You will be given a definition of a task first, then some input of the task.
In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

SECTION 1. SHORT TITLE.

This Act may be cited as the ''Medical Device Cybersecurity Act of
2017''.

SEC. 2. CYBERSECURITY FOR MEDICAL DEVICES.

(a) In General.--Chapter V of the Federal Food, Drug, and Cosmetic
Act (21 U.S.C. 351 et seq.) is amended by inserting after section 520
(21 U.S.C. 360j) the following--

''SEC. 520A. CYBERSECURITY FOR DEVICES.

''(a) Definitions.--In this section:
''(1) Cyber device.--The term 'cyber device' means any
device that has network or Internet connectivity (such as near
field communication (NFC), Bluetooth, or WiFi), connects to an
external storage device or external media (such as a universal
serial bus (USB) or a compact disk), or has any other cyber
capability.
''(2) Cybersecurity fix or update.--The term 'cybersecurity
fix or update' means any modification to a cyber device that
addresses a software, firmware, or hardware error or known
vulnerability, or a security update, and does not change the
therapeutic or diagnostic function of the device.
''(b) Transparency of Risk Prior to Marketing.--
''(1) Report card.--
''(A) In general.--The Secretary, in coordination
with the entities described in subparagraph (B), shall
develop a report card for indicating the cybersecurity
functions of cyber devices. The report card shall
contain the contents described in paragraph (2) and be
disclosed in accordance with paragraph (3).
''(B) Coordination.--The entities described in this
subparagraph are the following:
''(i) The National Institute of Standards
and Technology.
''(ii) The Secretary of Homeland Security.
''(iii) The National Coordination Office
supporting the Networking and Information
Technology Research and Development Program.
''(iv) The Federal Trade Commission.
''(v) Any other relevant agency, or
cybersecurity or medical device industry group,
as determined by the Secretary.
''(2) Contents of report card.--Each report card shall
contain each of the following:
''(A) Information pertaining to all essential
elements described in the most recent version of the
Manufacturer Disclosure Statement for Medical Device
Security, as set forth by the Healthcare Information
and Management Systems Society and the National
Electrical Manufacturers Association.
''(B) A traceability matrix, accepted by the
Secretary, that--
''(i) redacts content that is confidential,
as determined by the Secretary; and
''(ii) establishes design components and
traces such components to design compensating
controls.
''(C) A description of any manufacturer
compensating controls that--
''(i) effectively address known common
vulnerabilities and exposures; and
''(ii) provide providers with industry
standard compensating controls for improving
cybersecurity.
''(D) A description of--
''(i) any cybersecurity evaluation
conducted on the device, including any testing,
validation, or verification of the device;
''(ii) who conducted such evaluation; and
''(iii) the results of such evaluation.
''(E) A cybersecurity risk assessment conducted by
the manufacturer, or a third party, explaining the risk
of the device to patient safety and clinical hazards.
''(F) An indication of whether the device is
capable of being remotely accessed. If the device is
capable of being remotely accessed, an indication of
any security measures and access protocols the device
has in place to secure such access.
''(3) Disclosure of report card.--
''(A) Clearance or approval.--The manufacturer of
any cyber device shall include the report card in any
notification to the Secretary under section 510(k) or
any application for premarket approval under section
515(c), as applicable.
''(B) Public accessibility.--
''(i) In general.--The Secretary shall
provide a copy of the report card to any entity
described in clause (ii) that submits a request
for such copy to the Secretary.
''(ii) Entities permitted access.--An
entity described in this clause is--
''(I) any health care industry
entity, consisting of any provider,
device manufacturer, the Federal
Government, health care information
security researchers, and health care
academia; and
''(II) any entity determined by the
Secretary to have a valid interest in
the report card.
''(C) Updated report card.--For as long as the
cyber device receives technical support from the
manufacturer or any other third party authorized by the
manufacturer, the manufacturer shall submit to the
Secretary an annual update to the report card.
''(c) Protecting Remote Access to Managed Solutions.--
''(1) In general.--A manufacturer of a cyber device shall:
''(A) In order to remotely access such device after
selling, or otherwise transferring ownership of, the
device, obtain consent for such access from the
provider owning or operating the device and from any
patient on which the device is used. Such consent may
be in the form of an agreement entered into between the
provider and the manufacturer at the time the device is
sold to the provider, and may be for the manufacturer
to remotely access the device at times specified in
such agreement or by an agreement between the
manufacturer and provider entered into thereafter. In
the case of an agreement described in the previous
sentence, consent of the patient may be obtained
through the provider notifying the patient of such
agreement.
''(B) For any cyber device that the manufacturer
may remotely access in accordance with subparagraph
(A):
''(i) Notify the provider when the
manufacturer accesses the device remotely,
including the name of the person with such
access, the kinds of tasks that can be
performed through such access, and the software
used to access the device. Such notification
can be in the form of an audit log described in
clause (ii) if the audit log is readily
available to the provider.
''(ii) Maintain an audit log for each time
the manufacturer accesses the device remotely
and make such log accessible to the provider.
''(C) Except as provided in paragraph (2), for any
cyber device that has the capability to be accessed
remotely by the manufacturer or any other entity:
''(i) Implement multi-factor authentication
for accessing any cyber capability of the
device.
''(ii) Secure data in motion and data at
rest with data encryption, and other best
practices, approved by the National Institute
of Standards and Technology.
''(iii) Install automated tools to track
access, or identify attempts at unauthorized
access, to any cyber capability of the device.
''(iv) Adopt whitelisting approaches and
changeable passwords for accessing any cyber
capability of the device.
''(v) Comply with the remote access
provisions recommended by the National
Institute of Standards and Technology, in the
document entitled 'Security for Telecommuting
and Broadband Communications (NIST Special
Publication 800-46)', published in August 2002.
''(2) Exceptions.--A manufacturer may submit a petition to
the Secretary to exempt a cyber device from any requirement
under paragraph (1)(C). The Secretary may grant such an
exemption if it determines that the manufacturer can prove the
exemption would pose not more than a minimal risk to patient
health, minimal risk to privacy, and minimal risk of a cyber
vulnerability.
''(d) Cybersecurity Fixes or Updates.--
''(1) Re-clearance or reapproval.--Unless at the request of
the Secretary due to a unique and extenuating circumstance, any
cybersecurity fix or update shall not require a new
notification under section 510(k) or application for premarket
approval under section 515(c).
''(2) Free cybersecurity fixes or updates.--A manufacturer
of a cyber device shall provide any cybersecurity fix or update
to the device free of charge until--
''(A) the date on which any agreement to provide
such fixes or updates, entered into between the
manufacturer (or a third party authorized by the
manufacturer) and a provider, expires; or
''(B) if no agreement described in subparagraph (A)
is in effect, the date that is 10 years after the date
on which the manufacturer discontinues marketing the
device.
''(e) End-of-Life Device.--Not later than 90 days after a
manufacturer declares that it will no longer sell a cyber device, the
manufacturer of such device shall--
''(1) shall provide any provider owning or operating the
device with the report card, as most recently updated under
subsection (b)(3)(C);
''(2) to the extent practicable, inform any provider owning
or operating the device that the manufacturer will no longer be
manufacturing such device;
''(3) provide notice to any provider owning or operating
the device of the date on which the last cybersecurity fix or
update will be provided by the manufacturer;
''(4) notify the Secretary of such declaration; and
''(5) provide any provider owning or operating the device
with the following information related to the device:
''(A) Compensating controls on how to securely
configure the cyber device if the device stays in
operation past the date on which the manufacturer stops
providing cybsecurity fixes or updates under subsection
(d)(2).
''(B) Documentation on secure preparation for
recycling and disposal of the device.
''(C) Specific guidance regarding supporting
infrastructure architecture, including network
segmentation and device isolation requirements.
''(D) Instructions on how to delete any personally
identifiable information, protected health information,
or other site-specific sensitive data such as
configuration files.
''(f) Applicability.--This section shall not apply with respect to
any cyber device for which, prior to the enactment of the Medical
Device Cybersecurity Act of 2017, a notification was submitted under
section 510(k), or for which an application for premarket approval was
submitted under section 515(c).''.
(b) Enforcement.--Section 301 of the Federal Food, Drug, and
Cosmetic Act (21 U.S.C. 331) is amended by adding at the end the
following:
''(eee) The failure to comply with subsection (b), (c), (d), or (e)
of section 520A.''.
(c) Expansion of ICS-CERT Responsibilities.--
(1) Definitions.--In this subsection:
(A) Cyber device.--The term ''cyber device'' has
the meaning given the term in section 520A of the
Federal Food, Drug, and Cosmetic Act, as added by
subsection (a).
(B) ICS-CERT.--The term ''ICS-CERT'' means the
Industrial Control Systems Cyber Emergency Response
Team of the National Cybersecurity and Communications
Integration Center established under section 227 of the
Homeland Security Act of 2002 (6 U.S.C. 148).
(C) Under secretary.--The term ''Under Secretary''
means the Under Secretary appointed under section
103(a)(1)(H) of the Homeland Security Act of 2002 (6
U.S.C. 113(a)(1)(H)).
(2) Expansion.--Not later than 180 days after the date of
enactment of this Act, the Under Secretary shall expand the
duties and mission of ICS-CERT to include--
(A) investigating cybersecurity vulnerabilities of
cyber devices that may cause harm to human life or
significant misuse of personal health information, as
determined necessary by ICS-CERT or at the request of
the Under Secretary; and
(B) coordinating device-specific responses to
cybersecurity incidents and vulnerabilities with
respect to cyber devices.
(3) Consultation.--In carrying out paragraph (2), the Under
Secretary shall consult with relevant agencies within the Food
and Drug Administration, the Department of Health and Human
Services, the National Institute of Standards and Technology,
the National Coordination Office for Networking and Information
Technology Research and Development, the Federal Trade
Commission, and experts in the cybersecurity and medical device
industries.
(4) Coordinated disclosure.--Not later than 6 months after
the date of enactment of this Act, the Secretary of Homeland
Security shall issue rules relating to the coordinated
disclosure of controlled and uncontrolled cybersecurity
vulnerabilities of cyber devices, which shall--
(A) outline the roles and responsibilities of ICS-
CERT and manufacturers and providers of cyber devices;
(B) provide timelines for all required actions; and
(C) provide for the enforcement of cooperation
between ICS-CERT and manufacturers and providers of
cyber devices.
(5) Report.--Not later than 1 year after the date of
enactment of this Act, the Under Secretary shall submit to
Congress a report detailing the expanded duties and mission of
ICS-CERT under paragraph (2).
Output:
Medical Device Cybersecurity Act of 2017 This bill amends the Federal Food, Drug, and Cosmetic Act to require the Food and Drug Administration (FDA), in coordination with others,to create a cybersecurity report card for devices that have network or Internet connectivity, connect to an external drive or external media, or have any other cyber capability. Report cards must contain specified information, including: (1) information pertaining to the essential elements described in the most recent version of the Manufacturer Disclosure Statement for Medical Device Security, (2) a cybersecurity risk assessment conducted by the manufacturer or third party, and (3) whether the device is capable of being accessed remotely. A cyber device manufacturer must includea report card in any premarket notification or application for premarket approval. TheFDA shall provide a copy of a device's report cardif requestedby a health care industry entity or an entity with a valid interest in the report card. The bill establishes procedures, including notifications toproviders and patients,for manufacturerswhen cyber devices areremotely accessed or no longer going to be sold. Fixes and updates to cyber devices must be free of charge for specified time periods. The bill expands the responsibilities of the Department of Homeland Security'sIndustrial Control Systems Cyber Emergency Response Team to include investigating cybersecurity vulnerabilities of cyber devices that may cause harm to human life or the significant misuse of personal health information, and coordinating device-specific responses.