; and (II) any entity determined by the Secretary to have a valid interest in the report card. (C) Updated report card For as long as the cyber device receives technical support from the manufacturer or any other third party authorized by the manufacturer, the manufacturer shall submit to the Secretary an annual update to the report card. (c) Protecting remote access to managed solutions (1) In general A manufacturer of a cyber device shall: (A) In order to remotely access such device after selling, or otherwise transferring ownership of, the device, obtain consent for such access from the provider owning or operating the device and from any patient on which the device is used. Such consent may be in the form of an agreement entered into between the provider and the manufacturer at the time the device is sold to the provider, and may be for the manufacturer to remotely access the device at times specified in such agreement or by an agreement between the manufacturer and provider entered into thereafter. In the case of an agreement described in the previous sentence, consent of the patient may be obtained through the provider notifying the patient of such agreement. (B) For any cyber device that the manufacturer may remotely access in accordance with subparagraph (A): (i) Notify the provider when the manufacturer accesses the device remotely, including the name of the person with such access, the kinds of tasks that can be performed through such access, and the software used to access the device. Such notification can be in the form of an audit log described in clause (ii) if the audit log is readily available to the provider. (ii) Maintain an audit log for each time the manufacturer accesses the device remotely and make such log accessible to the provider. (C) Except as provided in paragraph (2), for any cyber device that has the capability to be accessed remotely by the manufacturer or any other entity: (i) Implement multi-factor authentication for accessing any cyber capability of the device. (ii) Secure data