,,ii  #aah? ,,congress  #b;d ,session   
,s4 #dfig  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,july #aa 7legislative 
day1 ,july #aj71 #bjbd,ms4 ,ros5 7=     
h]self1 ,mr4 ,"y1 & ,mr4 ,k+7 introduc$ 
! foll[+ bill2 :i* 0 read twice & ref]r$
 to ! ,committee on ,homel& ,security & 
,gov]nm5tal ,affairs  ,a ,,bill  ,to    
enhance ! cyb]security ( ! ,heal?c>e &  
,public ,heal? ,sector4  #a4 ,%ort title
 ,?is ,act may be cit$ z ! ,heal?c>e    
,cyb]security ,act ( #bjbd4  #b4        
,def9itions ,9 ?is ,act-- 7#a7 ! t]m    
,ag5cy means ! ,cyb]security &          
,infra/ructure ,security ,ag5cy2  7#b7 !
 t]m cov]$ asset means a ,heal?c>e &    
,public ,heal? ,sector asset1 includ+   
te*nologies1 s]vices1 & utilities2  7#c7
 ! t]m ,cyb]security ,/ate ,coord9ator  
means a ,cyb]security ,/ate ,coord9ator 
appo9t$ "u section #bbag7;a7 ( ! ,homel&
 ,security ,act ( #bjjb 7#f ,u4,s4,c4   
#ffe;c7a772  7#d7 ! t]m ,dep>tm5t means 
! ,dep>tm5t ( ,heal? & ,human ,s]vices2 
7#e7 ! t]m ,director means ! ,director (

 ! ,ag5cy2  7#f7 ! t]m ,heal?c>e &      
,public ,heal? ,sector means ! ,heal?c>e
 & ,public ,heal? sector1 z id5tifi$ 9  
,presid5tial ,policy ,directive #ba     
7,febru>y #ab1 #bjac2 relat+ to critical
 infra/ructure security & resili5ce72   
7#g7 ! t]m ,in=mation ,%>+ & ,analysis  
,organizations has ! mean+ giv5 t t]m 9 
section #bbjj ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #fej72  7#h7 !   
t]m ,plan means ! ,heal?c>e & ,public   
,heal? ,sector ,specific ,plan2 &  7#i7 
! t]m ,secret>y means ! ,secret>y (     
,heal? & ,human ,s]vices4  #c4 ,f9d+s   
,congress f9ds ! foll[+3 7#a7 ,cov]$    
assets are increas+ly ! t>gets (        
malici\s cyb]attacks1 :i* result n only 
9 data brea*es1 b also increas$ heal?c>e
 deliv]y co/s1 & c ultimately affect    
pati5t heal? outcomes4  7#b7 ,data      
report$ to ! ,dep>tm5t %[s t l>ge cyb]  
brea*es ( ! in=mation sy/ems ( heal?c>e 
facilities rose #ic p]c5t betwe5 #bjah  
to #bjbb 4  7#c7 ,accord+ to data f !   
,(fice = ,civil ,rights ( ! ,dep>tm5t1  

heal? in=mation brea*es h increas$ s9ce 
#bjaf1 & 9 #bjbb alone1 ! ,dep>tm5t     
report$ #fbf brea*es on cov]$ entities1 
z def9$ "u ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7,public ,law #ajd-aia71 affect+ m
 ?an #ejj p1 ) ne>ly #db1jjj1jjj total p
 affect$ by heal? in=mation brea*es4    
#d4 ,ag5cy coord9ation ) ! ,dep>tm5t    
7a7 ,9 g5]al ,! ,ag5cy %all coord9ate ) 
! ,dep>tm5t1 includ+ by ent]+ into an   
agreem5t1 z appropriate1 to improve     
cyb]security 9 ! ,heal?c>e & ,public    
,heal? ,sector4  7b7 ,ag5cy liaison to !
 ,dep>tm5t  7#a7 ,appo9tm5t ,! ,director
 %all1 9 coord9ation ) ! ,secret>y1     
appo9t an individual1 :o %all be an     
employee ( ! ,ag5cy or a detailee       
assign$ to ! ,dep>tm5t by ! ,director1  
to s]ve z ! liaison ( ! ,ag5cy to !     
,dep>tm5t1 :o %all-- 7,a7 h appropriate 
cyb]security qualifications & exp]tise2 
&  7,b7 report directly to ! ,director4 
7#b7 ,responsibilities & duties ,!      
liaison appo9t$ "u p>agraph 7#a7 %all-- 

7,a7 provide to ! own]s & op]ators (    
cov]$ assets te*nical assi/ance reg>d+1 
in=mation on1 & be/ practices relat+ to 
improv+ cyb]security2  7,b7 s]ve z a    
prim>y contact ( ! ,dep>tm5t to         
coord9ate cyb]security issues ) !       
,ag5cy2  7,c7 support ! implem5tation & 
execution ( ! ,plan & assi/ 9 !         
developm5t ( updates to ! ,plan2  7,d7  
facilitate ! %>+ ( cyb] ?reat in=mation 
to improve und]/&+ ( cyb]security risks 
& situational aw>5ess ( cyb]security    
incid5ts2  7,e7 manage ! implem5tation (
 ! agreem5t ent]$ into "u subsection    
7a72  7,f7 implem5t ! tra9+ describ$ 9  
section #e2  7,g7 coord9ate betwe5 !    
,ag5cy & ! ,dep>tm5t dur+ cyb]security  
incid5ts )9 ! ,heal?c>e & ,public ,heal?
 ,sector2 &  7,h7 p]=m su* o!r duties z 
det]m9$ necess>y by ! ,secret>y to      
a*ieve ! goal ( improv+ ! cyb]security (
 ! ,heal?c>e & ,public ,heal? ,sector4  
7#c7 ,report ,n lat] ?an #ah mon?s aft] 
! date ( enactm5t ( ?is ,act1 ! liaison 
appo9t$ "u p>agraph 7#a71 9 consultation

 ) ! ,secret>y & ! ,director1 %all      
submit a report t describes ! activities
 und]tak5 to improve cyb]security       
coord9ation betwe5 ! ,ag5cy & !         
,dep>tm5t to-- 7,a7 ! ,committee on     
,heal?1 ,education1 ,labor1 & ,p5sions1 
! ,committee on ,f9ance1 & ! ,committee 
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate2 &  7,b7 !          
,committee on ,en]gy & ,comm]ce1 !      
,committee on ,ways & ,means1 & !       
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  7c7 ,assi/ance
  7#a7 ,9 g5]al ,! ,ag5cy %all coord9ate
 ) & make res\rces available to         
,in=mation ,%>+ & ,analysis             
,organizations1 in=mation %>+ & analysis
 c5t]s1 ! sector coord9at+ c\ncils1 &   
non-,f$]al entities t are receiv+       
in=mation %>$ ?r\gh programs manag$ by !
 ,dep>tm5t4  7#b7 ,scope ,! coord9ation 
"u p>agraph 7#a7 %all include-- 7,a7    
develop+ products specific to ! ne$s (  
,heal?c>e & ,public ,heal? ,sector      
entities2 &  7,b7 %>+ in=mation relat+  

to cyb] ?reat indicators & appropriate  
def5sive measures4  #e4 ,tra9+ =        
heal?c>e exp]ts ,! ,cyb] ,security      
,advisors & ,cyb]security ,/ate         
,coord9ators ( ! ,ag5cy %all1 9         
coord9ation1 z appropriate1 ) ! liaison 
appo9t$ "u section #d7;b77#a7 & private 
sector heal?c>e exp]ts1 provide tra9+ to
 ! own]s & op]ators ( cov]$ assets on-- 
7#a7 cyb]security risks to ! ,heal?c>e &
 ,public ,heal? ,sector & cov]$ assets2 
&  7#b7 ways to mitigate ! risks to     
in=mation sy/ems 9 ! ,heal?c>e & ,public
 ,heal? ,sector4  #f4 ,sector-specific  
plan  7a7 ,9 g5]al ,n lat] ?an #a ye>   
aft] ! date ( enactm5t ( ?is ,act1 !    
,secret>y1 9 coord9ation ) ! ,director1 
%all update ! ,plan1 :i* %all include ! 
foll[+ elem5ts3 7#a7 ,an analysis ( h[  
id5tifi$ cyb]security risks specifically
 impact cov]$ assets1 includ+ ! impact  
on rural & small & m$ium-siz$ cov]$     
assets4  7#b7 ,an evaluation ( !        
*all5ges ! own]s & op]ators ( cov]$     
assets face 9-- 7,a7 secur+-- 7i7 updat$

 in=mation sy/ems own$1 leas$1 or reli$ 
^u by cov]$ assets2  7ii7 m$ical devices
 or equipm5t own$1 leas$1 or reli$ ^u by
 cov]$ assets1 :i* %all include an      
analysis ( ! ?reat l&scape &            
cyb]security vuln]abilities ( su* m$ical
 devices or equipm5t2 &  7iii7 s5sitive 
pati5t heal? in=mation & electronic     
heal? records2  7,b7 implem5t+          
cyb]security protocols2 &  7,c7 respond+
 to data brea*es or cyb]security        
attacks1 includ+ ! impact on pati5t     
access to c>e1 quality ( pati5t c>e1    
timel9ess ( heal? c>e deliv]y1 & heal?  
outcomes4  7#c7 ,an evaluation ( be/    
practices = ! deploym5t ( tra9$ ,cyb]   
,security ,advisors & ,cyb]security     
,/ate ,coord9ators ( ! ,ag5cy into cov]$
 assets be=e1 dur+1 & aft] data brea*es 
or cyb]security attacks4  7#d7 ,an      
assessm5t ( relevant ,heal?c>e & ,public
 ,heal? ,sector cyb]security work=ce    
%ortages1 includ+-- 7,a7 tra9+1         
recruitm5t1 & ret5tion issues2 &  7,b7  
recomm5dations = h[ to address ^!       

%ortages & issues1 p>ticul>ly at rural &
 small & m$ium-siz$ cov]$ assets4  7#e7 
,an evaluation ( ! mo/ accessible &     
timely ways = ! ,ag5cy & ! ,dep>tm5t to 
communicate & deploy cyb]security       
recomm5dations & tools to ! own]s &     
op]ators ( cov]$ assets4  7b7           
,congressional brief+ ,n lat] ?an #abj  
days aft] ! date ( enactm5t ( ?is ,act1 
! ,secret>y1 9 consultation ) !         
,director1 %all provide a brief+ on !   
updat+ ( ! ,plan "u subsection 7a7 to-- 
7#a7 ! ,committee on ,heal?1 ,education1
 ,labor1 & ,p5sions1 ! ,committee on    
,f9ance1 & ! ,committee on ,homel&      
,security & ,gov]nm5tal ,affairs ( !    
,s5ate2 &  7#b7 ! ,committee on ,en]gy &
 ,comm]ce1 ! ,committee on ,ways &      
,means1 & ! ,committee on ,homel&       
,security ( ! ,h\se ( ,repres5tatives4  
#g4 ,id5tify+ high-risk cov]$ assets    
7a7 ,9 g5]al ,n lat] ?an #ij days aft] !
 date ( enactm5t ( ?is ,act1 ! ,director
 %all e/abli% objective crit]ia =       
det]m9+ :e!r a cov]$ asset %\ld be      

designat$ z a high-risk cov]$ asset4    
7b7 ,me?odology ,! ,director1 9         
consultation ) ! ,secret>y1 z           
appropriate1 %all e/abli% a me?odology =
 det]m9+ :e!r a cov]$ asset meets !     
crit]ia e/abli%$ "u subsection 7a7 to be
 designat$ z a high-risk cov]$ asset4   
7c7 ,li/ ( high-,risk cov]$ assets  7#a7
 ,9 g5]al ,! ,secret>y %all develop a   
li/ (1 & notify1 ! own]s & op]ators (   
ea* cov]$ asset det]m9$ to be a         
high-risk cov]$ asset us+ ! me?odology  
e/abli%$ "u subsection 7b74  7#b7       
,biannual updat+ ,! ,secret>y %all--    
7,a7 biannually review & update ! li/ ( 
high-risk cov]$ assets develop$ "u      
p>agraph 7#a72 &  7,b7 notify ! own]s & 
op]ators ( ea* cov]$ asset add$ to or   
remov$ f ! li/ z "p ( a review & update 
( ! li/ "u subp>agraph 7,a74  7#c7      
,notice to ,congress ,! ,secret>y %all  
notify ,congress :5 ! initial li/ (     
high-risk cov]$ assets is develop$ "u   
p>agraph 7#a7 & ea* "t ! li/ is updat$  
"u p>agraph 7#b74  7#d7 ,use ,! li/     

develop$ & updat$ "u ?is subsection %all
 be us$ by ! ,dep>tm5t to prioritize    
res\rce allocation to high-risk cov]$   
assets to bol/] cyb] resili5ce4  #h4    
,report on ,assi/ance ,provid$ to       
,entities ( ,heal?c>e & ,public ,heal?  
,sector ,n lat] ?an #abj days aft] !    
date ( enactm5t ( ?is ,act1 ! ,ag5cy    
%all submit to ,congress a report on !  
organization-wide level ( support &     
activities t ! ,ag5cy has provid$ to !  
heal?c>e & public heal? sector to       
proactively prep>e ! sector to face cyb]
 ?reats & respond to cyb] attacks :5 su*
 ?reats or attacks occur4