H.R. 3985 – Internet of Medical Things Resilience Partnership Act of 2017

AI-Generated Summary

Updated April 15, 2026 at 6:27 PM UTC

The Internet of Medical Things Resilience Partnership Act of 2017 directs the Food and Drug Administration (FDA) to set up a public‑private working group that will create voluntary security guidelines for networked medical devices that handle patient data. Within five months the group must be formed, and within 18 months the FDA must report its recommendations to Congress. The effort is aimed at improving the cybersecurity and reliability of medical devices that could cause patient harm if compromised.

Key Provisions

The FDA commissioner, in consultation with NIST, must establish a working group of federal agencies, industry, and academia within five months of the law’s enactment.
The working group is chaired by the FDA commissioner (or a designee) and includes representatives from specific federal offices (e.g., FDA’s Center for Devices and Radiological Health, HHS’s ONC, FTC, FCC, NIST, and the National Cyber Security Alliance).
The chair must also add at least three qualified members from each of ten private‑sector categories, such as medical‑device makers, health‑care providers, insurers, cloud and wireless providers, and software and hardware developers.
The group’s task is to develop voluntary frameworks and guidelines to boost the security and resilience of Internet‑connected medical devices that store, transmit, or receive patient information.
The FDA must submit a report to Congress within 18 months outlining existing cybersecurity standards, identifying gaps, and proposing action plans for new or revised standards.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

2 earlier actions

HouseCommittee Latest Action

Referred to the Subcommittee on Health.

Health Subcommittee

October 6, 2017

View full timeline

HouseIntro Referral

Introduced in House

October 5, 2017

HouseIntro Referral

Referred to the House Committee on Energy and Commerce.

Energy and Commerce Committee

October 5, 2017

HouseCommittee

Referred to the Subcommittee on Health.

Health Subcommittee

October 6, 2017

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in HouseIssued October 5, 2017

I

115th CONGRESS

1st Session

H. R. 3985

IN THE HOUSE OF REPRESENTATIVES

October 5, 2017

Mr. Trott (for himself and Mrs. Brooks of Indiana) introduced the following bill; which was referred to the Committee on Energy and Commerce

A BILL

To establish a working group of public and private entities led by the Food and Drug Administration to recommend voluntary frameworks and guidelines to increase the security and resilience of Internet of Medical Things devices, and for other purposes.

1.

Short title

This Act may be cited as the Internet of Medical Things Resilience Partnership Act of 2017.

2.

Study on the security and resilience of certain medical devices

(a)

Study

Not later than 5 months after the date of enactment of this Act, the Commissioner of the Food and Drug Administration, in consultation with the National Institute of Standards and Technology, shall establish a working group of public and private entities to develop recommendations for voluntary frameworks and guidelines to increase the security and resilience of networked medical devices sold in the United States that store, receive, access, or transmit information to an external recipient or system for which unauthorized access, modification, misuse, or denial of use may result in patient harm.

(b)

Working group

(1)

In general

In developing the recommendations under subsection (a), the Commissioner shall seek input from a working group representing the Federal Government, industry, and academia.

(2)

Chairperson

The Commissioner of the Food and Drug Administration, or a designee of the Commissioner, shall serve as the chairperson of the working group established under paragraph (1).

(3)

Membership

Membership of the working group shall include a representative from each of the following:

(A)

The Center for Devices and Radiological Health of the Food and Drug Administration.

(B)

The Office of the National Coordinator for Health Information Technology of the Department of Health and Human Services.

(C)

The Office of Technology Research and Investigation of the Federal Trade Commission.

(D)

The Cybersecurity and Communications Reliability Division of the Federal Communications Commission.

(E)

The National Institute of Standards and Technology of the Department of Commerce.

(F)

The National Cyber Security Alliance.

(4)

Appointed Members

The chairperson shall appoint to the working group a minimum of 3 qualified representatives from each of the following private sector categories:

(A)

Medical device manufacturers.

(B)

Health care providers.

(C)

Health insurance providers.

(D)

Cloud computing.

(E)

Wireless network providers.

(F)

Enterprise security solutions systems.

(G)

Health information technology.

(H)

Web-based mobile application developers.

(I)

Software developers.

(J)

Hardware developers.

(c)

Report

Not later than 18 months after the date of enactment of this Act, the Commissioner shall submit to Congress a report on the recommendations developed under subsection (a), including—

(1)

an identification of existing cybersecurity standards, guidelines, frameworks, and best practices that are applicable to mitigate vulnerabilities in the devices described in subsection (a);

(2)

an identification of existing and developing international and domestic cybersecurity standards, guidelines, frameworks, and best practices that mitigate vulnerabilities in such devices;

(3)

a specification of high-priority gaps for which new or revised standards are needed; and

(4)

potential action plans by which such gaps can be addressed.