,,ii #aahth ,,congress #b;d ,session ,s4 #dfig ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #aa 7legislative day1 ,july #aj71 #bjbd,ms4 ,rosen 7for herself1 ,mr4 ,young1 and ,mr4 ,king7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to enhance the cybersecurity of the ,healthcare and ,public ,health ,sector4 #a4 ,short title ,this ,act may be cited as the ,healthcare ,cybersecurity ,act of #bjbd4 #b4 ,definitions ,in this ,act-- 7#a7 the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency2 7#b7 the term covered asset means a ,healthcare and ,public ,health ,sector asset1 including technologies1 services1 and utilities2 7#c7 the term ,cybersecurity ,state ,coordinator means a ,cybersecurity ,state ,coordinator appointed under section #bbag7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;c7a772 7#d7 the term ,department means the ,department of ,health and ,human ,services2 7#e7 the term ,director means the ,director of the ,agency2 7#f7 the term ,healthcare and ,public ,health ,sector means the ,healthcare and ,public ,health sector1 as identified in ,presidential ,policy ,directive #ba 7,february #ab1 #bjac2 relating to critical infrastructure security and resilience72 7#g7 the term ,information ,sharing and ,analysis ,organizations has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej72 7#h7 the term ,plan means the ,healthcare and ,public ,health ,sector ,specific ,plan2 and 7#i7 the term ,secretary means the ,secretary of ,health and ,human ,services4 #c4 ,findings ,congress finds the following3 7#a7 ,covered assets are increasingly the targets of malicious cyberattacks1 which result not only in data breaches1 but also increased healthcare delivery costs1 and can ultimately affect patient health outcomes4 7#b7 ,data reported to the ,department shows that large cyber breaches of the information systems of healthcare facilities rose #ic percent between #bjah to #bjbb 4 7#c7 ,according to data from the ,office for ,civil ,rights of the ,department1 health information breaches have increased since #bjaf1 and in #bjbb alone1 the ,department reported #fbf breaches on covered entities1 as defined under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia71 affecting more than #ejj people1 with nearly #db1jjj1jjj total people affected by health information breaches4 #d4 ,agency coordination with the ,department 7a7 ,in general ,the ,agency shall coordinate with the ,department1 including by entering into an agreement1 as appropriate1 to improve cybersecurity in the ,healthcare and ,public ,health ,sector4 7b7 ,agency liaison to the ,department 7#a7 ,appointment ,the ,director shall1 in coordination with the ,secretary1 appoint an individual1 who shall be an employee of the ,agency or a detailee assigned to the ,department by the ,director1 to serve as the liaison of the ,agency to the ,department1 who shall-- 7,a7 have appropriate cybersecurity qualifications and expertise2 and 7,b7 report directly to the ,director4 7#b7 ,responsibilities and duties ,the liaison appointed under paragraph 7#a7 shall-- 7,a7 provide to the owners and operators of covered assets technical assistance regarding1 information on1 and best practices relating to improving cybersecurity2 7,b7 serve as a primary contact of the ,department to coordinate cybersecurity issues with the ,agency2 7,c7 support the implementation and execution of the ,plan and assist in the development of updates to the ,plan2 7,d7 facilitate the sharing of cyber threat information to improve understanding of cybersecurity risks and situational awareness of cybersecurity incidents2 7,e7 manage the implementation of the agreement entered into under subsection 7a72 7,f7 implement the training described in section #e2 7,g7 coordinate between the ,agency and the ,department during cybersecurity incidents within the ,healthcare and ,public ,health ,sector2 and 7,h7 perform such other duties as determined necessary by the ,secretary to achieve the goal of improving the cybersecurity of the ,healthcare and ,public ,health ,sector4 7#c7 ,report ,not later than #ah months after the date of enactment of this ,act1 the liaison appointed under paragraph 7#a71 in consultation with the ,secretary and the ,director1 shall submit a report that describes the activities undertaken to improve cybersecurity coordination between the ,agency and the ,department to-- 7,a7 the ,committee on ,health1 ,education1 ,labor1 and ,pensions1 the ,committee on ,finance1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,b7 the ,committee on ,energy and ,commerce1 the ,committee on ,ways and ,means1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 7c7 ,assistance 7#a7 ,in general ,the ,agency shall coordinate with and make resources available to ,information ,sharing and ,analysis ,organizations1 information sharing and analysis centers1 the sector coordinating councils1 and non-,federal entities that are receiving information shared through programs managed by the ,department4 7#b7 ,scope ,the coordination under paragraph 7#a7 shall include-- 7,a7 developing products specific to the needs of ,healthcare and ,public ,health ,sector entities2 and 7,b7 sharing information relating to cyber threat indicators and appropriate defensive measures4 #e4 ,training for healthcare experts ,the ,cyber ,security ,advisors and ,cybersecurity ,state ,coordinators of the ,agency shall1 in coordination1 as appropriate1 with the liaison appointed under section #d7;b77#a7 and private sector healthcare experts1 provide training to the owners and operators of covered assets on-- 7#a7 cybersecurity risks to the ,healthcare and ,public ,health ,sector and covered assets2 and 7#b7 ways to mitigate the risks to information systems in the ,healthcare and ,public ,health ,sector4 #f4 ,sector-specific plan 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary1 in coordination with the ,director1 shall update the ,plan1 which shall include the following elements3 7#a7 ,an analysis of how identified cybersecurity risks specifically impact covered assets1 including the impact on rural and small and medium-sized covered assets4 7#b7 ,an evaluation of the challenges the owners and operators of covered assets face in-- 7,a7 securing-- 7i7 updated information systems owned1 leased1 or relied upon by covered assets2 7ii7 medical devices or equipment owned1 leased1 or relied upon by covered assets1 which shall include an analysis of the threat landscape and cybersecurity vulnerabilities of such medical devices or equipment2 and 7iii7 sensitive patient health information and electronic health records2 7,b7 implementing cybersecurity protocols2 and 7,c7 responding to data breaches or cybersecurity attacks1 including the impact on patient access to care1 quality of patient care1 timeliness of health care delivery1 and health outcomes4 7#c7 ,an evaluation of best practices for the deployment of trained ,cyber ,security ,advisors and ,cybersecurity ,state ,coordinators of the ,agency into covered assets before1 during1 and after data breaches or cybersecurity attacks4 7#d7 ,an assessment of relevant ,healthcare and ,public ,health ,sector cybersecurity workforce shortages1 including-- 7,a7 training1 recruitment1 and retention issues2 and 7,b7 recommendations for how to address these shortages and issues1 particularly at rural and small and medium-sized covered assets4 7#e7 ,an evaluation of the most accessible and timely ways for the ,agency and the ,department to communicate and deploy cybersecurity recommendations and tools to the owners and operators of covered assets4 7b7 ,congressional briefing ,not later than #abj days after the date of enactment of this ,act1 the ,secretary1 in consultation with the ,director1 shall provide a briefing on the updating of the ,plan under subsection 7a7 to-- 7#a7 the ,committee on ,health1 ,education1 ,labor1 and ,pensions1 the ,committee on ,finance1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7#b7 the ,committee on ,energy and ,commerce1 the ,committee on ,ways and ,means1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 #g4 ,identifying high-risk covered assets 7a7 ,in general ,not later than #ij days after the date of enactment of this ,act1 the ,director shall establish objective criteria for determining whether a covered asset should be designated as a high-risk covered asset4 7b7 ,methodology ,the ,director1 in consultation with the ,secretary1 as appropriate1 shall establish a methodology for determining whether a covered asset meets the criteria established under subsection 7a7 to be designated as a high-risk covered asset4 7c7 ,list of high-,risk covered assets 7#a7 ,in general ,the ,secretary shall develop a list of1 and notify1 the owners and operators of each covered asset determined to be a high-risk covered asset using the methodology established under subsection 7b74 7#b7 ,biannual updating ,the ,secretary shall-- 7,a7 biannually review and update the list of high-risk covered assets developed under paragraph 7#a72 and 7,b7 notify the owners and operators of each covered asset added to or removed from the list as part of a review and update of the list under subparagraph 7,a74 7#c7 ,notice to ,congress ,the ,secretary shall notify ,congress when the initial list of high-risk covered assets is developed under paragraph 7#a7 and each time the list is updated under paragraph 7#b74 7#d7 ,use ,the list developed and updated under this subsection shall be used by the ,department to prioritize resource allocation to high-risk covered assets to bolster cyber resilience4 #h4 ,report on ,assistance ,provided to ,entities of ,healthcare and ,public ,health ,sector ,not later than #abj days after the date of enactment of this ,act1 the ,agency shall submit to ,congress a report on the organization-wide level of support and activities that the ,agency has provided to the healthcare and public health sector to proactively prepare the sector to face cyber threats and respond to cyber attacks when such threats or attacks occur4