Section 1 Short title
This Act may be cited as the “Internet of Medical Things Resilience Partnership Act of 2017”.
Internet of Medical Things Resilience Partnership Act of 2017
A BILL
To establish a working group of public and private entities led by the Food and Drug Administration to recommend voluntary frameworks and guidelines to increase the security and resilience of Internet of Medical Things devices, and for other purposes.
Sec. 2 Study on the security and resilience of certain medical devices
Study— Not later than 5 months after the date of enactment of this Act, the Commissioner of the Food and Drug Administration, in consultation with the National Institute of Standards and Technology, shall establish a working group of public and private entities to develop recommendations for voluntary frameworks and guidelines to increase the security and resilience of networked medical devices sold in the United States that store, receive, access, or transmit information to an external recipient or system for which unauthorized access, modification, misuse, or denial of use may result in patient harm.
Working group—
In general— In developing the recommendations under subsection (a), the Commissioner shall seek input from a working group representing the Federal Government, industry, and academia.
Chairperson— The Commissioner of the Food and Drug Administration, or a designee of the Commissioner, shall serve as the chairperson of the working group established under paragraph (1).
Membership— Membership of the working group shall include a representative from each of the following:
The Center for Devices and Radiological Health of the Food and Drug Administration.
The Office of the National Coordinator for Health Information Technology of the Department of Health and Human Services.
The Office of Technology Research and Investigation of the Federal Trade Commission.
The Cybersecurity and Communications Reliability Division of the Federal Communications Commission.
The National Institute of Standards and Technology of the Department of Commerce.
The National Cyber Security Alliance.
Appointed Members— The chairperson shall appoint to the working group a minimum of 3 qualified representatives from each of the following private sector categories:
Medical device manufacturers.
Health care providers.
Health insurance providers.
Cloud computing.
Wireless network providers.
Enterprise security solutions systems.
Health information technology.
Web-based mobile application developers.
Software developers.
Hardware developers.
Report— Not later than 18 months after the date of enactment of this Act, the Commissioner shall submit to Congress a report on the recommendations developed under subsection (a), including—
an identification of existing cybersecurity standards, guidelines, frameworks, and best practices that are applicable to mitigate vulnerabilities in the devices described in subsection (a);
an identification of existing and developing international and domestic cybersecurity standards, guidelines, frameworks, and best practices that mitigate vulnerabilities in such devices;
a specification of high-priority gaps for which new or revised standards are needed; and
potential action plans by which such gaps can be addressed.