H.R. 7084 – PATCH Act of 2022

AI-Generated Summary

Updated February 8, 2026 at 10:04 AM UTC

The PATCH Act amends the Federal Food, Drug, and Cosmetic Act to require that manufacturers of medical devices that contain software or connect to the internet (called “cyber devices”) provide detailed cybersecurity information in any pre‑market submission. The goal is to ensure a reasonable assurance of safety and effectiveness throughout the device’s lifecycle, including after it is on the market. The rule applies to device makers and the FDA, which can use the information to evaluate and approve devices.

Key Provisions

Manufacturers must include cybersecurity data in pre‑market submissions as the Secretary (FDA) requires.
Minimum requirements: a plan to monitor and address post‑market vulnerabilities; a coordinated vulnerability disclosure process; procedures to release regular and urgent software updates/patches; and a software bill of materials listing all components.
FDA can deem a device’s cybersecurity information inadequate and refuse a finding of substantial equivalence.
Non‑compliance is treated as a prohibited act, adulteration, and misbranding under the FD&C Act.
Defines “cyber device” as any device with software or internet connectivity and defines “lifecycle” to include the post‑market period.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

2 earlier actions

HouseCommittee Latest Action

Referred to the Subcommittee on Health.

Health Subcommittee

March 16, 2022

View full timeline

HouseIntro Referral

Introduced in House

March 15, 2022

HouseIntro Referral

Referred to the House Committee on Energy and Commerce.

Energy and Commerce Committee

March 15, 2022

HouseCommittee

Referred to the Subcommittee on Health.

Health Subcommittee

March 16, 2022

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in HouseIssued March 15, 2022

I

117th CONGRESS

2d Session

H. R. 7084

IN THE HOUSE OF REPRESENTATIVES

March 15, 2022

Mr. Burgess introduced the following bill; which was referred to the Committee on Energy and Commerce

A BILL

To amend the Federal Food, Drug, and Cosmetic Act to require, for purposes of ensuring cybersecurity, the inclusion in any premarket submission for a cyber device of information to demonstrate a reasonable assurance of safety and effectiveness throughout the lifecycle of the cyber device, and for other purposes.

1.

Short title

This Act may be cited as the Protecting and Transforming Cyber Health Care Act of 2022 or the PATCH Act of 2022.

2.

Ensuring cybersecurity of medical devices

(a)

In general

Subchapter A of chapter V of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 351 et seq.) is amended by adding at the end the following:

524B.

Ensuring cybersecurity of devices

(a)

In general

For purposes of ensuring cybersecurity throughout the lifecycle of a cyber device, any person who submits a premarket submission for the cyber device shall include such information as the Secretary may require to ensure that the cyber device meets such cybersecurity requirements as the Secretary determines to be appropriate to demonstrate a reasonable assurance of safety and effectiveness, including at a minimum the cybersecurity requirements under subsection (b). The Secretary may establish exemptions to the requirements under this subsection.

(b)

Cybersecurity requirements

At a minimum, the manufacturer of a cyber device shall meet the following cybersecurity requirements:

(1)

The manufacturer shall have a plan to appropriately monitor, identify, and address in a reasonable time postmarket cybersecurity vulnerabilities and exploits.

(2)

The manufacturer shall—

(A)

have a plan and procedures for a Coordinated Vulnerability Disclosure to be part of submissions to the Food and Drug Administration; and

(B)

collect and maintain such other information as the Secretary may (by order published in the Federal Register or by other process) require to demonstrate a reasonable assurance of the safety and effectiveness of the cyber device.

(3)

The manufacturer shall design, develop, and maintain processes and procedures to make available updates and patches to the cyber device and related systems throughout the lifecycle of the cyber device to address—

(A)

on a reasonably justified regular cycle, known unacceptable vulnerabilities; and

(B)

as soon as possible out of cycle, critical vulnerabilities that could cause uncontrolled risks.

(4)

The manufacturer shall furnish to the Secretary a software bill of materials, including commercial, open-sourced, and off-the-shelf software components that will be provided to users.

(c)

Substantial equivalence

In making a determination of substantial equivalence under section 513(i) for a cyber device, the Secretary may—

(1)

find that cybersecurity information for the cyber device described in the relevant premarket submission in the cyber device’s use environment is inadequate; and

(2)

issue a nonsubstantial equivalence determination based on this finding.

(d)

Definition

In this section:

(1)

The term cyber device means a device that—

(A)

includes software; or

(B)

is intended to connect to the internet.

(2)

The term lifecycle of the cyber device includes the postmarket lifecycle of the cyber device.

(3)

The term premarket submission means any submission under section 510(k), 513, 515(c), 515(f), or 520(m).

.

(b)

Prohibited act

Section 301(q) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 331(q)) is amended by adding at the end the following:

(3)

The failure to comply with any requirement under section 524B (relating to ensuring the cybersecurity).

.

(c)

Adulteration

Section 501 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 351) is amended by inserting after paragraph (j) the following:

(k)

If it is a device with respect to which the sponsor is in violation of section 524B (relating to ensuring cybersecurity).

.

(d)

Misbranding

Section 502(t) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 352(t)) is amended—

(1)

by striking or (3) and inserting (3); and

(2)

by inserting before the period at the end the following: , or (4) to furnish a software bill of materials as required under section 524B (relating to ensuring the cybersecurity).