph (3).
                    ``(B) Coordination.--The entities described in this 
                subparagraph are the following:
                            ``(i) The National Institute of Standards 
                        and Technology.
                            ``(ii) The Secretary of Homeland Security.
                            ``(iii) The National Coordination Office 
                        supporting the Networking and Information 
                        Technology Research and Development Program.
                            ``(iv) The Federal Trade Commission.
                            ``(v) Any other relevant agency, or 
                        cybersecurity or medical device industry group, 
                        as determined by the Secretary.
            ``(2) Contents of report card.--Each report card shall 
        contain each of the following:
                    ``(A) Information pertaining to all essential 
                elements described in the most recent version of the 
                Manufacturer Disclosure Statement for Medical Device 
                Security, as set forth by the Healthcare Information 
                and Management Systems Society and the National 
                Electrical Manufacturers Association.
                    ``(B) A traceability matrix, accepted by the 
                Secretary, that--
                            ``(i) redacts content that is confidential, 
                        as determined by the Secretary; and
                            ``(ii) establishes design components and 
                        traces such components to design compensating 
                        controls.
                    ``(C) A description of any manufacturer 
                compensating controls that--
                            ``(i) effectively address known common 
                        vulnerabilities and exposures; and
                            ``(ii) provide providers with industry 
                        standard compensating controls for improving 
                        cybersecurity.
                    ``(D) A description of--
                            ``(i) any cybersecurity evaluation 
                        conducted on the device, including any testing, 
                        validation, or verification of the device;
                            ``(ii) who conducted such evaluation; and
                            ``(iii) the results of such evaluation.
                    ``(E) A cybersecurity risk assessment conducted by 
                the manufacturer, or a third party, explaining the risk 
                of the device to patient safety and clinical hazards.
                    ``(F) An indication of whether the device is 
                capable of being remotely accessed. If the device is 
                capable of being remotely accessed, an indication of 
                any security measures and access protocols the device 
                has in place to secure such access.
            ``(3) Disclosure of report card.--
                    ``(A) Clearance or approval.--The manufacturer of 
                any cyber device shall include the report card in any 
                notification to the Secretary under section 510(k) or 
                any application for premarket approval under section 
                515(c), as applicable.
                    ``(B) Public accessibility.--
                            ``(i) In general.--The Secretary shall 
                        provide a copy of the report card to any entity 
                        described in clause (ii) that submits a request 
                        for such copy to the Secretary.
                            ``(ii) Entities permitted access.--An 
                        entity described in this clause is--
                                    ``(I) any health care industry 
                                entity, consisting of any provider, 
                                device manufacturer, the Federal 
                                Government, health care information 
                                security researchers, and health care 
                                academia; and
                                    ``(II) any entity determined by the 
                                Secretary to have a valid interest in 
                                the report card.
                    ``(C) Updated report card.--For as long as the 
                cyber device receives technical support from the 
                manufacturer or any other third party authorized by the 
                manufacturer, the manufacturer shall submit to the 
                Secretary an annual update to the report card.
    ``(c) Protecting Remote Access to Managed Solutions.--
            ``(1) In general.--A manufacturer of a cyber device shall:
                    ``(A) In order to remotely access such device after 
                selling, or otherwise transferring ownership of, the 
                device, obtain consent for such access from the 
                provider owning or operating the device and from any 
                patient on which the device is used. Such consent may 
                be in the form of an agreement entered into between the 
                provider and the manufacturer at the time the device is 
                sold to the provider, and may be for the manufacturer 
                to remotely access the device at times specified in 
                such agreement or by an agreement between the 
                manufacturer and provider entered into thereafter. In 
                the case of an agreement described in the previous 
                sentence, consent of the patient may be obtained 
                through the provider notifying the patient of such 
                agreement.
                    ``(B) For any cyber device that the manufacturer 
                may remotely access in accordance with subparagraph 
                (A):
                            ``(i) Notify the provider when the 
                        manufacturer accesses the device remotely, 
                        including the name of the person with such 
                        access, the kinds of tasks that can be 
                        performed through such access, and the software 
                        used to access the device. Such notification 
                        can be in the form of an audit log described in 
                        clause (ii) if the audit log is readily 
                        available to the provider.
                            ``(ii) Maintain an audit log for each time 
                        the manufacturer accesses the device remotely 
                        and make such log accessible to the provider.
                    ``(C) Except as provided in paragraph (2), for any 
                cyber device that has the capability to be accessed 
                remotely by the manufacturer or any other entity:
                            ``(i) Implement multi-factor authentication 
                        for accessing any cyber capability of the 
                        device.
                            ``(ii) Secure data in motion and data at 
                        rest with data encryption, and other best 
                        practices, approved by the National Institute 
                        of Standards and Technology.
                            ``(iii) Install automated tools to track 
                        access, or identify attempts at unauthorized 
                        access, to any cyber capability of the device.
                            ``(iv) Adopt whitelisting approaches and 
                        changeable passwords for accessing any cyber 
                        capability of the device.
                            ``(v) Comply with the remote access 
                        provisions recommended by the National 
                        Institute of Standards and Technology, in the 
                        document entitled `Security for Telecommuting 
                        and Broadband Communications (NIST Special 
                        Publication 800-46)', published in August 2002.
            ``(2) Exceptions.--A manufacturer may submit a petition to 
        the Secretary to exempt a cyber device from any requirement 
        under paragraph (1)(C). The Secretary may grant such an 
        exemption if it determines that the manufacturer can prove the 
        exemption would pose not more than a minimal risk to patient 
        health, minimal risk to privacy, and minimal risk of a cyber 
        vulnerability.
    ``(d) Cybersecurity Fixes or Updates.--
            ``(1) Re-clearance or reapproval.--Unless at the request of 
        the Secretary due to a unique and extenuating circumstance, any 
        cybersecurity fix or update shall not require a new 
        notification under section 510(k) or application for premarket 
        approval under section 515(c).
            ``(2) Free cybersecurity fixes or updates.--A manufacturer 
        of a cyber device shall provide any cybersecurity fix or update 
        to the device free of charge until--
                    ``(A) the date on which any agreement to provide 
                such fixes or updates, entered into between the 
                manufacturer (or a third party authorized by the 
                manufacturer) and a provider, expires; or
                    ``(B) if no agreement described in subparagraph (A) 
                is in effect, the date that is 10 years after the date 
                on which the manufacturer discontinues marketing the 
                device.
    ``(e) End-of-Life Device.--Not later than 90 days after a 
manufacturer declares that it will no longer sell a cyber device, the 
manufacturer of such device shall--
            ``(1) shall provide any provider owning or operating the 
        device with the report card, as most recently updated under 
        subsection (b)(3)(C);
            ``(2) to the extent practicable, inform any provider owning 
        or operating the device that the manufacturer will no longer be 
        manufacturing such device;
            ``(3) provide notice to any provider owning or operating 
        the device of the date on which the last cybersecurity fix or 
        update will be provided by the manufacturer;
            ``(4) notify the Secretary of such declaration; and
            ``(5) provide any provider owning or operating the device 
        with the following information related to the device:
                    ``(A) Compensating controls on how to securely 
                configure the cyber device if the device stays in 
                operation past the date on which the manufacturer stops 
                providing cybsecurity fixes or updates under subsection 
                (d)(2).
                    ``(B) Documentation on secure preparation for 
                recycling and disposal of the device.
                    ``(C) Specific guidance regarding supporting 
                infrastructure architecture, including network 
                segmentation and device isolation requirements.
                    ``(D) Instructions on how to delete any personally 
                identifiable information, protected health information, 
                or other site-specific sensitive data such as 
                configuration files.
    ``(f) Applicability.--This section shall not apply with respect to 
any cyber device for which, prior to the enactment of the Medical 
Device Cybersecurity Act of 2017, a notification was submitted under 
section 510(k), or for which an application for premarket approval was 
submitted under section 515(c).''.
    (b) Enforcement.--Section 301 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 331) is amended by adding at the end the 
following:
    ``(eee) The failure to comply with subsection (b), (c), (d), or (e) 
of section 520A.''.
    (c) Expansion of ICS-CERT Responsibilities.--
            (1) Definitions.--In this subsection:
                    (A) Cyber device.--The term ``cyber device'' has 
                the meaning given the term in section 520A of the 
                Federal Food, Drug, and Cosmetic Act, as added by 
                subsection (a).
                    (B) ICS-CERT.--The term ``ICS-CERT'' means the 
                Industrial Control Systems Cyber Emergency Response 
                Team of the National Cybersecurity and Communications 
                Integration Center established under section 227 of the 
                Homeland Security Act of 2002 (6 U.S.C. 148).
                    (C) Under secretary.--The term ``Under Secretary'' 
                means the Under Secretary appointed under section 
                103(a)(1)(H) of the Homeland Security Act of 2002 (6 
                U.S.C. 113(a)(1)(H)).
            (2) Expansion.--Not later than 180 days after the date of 
        enactment of this Act, the Under Secretary shall expand the 
        duties and mission of ICS-CERT to include--
                    (A) investigating cybersecurity vulnerabilities of 
                cyber devices that may cause harm to human life or 
                significant misuse of personal health information, as 
                determined necessary by ICS-CERT or at the request of 
                the Under Secretary; and
                    (B) coordinating device-specific responses to 
                cybersecurity incidents and vulnerabilities with 
                respect to cyber devices.
            (3) Consultation.--In carrying out paragraph (2), the Under 
        Secretary shall consult with relevant agencies within the Food 
        and Drug Administration, the Department of Health and Human 
        Services, the National Institute of Standards and Technology, 
        the National Coordination Office for Networking and Information 
        Technology Research and Development, the Federal Trade 
        Commission, and experts in the cybersecurity and medical device 
        industries.
            (4) Coordinated disclosure.--Not later than 6 months after 
        the date of enactment of this Act, the Secretary of Homeland 
        Security shall issue rules relating to the coordinated 
        disclosure of controlled and uncontrolled cybersecurity 
        vulnerabilities of cyber devices, which shall--
                    (A) outline the roles and responsibilities of ICS-
                CERT and manufacturers and providers of cyber devices;
                    (B) provide timelines for all required actions; and
                    (C) provide for the enforcement of cooperation 
                between ICS-CERT and manufacturers and providers of 
                cyber devices.
            (5) Report.--Not later than 1 year after the date of 
        enactment of this Act, the Under Secretary shall submit to 
        Congress a report detailing the expanded duties and mission of 
        ICS-CERT under paragraph (2).

Ex Output:
Medical Device Cybersecurity Act of 2017 This bill amends the Federal Food, Drug, and Cosmetic Act to require the Food and Drug Administration (FDA), in coordination with others,&nbsp;to create a cybersecurity report card for devices that have network or Internet connectivity, connect to an external drive or external media, or have any other cyber capability. Report cards must contain specified information, including: (1) information pertaining to the essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, (2) a cybersecurity risk assessment conducted by the manufacturer or third party, and (3) whether the device is capable of being accessed remotely. A cyber device manufacturer must include&nbsp;a report card in any premarket notification or application for premarket approval. The&nbsp;FDA shall provide a copy of a device's report card&nbsp;if requested&nbsp;by a health care industry entity or an entity with a valid interest in the report card.&nbsp; The bill establishes procedures, including notifications to&nbsp;providers and patients,&nbsp;for manufacturers&nbsp;when cyber devices are&nbsp;remotely accessed or no longer going to be sold. Fixes and updates to cyber devices must be free of charge for specified time periods. The bill expands the responsibilities of the Department of Homeland Security's&nbsp;Industrial Control Systems Cyber Emergency Response Team to include investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or the significant misuse of personal health information, and coordinating device-specific responses.


Ex Input:
SECTION 1. FINDINGS.

    The Congress makes the following findings:
            (1) Jesse Louis Jackson, Sr. was born on October 8, 1941, 
        in Greenville, South Carolina.
            (2) In 1965 Jesse L. Jackson, Sr. joined the civil rights 
        movement full-time, beginning his activism as a student leader 
        in the sit-in movement and continuing as a young organizer for 
        the Southern Christian Leadership Conference as an assistant to 
        Dr. Martin Luther King, Jr.
            (3) On June 30, 1968, Jesse L. Jackson, Sr. became an 
        ordained minister, having attended the Chicago Theological 
        Seminary.
            (4) Jesse L. Jackson, Sr. served as the national director 
        for Operation Breadbasket and, in 1971 in Chicago, Illinois, 
        founded People United to Save Humanity, known as PUSH.
            (5) In 1984 Jesse L. Jackson, Sr. founded the National 
        Rainbow Coalition, a national social justice organization 
        devoted to political empowerment and to expanding educational 
        and employment opportunities for disadvantaged people and for 
        communities of color.
            (6) In 1996 Jesse L. Jackson, Sr. merged the National 
        Rainbow Coalition and PUSH to continue the philosophies of both 
        organizations and to maximize their resources.
            (7) Jesse L. Jackson, Sr. is, and has been for more than 30 
        years, one of the foremost political figures in the United 
        States, playing a pivotal role in virtually every movement for 
        human rights, civil rights, peace, gender equality, 
        empowerment, and economic and social justice.
            (8) Jesse L. Jackson, Sr. has been and continues to be 
        counted on to serve as a champion and spokesman for a segment 
        of the population whose voices all too often are not heard.
            (9) Jesse L. Jackson, Sr. has been called the ``conscience 
        of the Nation'' and the ``great unifier'', challenging the 
        United States to establish just and humane priorities.
            (10) Jesse L. Jackson, Sr. has led a myriad of successful 
        delegations, marches, and missions for justice, peace, and 
        reconciliation.
            (11) Jesse L. Jackson, Sr. is a highly respected world 
        leader who has acted on many occasions as an international 
        diplomat.
            (12) In 1984 Jesse L. Jackson, Sr. secured the release of a 
        captured Navy pilot, Lieutenant Robert Goodman, who was shot 
        down over Lebanon. He also negotiated the release of 22 
        Americans and 26 Cubans in Cuba during 1984.
            (13) In 1990 Jesse L. Jackson, Sr. won the release of 
        hundreds of foreign nationals, including 47 Americans, being 
        held in Iraq and Kuwait by Saddam Hussein.
            (14) In October 1997 Jesse L. Jackson, Sr. was appointed by 
        President William Jefferson Clinton and by Secretary of State 
        Madeleine K. Albright as the Special Envoy of the President and 
        the Secretary of State for the Promotion of Democracy in 
        Africa.
            (15) On May 2, 1999, Jesse L. Jackson, Sr. obtained the 
        negotiated release of Army Specialist Steven M. Gonzales and 
        Staff Sergeants Christopher J. Stone and Andrew Ramirez, 3 
        United States soldiers who had spent 32 days in captivity in 
        Yugoslavia as prisoners of war and hostages.
            (16) Jesse L. Jackson, Sr. has dedicated his life to the 
        principles of freedom, peace, justice, international good will, 
        and the struggle for civil rights and equality for Americans 
        and for all peoples, at home and abroad.

SEC. 2. CONGRESSIONAL GOLD MEDAL.

    (a) Presentation Authorized.--The President is authorized to 
present, on behalf of the Congress, a gold medal of appropriate design 
to Jesse L. Jackson, Sr. in recognition of his outstanding and enduring 
contributions to the Nation.
    (b) Design and Striking.--For the purpose of the presentation 
referred to in subsection (a), the Secretary of the Treasury shall 
strike a gold medal with suitable emblems, devices, and inscriptions, 
to be determined by the Secretary.
    (c) Authorization of Appropriation.--Effective February 1, 1999, 
there are authorized to be appropriated $30,000 to carry out this 
section.

SEC. 3. DUPLICATE MEDALS.

    (a) Striking and Sale.--The Secretary of the Treasury may strike 
and sell duplicates in bronze of the gold medal struck under section 2 
under such regulations as the Secretary may prescribe, at a price 
sufficient to cover the cost thereof, including labor, materials, dies, 
use of machinery, and overhead expenses, and the cost of the gold 
medal.
    (b) Reimbursement of Appropriation.--The appropriation used to 
carry out section 2 shall be reimbursed out of the proceeds of sales 
under subsection (a).

SEC. 4. NATIONAL MEDALS.

    The medals struck under this Act are national medals for purposes 
of chapter 51 of title 31, United States Code.

Ex Output:
Authorizes the President to present to Jesse L. Jackson, on behalf of the Congress, a gold medal in recognition of his outstanding and enduring contributions to the Nation. 
Authorizes appropriations.


Ex Input:
SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Social Media Working Group Act of 
2014''.

SEC. 2. SOCIAL MEDIA WORKING GROUP.

    (a) In General.--Title III of the Homeland Security Act of 2002 (6 
U.S.C. 181 et seq.) is amended by adding at the end the following new 
section:

``SEC. 318. SOCIAL MEDIA WORKING GROUP.

    ``(a) Establishment.--The Secretary shall establish within the 
Department a social media working group (in this section referred to as 
the `Group').
    ``(b) Purpose.--In order to enhance information sharing between the 
Department and appropriate stakeholders, the Group shall provide 
guidance and best practices to the emergency preparedness and response 
community on the use of social media technologies before, during, and 
after a terrorist attack or other emergency.
    ``(c) Membership.--
            ``(1) In general.--The Under Secretary for Science and 
        Technology shall serve as the permanent chairperson of the 
        Group, and shall designate, on a rotating basis, a 
        representative from a State or local government who is a member 
        of the Group to serve as co-chairperson. The Under Secretary 
        shall establish term limits for individuals appointed to the 
        Group pursuant to paragraph (2). Membership of the Group shall 
        be composed of a cross section of subject matter experts from 
        Federal, State, local, tribal, and nongovernmental organization 
        practitioners, including representatives from the following 
        entities:
                    ``(A) The Office of Public Affairs of the 
                Department.
                    ``(B) The Office of the Chief Information Officer 
                of the Department.
                    ``(C) The Privacy Office of the Department.
                    ``(D) The Federal Emergency Management Agency.
                    ``(E) The Office of Disability Integration and 
                Coordination of the Federal Emergency Management 
                Agency.
                    ``(F) The American Red Cross.
                    ``(G) The Forest Service.
                    ``(H) The Centers for Disease Control and 
                Prevention.
                    ``(I) The United States Geological Survey.
                    ``(J) The National Oceanic and Atmospheric 
                Administration.
            ``(2) Additional members.--The Under Secretary for Science 
        and Technology shall appoint, on a rotating basis, qualified 
        individuals to the Group. The total number of such additional 
        members shall--
                    ``(A) be equal to or greater than the total number 
                of regular members under paragraph (1); and
                    ``(B) include--
                            ``(i) not fewer than three representatives 
                        from the private sector; and
                            ``(ii) representatives from--
                                    ``(I) State, local, and tribal 
                                entities, including from--
                                            ``(aa) law enforcement;
                                            ``(bb) fire services;
                                            ``(cc) emergency management 
                                        services; and
                                            ``(dd) public health 
                                        entities;
                                    ``(II) universities and academia; 
                                and
                                    ``(III) non-profit disaster relief 
                                organizations.
    ``(d) Consultation With Non-members.--To the extent practicable, 
the Group shall work with existing bodies in the public and private 
sectors to carry out subsection (b).
    ``(e) Meetings.--
            ``(1) Initial meeting.--Not later than 90 days after the 
        date of the enactment of this section, the Group shall hold its 
        initial meeting. Such initial meeting may be held virtually.
            ``(2) Subsequent meetings.--After the initial meeting under 
        paragraph (1), the Group shall meet at least twice each year, 
        or at the call of the Chairperson. Such subsequent meetings may 
        be held virtually.
    ``(f) Nonapplicability of FACA.--The Federal Advisory Committee Act 
(5 U.S.C. App.) shall not apply to the Group.
    ``(g) Reports.--Not later than March 30 of each year, the Group 
shall submit to the appropriate congressional committees a report that 
includes the following:
            ``(1) A review of current and emerging social media 
        technologies being used to support preparedness and response 
        activities related to terrorist attacks and other emergencies.
            ``(2) A review of best practices and lessons learned on the 
        use of social media during the response to terrorist attacks 
        and other emergencies that occurred during the period covered 
        by the report at issue.
            ``(3) Recommendations to improve the Department's use of 
        social media for emergency management purposes.
            ``(4) Recommendations to improve public awareness of the 
        type of information disseminated through social media, and how 
        to access such information, during a terrorist attack or other 
        emergency.
            ``(5) Recommendations to improve information sharing among 
        the Department and its components.
            ``(6) Recommendations to improve information sharing among 
        State and local governments.
            ``(7) A review of available training for Federal, State, 
        local, and tribal officials on the use of social media in 
        response to a terrorist attack or other emergency.
            ``(8) A summary of coordination efforts with the private 
        sector to discuss and resolve legal, operational, technical, 
        privacy, and security concerns.''.
    (b) Clerical Amendment.--The table of contents in section 1(b) of 
the Homeland Security Act of 2002 is amended by inserting after the 
item relating to section 317 the following new item:

``Sec. 318. Social media working group.''.

            Passed the House of Representatives July 8, 2014.

            Attest:

                                                 KAREN L. HAAS,

                                                                 Clerk.

Ex Output:

(This measure has not been amended since it was reported to the House on June 19, 2014.  Social Media Working Group Act of 2014 - Amends the Homeland Security Act of 2002 to direct the Secretary of Homeland Security to establish within the Department of Homeland Security (DHS) a social media working group (the Group) to provide guidance and best practices to the emergency preparedness and response community on the use of social media technologies before, during, and after a terrorist attack or other emergency.    Requires the Group to submit an annual report that includes: (1) a review of current and emerging social media technologies being used to support preparedness and response activities related to terrorist attacks and other emergencies; (2) a review of best practices and lessons learned on the use of social media during the response to terrorist attacks and other emergencies that occurred during the period covered by the report; (3) recommendations to improve DHS's use of social media for emergency management purposes, to improve public awareness of the type of information disseminated through social media and how to access such information during a terrorist attack or other emergency, and to improve information sharing among DHS and its components and among state and local governments; (4) a review of available training for government officials on the use of social media in response to a terrorist attack or other emergency; and (5) a summary of coordination efforts with the private sector to discuss and resolve legal, operational, technical, privacy, and security concerns.