,i #aah? ,,congress #b;d ,session ,h4 ,r4 #ajdee ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,decemb] #ag1 #bjbd,ms4 ,kelly ( ,ill9ois introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce1 & 9 addition to ! ,committees on ,ways & ,means1 & ,sci5ce1 ,space1 & ,te*nology1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,a ,,bill ,to direct ! ,secret>y ( ,heal? & ,human ,s]vices to e/abli% ! ,heal? ,sector ,cyb]security ,coord9ation ,c5t]1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,heal?c>e ,cyb]security ,improvem5t ,act4 #b ,f9d+s ,congress f9ds t-- 7#a7 ! ,dep>tm5t ( ,heal? & ,human ,s]vices f\nd t ransomw>e attacks on hospitals h m ?an d\bl$ f #bjai to #bjbj1 ) m ?an #bci1jjj1jjj attacks attempt$2 7#b7 9 #bjbj1 ov] #fcj heal? c>e organizations 7 subject to data brea*es1 lead+ to ov] #bi1jjj1jjj heal? records publicly releas$2 & 7#c7 /udies indicate t attacks on our nation's heal? c>e sy/ems w only increase z hospitals are =c$ to balance heal? c>e co/s ) an increas+ly digital heal? c>e sy/em4 #c ,heal? ,sector ,cyb]security ,coord9ation ,c5t] 7a7 ,e/abli%m5t ,n lat] ?an #abj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y ( ,heal? & ,human ,s]vices 79 ?is ,act ref]r$ to z ! ,secret>y7 %all1 9 consultation1 z appropriate1 ) o!r relevant (ficials )9 ! ,dep>tm5t ( ,heal? & ,human ,s]vices1 includ+ ! ,commission] ( ,food & ,drugs1 ! ,assi/ant ,secret>y = ,prep>$ness & ,response1 & ! ,(fic] = ,civil ,rights & ,civil ,lib]ties1 e/abli% a c5t] = purposes ( coord9at+ cyb]security across ! heal? c>e sector to be kn[n z ! ,heal? ,sector ,cyb]security ,coord9ation ,c5t] 79 ?is section ref]r$ to z ! ,c5t]74 7b7 ,duties ,! ,c5t] %all-- 7#a7 support ! def5se ( ! in=mation te*nology infra/ructure ( ! heal? c>e sector1 includ+ by-- 7,a7 /r5g!n+ coord9ation & in=mation %>+ )9 ! sector2 & 7,b7 develop+ a plan to protect1 detect1 respond to1 & recov] f cyb]security risks & incid5ts1 includ+ = entities ) limit$ te*nical capacity2 & 7#b7 develop & support te*nical capabilities & provide advice reg>d+ ! developm5t ( /&>ds1 to prev5t & mitigate cyb] attacks1 includ+-- 7,a7 ! ,commission] ( ,food & ,drugs2 & 7,b7 ! ,assi/ant ,secret>y = ,prep>$ness & ,response4 #d ,heal? ,c>e ,cyb]security ,grant ,program 7a7 ,e/abli%m5t ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y %all e/abli% a program to be kn[n z ! ,heal? ,c>e ,cyb]security ,grant ,program = ! purpose ( aw>d+ grants to eligible entities to obta9 equipm5t & s(tw>e & hire in=mation te*nology /aff to ensure ! protection ( critical in=mation sy/ems4 7b7 ,grant am\nt ,n lat] ?an #ij days aft] funds are made available to c>ry out ?is section1 ! ,secret>y %all publi% ! maximum am\nt ( a grant available "u ?is section1 z det]m9$ by ! ,secret>y4 7c7 ,report ,n lat] ?an #e ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y %all prep>e & submit to ! ,committee on ,heal?1 ,education1 ,labor1 & ,p5sions ( ! ,s5ate & ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives a report on ! activities & outcomes ( ! grant program "u ?is section4 7d7 ,def9itions ,9 ?is section3 7#a7 ,eligible entity ,! t]m eligible entity means a-- 7,a7 hospital ) few] ?an #cjj b$s = ! provision ( pati5t c>e2 or 7,b7 rural heal? cl9ic4 7#b7 ,hospital ,! t]m hospital means a hospital1 z def9$ 9 section #ahfa7;e7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #aciex7e771 or a critical access hospital1 z def9$ 9 section #ahfa7mm77#a7 ( su* ,act 7#db ,u4,s4,c4 #aciex7mm77#a774 7#c7 ,rural heal? cl9ic ,! t]m rural heal? cl9ic has ! mean+ giv5 su* t]m 9 section #ahfa7;aa7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #aciex7aa77#b774 7e7 ,au?orization ( ,appropriations ,!re are au?oriz$ to be appropriat$ to c>ry out ?is section #ajj1jjj1jjj = fiscal ye> #bjbb1 to rema9 available ?r\gh fiscal ye> #bjbc4 #e4 ,/&>ds = m$ical devices & in=mation security networks 9 hospitals 7a7 ,e/abli%m5t ,n lat] ?an #a ye> aft] ! date ( ! enactm5t ( ?is ,act1 ! ,director ( ! ,national ,in/itute ( ,/&>ds & ,te*nology1 9 consultation ) ! ,director ( ! ,cyb]security & ,infra/ructure ,security ,ag5cy & ! heads ( appropriate ,f$]al ag5cies1 %all develop /&>ds = ! protection ( in=mation security networks & digital m$ical devices 9 hospitals4 7b7 ,consid]ation ,9 develop+ /&>ds "u subsection 7a71 ! ,director %all take into consid]ation-- 7#a7 curr5t ,f$]al /&>ds & guidel9es1 includ+-- 7,a7 /&>ds & guidel9es develop$ "u section #d ( ! ,int]net ( ,?+s ,cyb]security ,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 #bgh;g-b72 7,b7 /&>ds promulgat$ "u section #dje7;d7 ( ! ,cyb]security ,act ( #bjae 7#f ,u4,s4,c4 #aecc72 & 7,c7 /&>ds develop$ by ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security ) respect to critical infra/ructure 7z def9$ 9 section #ajaf7;e7 ( ! ,,usa ,,patriot ,act 7#db ,u4,s4,c4 #eaie;c7e772 & 7#b7 g5]al security practices1 includ+-- 7,a7 network segm5tation betwe5 m$ical devices & pati5t in=mation2 & 7,b7 ! me?ods us$ to detect m$ical devices connect$ to ! int]nal network ( a hospital4 7c7 ,en=cem5t "u ,m$ic>e & ,m$icaid 7#a7 ,m$ic>e ,section #ahff7;a77#a7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acie;cc7a77#a77 is am5d$-- 7,a7 9 subp>agraph 7,x71 by /rik+ & at ! end2 7,b7 9 subp>agraph 7,y77ii77,v71 by /rik+ ! p]iod & ins]t+ 1 &2 & 7,c7 by ins]t+ aft] subp>agraph 7,y7 ! foll[+ new subp>agraph3 7,z7 9 ! case ( a hospital or a critical access hospital1 beg9n+ on ! date t is #b ye>s aft] ! date ( ! enactm5t ( ?is subp>agraph1 to comply ) ! /&>ds develop$ "u section #e7;a7 ( ! ,heal?c>e ,cyb]security ,improvem5t ,act4 4 7#b7 ,m$icaid ,section #aijb7;a7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acif;a7a77 is am5d$-- 7,a7 9 p>agraph 7#hf71 by /rik+ & at ! end2 7,b7 9 p>agraph 7#hg77;,d71 by /rik+ ! p]iod & ins]t+ 2 &2 & 7,c7 by ins]t+ aft] p>agraph 7#hg7 ! foll[+ new p>agraph3 7#hh7 provide t1 beg9n+ on ! date t is #b ye>s aft] ! date ( ! enactm5t ( ?is p>agraph1 no hospital be eligible to p>ticipate "u ! plan 7or a waiv] ( su* plan7 unless su* hospital complies ) ! /&>ds develop$ "u section #e7;a7 ( ! ,heal?c>e ,cyb]security ,improvem5t ,act4 4 7d7 ,qu9qu5nial review & revision ,n lat] ?an #e ye>s aft] ! date on :i* ! ,secret>y publi%es ! /&>ds "u subsection 7a71 & n less frequ5tly ?an once e #e ye>s !reaft]1 ! ,secret>y1 %all review & revise su* /&>ds1 z appropriate4 #f4 ,limitation on liability = a l>ge hospital 7a7 ,9 g5]al ,not)/&+ any o!r provision ( law1 a l>ge hospital %all n be liable 9 any cov]$ civil action to a small] heal? entity if su* hospital provid$ cyb]security assi/ance to su* entity ) respect to electronic data1 unless su* entity c prove by cle> & conv9c+ evid5ce t ! alleg$ h>m 0 caus$ by gross neglig5ce or willful misconduct4 7b7 ,exception ,= purposes ( ?is section1 any acts or omissions by a l>ge hospital result+ f a res\rce or /aff+ %ortage %all n be consid]$ willful misconduct or gross neglig5ce4 7c7 ,def9itions ,9 ?is section3 7#a7 ,cov]$ civil action ,! t]m cov]$ civil action means a civil action "u ,/ate law f h>m result+ f ! acquisition1 /orage1 security1 use1 misuse1 disclosure1 or transmission ( electronic data ( any k9d1 includ+-- 7,a7 in=mation security & privacy2 7,b7 p5alties1 includ+ = regulatory def5se2 7,c7 misuse ( website m$ia cont5t2 & 7,d7 disclosure1 misuse1 or improp] 7or inadequate7 /orage or security ( p]sonal & confid5tial in=mation4 7#b7 ,l>ge hospital ,! t]m l>ge hospital means a hospital ) #cjj or m b$s = ! provision ( pati5t c>e4 7#c7 ,hospital ,! t]m hospital has ! mean+ giv5 su* t]m 9 section #ahfa7;e7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #aciex74 7#d7 ,rural heal? cl9ic ,! t]m rural heal? cl9ic has ! mean+ giv5 su* t]m 9 section #ahfa7;aa7 ( ! ,social ,security ,act 7#db ,u4,s4,c4 #aciex7aa77#b774 7#e7 ,small heal? entity ,! t]m small heal? entity means-- 7,a7 a hospital ) few] ?an #bii b$s = ! provision ( pati5t c>e2 & 7,b7 a rural heal? cl9ic4