In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

Q: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cancer Screening and Prevention 
Act''.

SEC. 2. MEDICARE COVERAGE OF COLORECTAL SCREENING.

    (a) In General.--Section 1834 of the Social Security Act (42 U.S.C. 
1395m) is amended by inserting after subsection (c) the following new 
subsection:
    ``(d) Frequency and Payment Limits for Screening Fecal-Occult Blood 
Tests, Screening Flexible Sigmoidoscopies, and Screening Colonoscopy.--
            ``(1) Screening fecal-occult blood tests.--
                    ``(A) Payment limit.--In establishing fee schedules 
                under section 1833(h) with respect to screening fecal-
                occult blood tests provided for the purpose of early 
                detection of colon cancer, except as provided by the 
                Secretary under paragraph (3)(A), the payment amount 
                established for tests performed--
                            ``(i) in 1996 shall not exceed $5; and
                            ``(ii) in a subsequent year, shall not 
                        exceed the limit on the payment amount 
                        established under this subsection for such 
                        tests for the preceding year, adjusted by the 
                        applicable adjustment under section 1833(h) for 
                        tests performed in such year.
                    ``(B) Frequency limit.--Subject to revision by the 
                Secretary under paragraph (3)(B), no payment may be 
                made under this part for a screening fecal-occult blood 
                test provided to an individual for the purpose of early 
                detection of colon cancer--
                            ``(i) if the individual is under 50 years 
                        of age; or
                            ``(ii) if the test is performed within the 
                        11 months after a previous screening fecal-
                        occult blood test.
            ``(2) Screening flexible sigmoid- oscopies.--
                    ``(A) Payment amount.--The Secretary shall 
                establish a payment amount under section 1848 with 
                respect to screening flexible sigmoidoscopies provided 
                for the purpose of early detection of colon cancer that 
                is consistent with payment amounts under such section 
                for similar or related services, except that such 
                payment amount shall be established without regard to 
                subsection (a)(2)(A) of such section.
                    ``(B) Frequency limit.--Subject to revision by the 
                Secretary under paragraph (4)(B), no payment may be 
                made under this part for a screening flexible 
                sigmoidoscopy provided to an individual for the purpose 
                of early detection of colon cancer--
                            ``(i) if the individual is under 50 years 
                        of age; or
                            ``(ii) if the procedure is performed within 
                        the 47 months after a previous screening 
                        flexible sigmoidoscopy.
            ``(3) Screening colonoscopy for individuals at high risk 
        for colorectal cancer.--
                    ``(A) Payment amount.--The Secretary shall 
                establish a payment amount under section 1848 with 
                respect to screening colonoscopy for individuals at 
                high risk for colorectal cancer (as defined in 
                subparagraph (C)) provided for the purpose of early 
                detection of colon cancer that is consistent with 
                payment amounts under such section for similar or 
                related services, except that such payment amount shall 
                be established without regard to subsection (a)(2)(A) 
                of such section.
                    ``(B) Frequency limit.--Subject to revision by the 
                Secretary under paragraph (4)(B), no payment may be 
                made under this part for a screening colonoscopy for 
                individuals at high
                 risk for colorectal cancer provided to an individual 
for the purpose of early detection of colon cancer if the procedure is 
performed within the 23 months after a previous screening colonoscopy.
                    ``(C) Individual at high risk defined.--In this 
                subsection, an `individual at high risk for colorectal 
                cancer' is an individual who, because of family 
                history, prior experience of cancer or precursor 
                neoplastic polyps, a history of chronic digestive 
                disease condition (including inflammatory bowel 
                disease, Crohn's Disease, or ulcerative colitis), the 
                presence of any appropriate recognized gene markers for 
                colorectal cancer, or other predisposing factors, faces 
                a high risk for colorectal cancer.
            ``(4) Reductions in payment limit and revision of 
        frequency.--
                    ``(A) Reductions in payment limit.--The Secretary 
                shall review from time to time the appropriateness of 
                the amount of the payment limit established for 
                screening fecal-occult blood tests under paragraph 
                (1)(A). The Secretary may, with respect to tests 
                performed in a year after 1998, reduce the amount of 
                such
                 limit as it applies nationally or in any area to the 
amount that the Secretary estimates is required to assure that such 
tests of an appropriate quality are readily and conveniently available 
during the year.
                    ``(B) Revision of frequency.--
                            ``(i) Review.--The Secretary shall review 
                        periodically the appropriate frequency for 
                        performing screening fecal-occult blood tests, 
                        screening flexible sigmoidoscopies, and 
                        screening colonoscopy based on age and such 
                        other factors as the Secretary believes to be 
                        pertinent.
                            ``(ii) Revision of frequency.--The 
                        Secretary, taking into consideration the review 
                        made under clause (i), may revise from time to 
                        time the frequency with which such tests and 
                        procedures may be paid for under this 
                        subsection, but no such revision shall apply to 
                        tests or procedures performed before January 1, 
                        1999.
            ``(5) Limiting charges of nonparticipating physicians.--
                    ``(A) In general.--In the case of a screening 
                flexible sigmoidoscopy provided to an individual for 
                the purpose of early detection of colon cancer or a 
                screening colonoscopy provided to an individual at high 
                risk for colorectal cancer for the purpose of early 
                detection of colon cancer for which payment may be made 
                under this part, if a nonparticipating physician 
                provides the procedure to an individual enrolled under 
                this part, the physician may not charge the individual 
                more than the limiting charge (as defined in section 
                1848(g)(2)).
                    ``(B) Enforcement.--If a physician or supplier 
                knowing and willfully imposes a charge in violation of 
                subparagraph (A), the Secretary may apply sanctions 
                against such physician or supplier in accordance with 
                section 1842(j)(2).''.
    (b) Conforming Amendments.--(1) Paragraphs (1)(D) and (2)(D) of 
section 1833(a) of such Act (42 U.S.C. 1395l(a)) are each amended by 
striking ``subsection (h)(1),'' and inserting ``subsection (h)(1) or 
section 1834(d)(1),''.
    (2) Section 1833(h)(1)(A) of such Act (42 U.S.C. 1395l(h)(1)(A)) is 
amended by striking ``The Secretary'' and inserting ``Subject to 
paragraphs (1) and (3)(A) of section 1834(d), the Secretary''.
    (3) Clauses (i) and (ii) of section 1848(a)(2)(A) of such Act (42 
U.S.C. 1395w-4(a)(2)(A)) are each amended by striking ``a service'' and 
inserting ``a service (other than a screening flexible sigmoidoscopy 
provided to an individual for the purpose of early detection of colon 
cancer or a screening colonoscopy provided to an individual at high 
risk for colorectal cancer for the purpose of early detection of colon 
cancer)''.
    (4) Section 1862(a) of such Act (42 U.S.C. 1395y(a)) is amended--
            (A) in paragraph (1)--
                    (i) in subparagraph (E), by striking ``and'' at the 
                end,
                    (ii) in subparagraph (F), by striking the semicolon 
                at the end and inserting ``, and'', and
                    (iii) by adding at the end the following new 
                subparagraph:
            ``(G) in the case of screening fecal-occult blood tests, 
        screening flexible sigmoidoscopies, and screening colonoscopy 
        provided for the purpose of early detection of colon cancer, 
        which are performed more frequently than is covered under 
        section 1834(d);''; and
            (B) in paragraph (7), by striking ``paragraph (1)(B) or 
        under paragraph (1)(F)'' and inserting ``subparagraphs (B), 
        (F), or (G) of paragraph (1)''.

SEC. 3. EFFECTIVE DATE.

    The amendments made by section 2 shall apply to screening fecal-
occult blood tests, screening flexible sigmoidoscopies, and screening 
colonoscopy performed on or after January 1, 1996.

A: Cancer Screening and Prevention Act - Amends title XVIII (Medicare) of the Social Security Act to provide for coverage of various specified colon and colorectal screening tests and corresponding payment and frequency limits.
****
Q: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Regulatory Transparency, Patient 
Access, and Effective Drug Enforcement Act of 2014''.

SEC. 2. SCHEDULING OF SUBSTANCES INCLUDED IN NEW FDA-APPROVED DRUGS.

    Section 201 of the Controlled Substances Act (21 U.S.C. 811) is 
amended by inserting after subsection (h) the following:
    ``(i) Within 45 days of receiving a recommendation from the 
Secretary to add a drug or substance that has never been marketed in 
the United States to a schedule under this title, the Attorney General 
shall, without regard to the findings required by subsection (a) of 
this section or section 202(b), issue an interim final rule, under the 
exception for good cause described in subparagraph (B) of section 
553(b) of title 5, United States Code, placing the drug or substance 
into the schedule recommended by the Secretary. The interim final rule 
shall be made immediately effective under section 553(d)(3) of title 5, 
United States Code.''.

SEC. 3. ENHANCING NEW DRUG DEVELOPMENT.

    Section 302 of the Controlled Substances Act (21 U.S.C. 822) is 
amended by inserting after subsection (g) the following:
    ``(h)(1) A person who submits an application for registration to 
manufacture or distribute a controlled substance in accordance with 
this section may indicate on the registration application that the 
substance will be used only in connection with clinical trials of a 
drug in accordance with section 505(i) of the Federal Food, Drug, and 
Cosmetic Act.
    ``(2) When an application for registration to manufacture or 
distribute a controlled substance includes an indication that the 
controlled substance will be used only in connection with clinical 
trials of a drug in accordance with section 505(i) of the Federal Food, 
Drug, and Cosmetic Act, the Attorney General shall--
            ``(A) make a final decision on the application for 
        registration within 180 days; or
            ``(B) provide notice to the applicant in writing of--
                    ``(i) the outstanding issues that must be resolved 
                in order to reach a final decision on the application; 
                and
                    ``(ii) the estimated date on which a final decision 
                on the application will be made.''.

SEC. 4. REGISTRATION PROCESS UNDER CONTROLLED SUBSTANCES ACT.

    (a) Definitions.--
            (1) Factors as may be relevant to and consistent with the 
        public health and safety.--Section 303 of the Controlled 
        Substances Act (21 U.S.C. 823) is amended by adding at the end 
        the following:
    ``(i) In this section, the phrase `factors as may be relevant to 
and consistent with the public health and safety' means factors that 
are relevant to and consistent with the findings contained in section 
101.''.
            (2) Imminent danger to the public health or safety.--
        Section 304(d) of the Controlled Substances Act (21 U.S.C. 
        824(d)) is amended--
                    (A) by striking ``(d) The Attorney General'' and 
                inserting ``(d)(1) The Attorney General''; and
                    (B) by adding at the end the following:
    ``(2) In this subsection, the phrase `imminent danger to the public 
health or safety' means that, in the absence of an immediate suspension 
order, controlled substances will continue to be distributed or 
dispensed by a registrant who knows or should know through fulfilling 
the obligations of the registrant under this Act, or has reason to 
believe that--
            ``(A) the dispensing is outside the usual course of 
        professional practice;
            ``(B) the distribution or dispensing poses a present or 
        foreseeable risk of adverse health consequences or death due to 
        the abuse or misuse of the controlled substances; or
            ``(C) the controlled substances will continue to be 
        diverted outside of legitimate distribution channels.''.
    (b) Opportunity To Submit Corrective Action Plan Prior to 
Revocation or Suspension.--Subsection (c) of section 304 of the 
Controlled Substances Act (21 U.S.C. 824) is amended--
            (1) by striking the last two sentences;
            (2) by striking ``(c) Before'' and inserting ``(c)(1) 
        Before''; and
            (3) by adding at the end the following:
    ``(2) An order to show cause under paragraph (1) shall--
            ``(A) contain a statement of the basis for the denial, 
        revocation, or suspension, including specific citations to any 
        laws or regulations alleged to be violated by the applicant or 
        registrant;
            ``(B) direct the applicant or registrant to appear before 
        the Attorney General at a time and place stated in the order, 
        but not less than 30 days after the date of receipt of the 
        order; and
            ``(C) notify the applicant or registrant of the opportunity 
        to submit a corrective action plan on or before the date of 
        appearance.
    ``(3) Upon review of any corrective action plan submitted by an 
applicant or registrant pursuant to paragraph (2), the Attorney General 
shall determine whether denial, revocation or suspension proceedings 
should be discontinued, or deferred for the purposes of modification, 
amendment, or clarification to such plan.
    ``(4) Proceedings to deny, revoke, or suspend shall be conducted 
pursuant to this section in accordance with subchapter II of chapter 5 
of title 5, United States Code. Such proceedings shall be independent 
of, and not in lieu of, criminal prosecutions or other proceedings 
under this title or any other law of the United States.
    ``(5) The requirements of this subsection shall not apply to the 
issuance of an immediate suspension order under subsection (d).''.

SEC. 5. REPORT TO CONGRESS ON EFFECTS OF LAW ENFORCEMENT ACTIVITIES ON 
              PATIENT ACCESS TO MEDICATIONS.

    (a) In General.--Not later than 1 year after the date of enactment 
of this Act, the Secretary of Health and Human Services, acting through 
the Commissioner of Food and Drugs and the Director of the Centers for 
Disease Control and Prevention, and in consultation with the 
Administrator of the Drug Enforcement Administration and the Director 
of National Drug Control Policy, shall submit a report to the 
Committees on the Judiciary of the House of Representatives, the 
Committee on Energy and Commerce of the House of Representatives, the 
Committee on the Judiciary of the Senate, and the Committee on Health, 
Education, Labor and Pensions of the Senate identifying--
            (1) obstacles to legitimate patient access to controlled 
        substances;
            (2) issues with diversion of controlled substances; and
            (3) how collaboration between Federal, State, local, and 
        tribal law enforcement agencies and the pharmaceutical industry 
        can benefit patients and prevent diversion and abuse of 
        controlled substances.
    (b) Consultation.--The report under subsection (a) shall 
incorporate feedback and recommendations from the following:
            (1) Patient groups.
            (2) Pharmacies.
            (3) Drug manufacturers.
            (4) Common or contract carriers and warehousemen.
            (5) Hospitals, physicians, and other health care providers.
            (6) State attorneys general.
            (7) Federal, State, local, and tribal law enforcement 
        agencies.
            (8) Health insurance providers and entities that provide 
        pharmacy benefit management services on behalf of a health 
        insurance provider.
            (9) Wholesale drug distributors.

A: Regulatory Transparency, Patient Access, and Effective Drug Enforcement Act of 2014 - Amends the Controlled Substances Act to direct the Attorney General, within 45 days of receiving a recommendation from the Secretary of Health and Human Services (HHS) to add a drug or substance that has never been marketed in the United States to a schedule of controlled substances, to issue an interim final rule under the exception for good cause, placing it into the schedule recommended, effective immediately. Allows a person who submits an application for registration to manufacture or distribute a controlled substance to indicate on the registration application that the substance will be used only in connection with clinical trials of a drug. Requires the Attorney General to: (1) make a final decision on such application within 180 days, or (2) provide written notice to the applicant of the outstanding issues that must be resolved to reach a final decision and the estimated date on which such decision will be made. Defines: (1) "factors as may be relevant to and consistent with the public health and safety," and (2) "imminent danger to the public health or safety." Requires an order to show cause as to why a registration should not be denied, revoked, or suspended to notify the registrant of the opportunity to submit a corrective action plan on or before the date of appearance before the Attorney General. Requires the Attorney General, upon review of any such plan, to determine whether denial, revocation, or suspension proceedings should be discontinued or deferred for purposes of modification or clarification of such plan. Makes these requirements inapplicable to the issuance of an immediate suspension order. Directs the Secretary, acting through the Commissioner of Food and Drugs (FDA) and the Director of the Centers for Disease Control and Prevention (CDC), to identify: (1) obstacles to legitimate patient access to controlled substances; (2) issues with diversion of controlled substances; and (3) how collaboration between federal, state, local, and tribal law enforcement agencies and the pharmaceutical industry can benefit patients and prevent diversion and abuse of controlled substances.
****
Q: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Medical Device Cybersecurity Act of 
2017''.

SEC. 2. CYBERSECURITY FOR MEDICAL DEVICES.

    (a) In General.--Chapter V of the Federal Food, Drug, and Cosmetic 
Act (21 U.S.C. 351 et seq.) is amended by inserting after section 520 
(21 U.S.C. 360j) the following--

``SEC. 520A. CYBERSECURITY FOR DEVICES.

    ``(a) Definitions.--In this section:
            ``(1) Cyber device.--The term `cyber device' means any 
        device that has network or Internet connectivity (such as near 
        field communication (NFC), Bluetooth, or WiFi), connects to an 
        external storage device or external media (such as a universal 
        serial bus (USB) or a compact disk), or has any other cyber 
        capability.
            ``(2) Cybersecurity fix or update.--The term `cybersecurity 
        fix or update' means any modification to a cyber device that 
        addresses a software, firmware, or hardware error or known 
        vulnerability, or a security update, and does not change the 
        therapeutic or diagnostic function of the device.
    ``(b) Transparency of Risk Prior to Marketing.--
            ``(1) Report card.--
                    ``(A) In general.--The Secretary, in coordination 
                with the entities described in subparagraph (B), shall 
                develop a report card for indicating the cybersecurity 
                functions of cyber devices. The report card shall 
                contain the contents described in paragraph (2) and be 
                disclosed in accordance with paragraph (3).
                    ``(B) Coordination.--The entities described in this 
                subparagraph are the following:
                            ``(i) The National Institute of Standards 
                        and Technology.
                            ``(ii) The Secretary of Homeland Security.
                            ``(iii) The National Coordination Office 
                        supporting the Networking and Information 
                        Technology Research and Development Program.
                            ``(iv) The Federal Trade Commission.
                            ``(v) Any other relevant agency, or 
                        cybersecurity or medical device industry group, 
                        as determined by the Secretary.
            ``(2) Contents of report card.--Each report card shall 
        contain each of the following:
                    ``(A) Information pertaining to all essential 
                elements described in the most recent version of the 
                Manufacturer Disclosure Statement for Medical Device 
                Security, as set forth by the Healthcare Information 
                and Management Systems Society and the National 
                Electrical Manufacturers Association.
                    ``(B) A traceability matrix, accepted by the 
                Secretary, that--
                            ``(i) redacts content that is confidential, 
                        as determined by the Secretary; and
                            ``(ii) establishes design components and 
                        traces such components to design compensating 
                        controls.
                    ``(C) A description of any manufacturer 
                compensating controls that--
                            ``(i) effectively address known common 
                        vulnerabilities and exposures; and
                            ``(ii) provide providers with industry 
                        standard compensating controls for improving 
                        cybersecurity.
                    ``(D) A description of--
                            ``(i) any cybersecurity evaluation 
                        conducted on the device, including any testing, 
                        validation, or verification of the device;
                            ``(ii) who conducted such evaluation; and
                            ``(iii) the results of such evaluation.
                    ``(E) A cybersecurity risk assessment conducted by 
                the manufacturer, or a third party, explaining the risk 
                of the device to patient safety and clinical hazards.
                    ``(F) An indication of whether the device is 
                capable of being remotely accessed. If the device is 
                capable of being remotely accessed, an indication of 
                any security measures and access protocols the device 
                has in place to secure such access.
            ``(3) Disclosure of report card.--
                    ``(A) Clearance or approval.--The manufacturer of 
                any cyber device shall include the report card in any 
                notification to the Secretary under section 510(k) or 
                any application for premarket approval under section 
                515(c), as applicable.
                    ``(B) Public accessibility.--
                            ``(i) In general.--The Secretary shall 
                        provide a copy of the report card to any entity 
                        described in clause (ii) that submits a request 
                        for such copy to the Secretary.
                            ``(ii) Entities permitted access.--An 
                        entity described in this clause is--
                                    ``(I) any health care industry 
                                entity, consisting of any provider, 
                                device manufacturer, the Federal 
                                Government, health care information 
                                security researchers, and health care 
                                academia; and
                                    ``(II) any entity determined by the 
                                Secretary to have a valid interest in 
                                the report card.
                    ``(C) Updated report card.--For as long as the 
                cyber device receives technical support from the 
                manufacturer or any other third party authorized by the 
                manufacturer, the manufacturer shall submit to the 
                Secretary an annual update to the report card.
    ``(c) Protecting Remote Access to Managed Solutions.--
            ``(1) In general.--A manufacturer of a cyber device shall:
                    ``(A) In order to remotely access such device after 
                selling, or otherwise transferring ownership of, the 
                device, obtain consent for such access from the 
                provider owning or operating the device and from any 
                patient on which the device is used. Such consent may 
                be in the form of an agreement entered into between the 
                provider and the manufacturer at the time the device is 
                sold to the provider, and may be for the manufacturer 
                to remotely access the device at times specified in 
                such agreement or by an agreement between the 
                manufacturer and provider entered into thereafter. In 
                the case of an agreement described in the previous 
                sentence, consent of the patient may be obtained 
                through the provider notifying the patient of such 
                agreement.
                    ``(B) For any cyber device that the manufacturer 
                may remotely access in accordance with subparagraph 
                (A):
                            ``(i) Notify the provider when the 
                        manufacturer accesses the device remotely, 
                        including the name of the person with such 
                        access, the kinds of tasks that can be 
                        performed through such access, and the software 
                        used to access the device. Such notification 
                        can be in the form of an audit log described in 
                        clause (ii) if the audit log is readily 
                        available to the provider.
                            ``(ii) Maintain an audit log for each time 
                        the manufacturer accesses the device remotely 
                        and make such log accessible to the provider.
                    ``(C) Except as provided in paragraph (2), for any 
                cyber device that has the capability to be accessed 
                remotely by the manufacturer or any other entity:
                            ``(i) Implement multi-factor authentication 
                        for accessing any cyber capability of the 
                        device.
                            ``(ii) Secure data in motion and data at 
                        rest with data encryption, and other best 
                        practices, approved by the National Institute 
                        of Standards and Technology.
                            ``(iii) Install automated tools to track 
                        access, or identify attempts at unauthorized 
                        access, to any cyber capability of the device.
                            ``(iv) Adopt whitelisting approaches and 
                        changeable passwords for accessing any cyber 
                        capability of the device.
                            ``(v) Comply with the remote access 
                        provisions recommended by the National 
                        Institute of Standards and Technology, in the 
                        document entitled `Security for Telecommuting 
                        and Broadband Communications (NIST Special 
                        Publication 800-46)', published in August 2002.
            ``(2) Exceptions.--A manufacturer may submit a petition to 
        the Secretary to exempt a cyber device from any requirement 
        under paragraph (1)(C). The Secretary may grant such an 
        exemption if it determines that the manufacturer can prove the 
        exemption would pose not more than a minimal risk to patient 
        health, minimal risk to privacy, and minimal risk of a cyber 
        vulnerability.
    ``(d) Cybersecurity Fixes or Updates.--
            ``(1) Re-clearance or reapproval.--Unless at the request of 
        the Secretary due to a unique and extenuating circumstance, any 
        cybersecurity fix or update shall not require a new 
        notification under section 510(k) or application for premarket 
        approval under section 515(c).
            ``(2) Free cybersecurity fixes or updates.--A manufacturer 
        of a cyber device shall provide any cybersecurity fix or update 
        to the device free of charge until--
                    ``(A) the date on which any agreement to provide 
                such fixes or updates, entered into between the 
                manufacturer (or a third party authorized by the 
                manufacturer) and a provider, expires; or
                    ``(B) if no agreement described in subparagraph (A) 
                is in effect, the date that is 10 years after the date 
                on which the manufacturer discontinues marketing the 
                device.
    ``(e) End-of-Life Device.--Not later than 90 days after a 
manufacturer declares that it will no longer sell a cyber device, the 
manufacturer of such device shall--
            ``(1) shall provide any provider owning or operating the 
        device with the report card, as most recently updated under 
        subsection (b)(3)(C);
            ``(2) to the extent practicable, inform any provider owning 
        or operating the device that the manufacturer will no longer be 
        manufacturing such device;
            ``(3) provide notice to any provider owning or operating 
        the device of the date on which the last cybersecurity fix or 
        update will be provided by the manufacturer;
            ``(4) notify the Secretary of such declaration; and
            ``(5) provide any provider owning or operating the device 
        with the following information related to the device:
                    ``(A) Compensating controls on how to securely 
                configure the cyber device if the device stays in 
                operation past the date on which the manufacturer stops 
                providing cybsecurity fixes or updates under subsection 
                (d)(2).
                    ``(B) Documentation on secure preparation for 
                recycling and disposal of the device.
                    ``(C) Specific guidance regarding supporting 
                infrastructure architecture, including network 
                segmentation and device isolation requirements.
                    ``(D) Instructions on how to delete any personally 
                identifiable information, protected health information, 
                or other site-specific sensitive data such as 
                configuration files.
    ``(f) Applicability.--This section shall not apply with respect to 
any cyber device for which, prior to the enactment of the Medical 
Device Cybersecurity Act of 2017, a notification was submitted under 
section 510(k), or for which an application for premarket approval was 
submitted under section 515(c).''.
    (b) Enforcement.--Section 301 of the Federal Food, Drug, and 
Cosmetic Act (21 U.S.C. 331) is amended by adding at the end the 
following:
    ``(eee) The failure to comply with subsection (b), (c), (d), or (e) 
of section 520A.''.
    (c) Expansion of ICS-CERT Responsibilities.--
            (1) Definitions.--In this subsection:
                    (A) Cyber device.--The term ``cyber device'' has 
                the meaning given the term in section 520A of the 
                Federal Food, Drug, and Cosmetic Act, as added by 
                subsection (a).
                    (B) ICS-CERT.--The term ``ICS-CERT'' means the 
                Industrial Control Systems Cyber Emergency Response 
                Team of the National Cybersecurity and Communications 
                Integration Center established under section 227 of the 
                Homeland Security Act of 2002 (6 U.S.C. 148).
                    (C) Under secretary.--The term ``Under Secretary'' 
                means the Under Secretary appointed under section 
                103(a)(1)(H) of the Homeland Security Act of 2002 (6 
                U.S.C. 113(a)(1)(H)).
            (2) Expansion.--Not later than 180 days after the date of 
        enactment of this Act, the Under Secretary shall expand the 
        duties and mission of ICS-CERT to include--
                    (A) investigating cybersecurity vulnerabilities of 
                cyber devices that may cause harm to human life or 
                significant misuse of personal health information, as 
                determined necessary by ICS-CERT or at the request of 
                the Under Secretary; and
                    (B) coordinating device-specific responses to 
                cybersecurity incidents and vulnerabilities with 
                respect to cyber devices.
            (3) Consultation.--In carrying out paragraph (2), the Under 
        Secretary shall consult with relevant agencies within the Food 
        and Drug Administration, the Department of Health and Human 
        Services, the National Institute of Standards and Technology, 
        the National Coordination Office for Networking and Information 
        Technology Research and Development, the Federal Trade 
        Commission, and experts in the cybersecurity and medical device 
        industries.
            (4) Coordinated disclosure.--Not later than 6 months after 
        the date of enactment of this Act, the Secretary of Homeland 
        Security shall issue rules relating to the coordinated 
        disclosure of controlled and uncontrolled cybersecurity 
        vulnerabilities of cyber devices, which shall--
                    (A) outline the roles and responsibilities of ICS-
                CERT and manufacturers and providers of cyber devices;
                    (B) provide timelines for all required actions; and
                    (C) provide for the enforcement of cooperation 
                between ICS-CERT and manufacturers and providers of 
                cyber devices.
            (5) Report.--Not later than 1 year after the date of 
        enactment of this Act, the Under Secretary shall submit to 
        Congress a report detailing the expanded duties and mission of 
        ICS-CERT under paragraph (2).

A:
Medical Device Cybersecurity Act of 2017 This bill amends the Federal Food, Drug, and Cosmetic Act to require the Food and Drug Administration (FDA), in coordination with others,&nbsp;to create a cybersecurity report card for devices that have network or Internet connectivity, connect to an external drive or external media, or have any other cyber capability. Report cards must contain specified information, including: (1) information pertaining to the essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, (2) a cybersecurity risk assessment conducted by the manufacturer or third party, and (3) whether the device is capable of being accessed remotely. A cyber device manufacturer must include&nbsp;a report card in any premarket notification or application for premarket approval. The&nbsp;FDA shall provide a copy of a device's report card&nbsp;if requested&nbsp;by a health care industry entity or an entity with a valid interest in the report card.&nbsp; The bill establishes procedures, including notifications to&nbsp;providers and patients,&nbsp;for manufacturers&nbsp;when cyber devices are&nbsp;remotely accessed or no longer going to be sold. Fixes and updates to cyber devices must be free of charge for specified time periods. The bill expands the responsibilities of the Department of Homeland Security's&nbsp;Industrial Control Systems Cyber Emergency Response Team to include investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or the significant misuse of personal health information, and coordinating device-specific responses.
****