,,ii ,calendar ,no4 #fhc #aahth ,,congress #b;d ,session ,s4 #dfig ,report ,no4 #aah-bhj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #aa 7legislative day1 ,july #aj71 #bjbd,ms4 ,rosen 7for herself1 ,mr4 ,young1 ,mr4 ,king1 and ,mr4 ,ossoff7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,december #i1 #bjbd,reported by ,mr4 ,peters1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to enhance the cybersecurity of the ,healthcare and ,public ,health ,sector4 #a4 ,short title ,this ,act may be cited as the ,healthcare ,cybersecurity ,act of #bjbd4 #b4 ,definitions ,in this ,act-- 7#a7 the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency2 7#b7 the term covered asset means a ,healthcare and ,public ,health ,sector asset1 including technologies1 services1 and utilities2 7#c7 the term ,cybersecurity ,state ,coordinator means a ,cybersecurity ,state ,coordinator appointed under section #bbag7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;c7a772 7#d7 the term ,department means the ,department of ,health and ,human ,services2 7#e7 the term ,director means the ,director of the ,agency2 7#f7 the term ,healthcare and ,public ,health ,sector means the ,healthcare and ,public ,health sector1 as identified in ,presidential ,policy ,directive #ba 7,february #ab1 #bjac2 relating to critical infrastructure security and resilience72 7#g7 the term ,information ,sharing and ,analysis ,organizations has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej72 7#h7 the term ,plan means the ,healthcare and ,public ,health ,sector ,specific ,plan2 and 7#i7 the term ,secretary means the ,secretary of ,health and ,human ,services4 #c4 ,findings ,congress finds the following3 7#a7 ,covered assets are increasingly the targets of malicious cyberattacks1 which result not only in data breaches1 but also increased healthcare delivery costs1 and can ultimately affect patient health outcomes4 7#b7 ,data reported to the ,department shows that large cyber breaches of the information systems of healthcare facilities rose #ic percent between #bjah to #bjbb 4 7#c7 ,according to data from the ,office for ,civil ,rights of the ,department1 health information breaches have increased since #bjaf1 and in #bjbb alone1 the ,department reported #fbf breaches on covered entities1 as defined under the ,health ,insurance ,portability and ,accountability ,act of #aiif 7,public ,law #ajd-aia71 affecting more than #ejj people1 with nearly #db1jjj1jjj total people affected by health information breaches4 #d4 ,agency coordination with the ,department 7a7 ,in general ,the ,agency shall coordinate with the ,department1 including by entering into an agreement1 as appropriate1 to improve cybersecurity in the ,healthcare and ,public ,health ,sector4 7b7 ,agency liaison to the ,department 7#a7 ,appointment ,the ,director shall1 in coordination with the ,secretary1 appoint an individual1 who shall be an employee of the ,agency or a detailee assigned to the ,department by the ,director1 to serve as the liaison of the ,agency to the ,department1 who shall-- 7,a7 have appropriate cybersecurity qualifications and expertise2 and 7,b7 report directly to the ,director4 7#b7 ,responsibilities and duties ,the liaison appointed under paragraph 7#a7 shall-- 7,a7 provide to the owners and operators of covered assets technical assistance regarding1 information on1 and best practices relating to improving cybersecurity2 7,b7 serve as a primary contact of the ,department to coordinate cybersecurity issues with the ,agency2 7,c7 support the implementation and execution of the ,plan and assist in the development of updates to the ,plan2 7,d7 facilitate the sharing of cyber threat information to improve understanding of cybersecurity risks and situational awareness of cybersecurity incidents2 7,e7 manage the implementation of the agreement entered into under subsection 7a72 7,f7 implement the training described in section #e2 7,g7 coordinate between the ,agency and the ,department during cybersecurity incidents within the ,healthcare and ,public ,health ,sector2 and 7,h7 perform such other duties as determined necessary by the ,secretary to achieve the goal of improving the cybersecurity of the ,healthcare and ,public ,health ,sector4 7#c7 ,report ,not later than #ah months after the date of enactment of this ,act1 the liaison appointed under paragraph 7#a71 in consultation with the ,secretary and the ,director1 shall submit a report that describes the activities undertaken to improve cybersecurity coordination between the ,agency and the ,department to-- 7,a7 the ,committee on ,health1 ,education1 ,labor1 and ,pensions1 the ,committee on ,finance1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7,b7 the ,committee on ,energy and ,commerce1 the ,committee on ,ways and ,means1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 7c7 ,assistance 7#a7 ,in general ,the ,agency shall coordinate with and make resources available to ,information ,sharing and ,analysis ,organizations1 information sharing and analysis centers1 the sector coordinating councils1 and non-,federal entities that are receiving information shared through programs managed by the ,department4 7#b7 ,scope ,the coordination under paragraph 7#a7 shall include-- 7,a7 developing products specific to the needs of ,healthcare and ,public ,health ,sector entities2 and 7,b7 sharing information relating to cyber threat indicators and appropriate defensive measures4 #e4 ,training for healthcare experts ,the ,cyber ,security ,advisors and ,cybersecurity ,state ,coordinators of the ,agency shall1 in coordination1 as appropriate1 with the liaison appointed under section #d7;b77#a7 and private sector healthcare experts1 provide training to the owners and operators of covered assets on-- 7#a7 cybersecurity risks to the ,healthcare and ,public ,health ,sector and covered assets2 and 7#b7 ways to mitigate the risks to information systems in the ,healthcare and ,public ,health ,sector4 #f4 ,sector-specific plan 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary1 in coordination with the ,director1 shall update the ,plan1 which shall include the following elements3 7#a7 ,an analysis of how identified cybersecurity risks specifically impact covered assets1 including the impact on rural and small and medium-sized covered assets4 7#b7 ,an evaluation of the challenges the owners and operators of covered assets face in-- 7,a7 securing-- 7i7 updated information systems owned1 leased1 or relied upon by covered assets2 7ii7 medical devices or equipment owned1 leased1 or relied upon by covered assets1 which shall include an analysis of the threat landscape and cybersecurity vulnerabilities of such medical devices or equipment2 and 7iii7 sensitive patient health information and electronic health records2 7,b7 implementing cybersecurity protocols2 and 7,c7 responding to data breaches or cybersecurity attacks1 including the impact on patient access to care1 quality of patient care1 timeliness of health care delivery1 and health outcomes4 7#c7 ,an evaluation of best practices for the deployment of trained ,cyber ,security ,advisors and ,cybersecurity ,state ,coordinators of the ,agency into covered assets before1 during1 and after data breaches or cybersecurity attacks4 7#d7 ,an assessment of relevant ,healthcare and ,public ,health ,sector cybersecurity workforce shortages1 including-- 7,a7 training1 recruitment1 and retention issues2 and 7,b7 recommendations for how to address these shortages and issues1 particularly at rural and small and medium-sized covered assets4 7#e7 ,an evaluation of the most accessible and timely ways for the ,agency and the ,department to communicate and deploy cybersecurity recommendations and tools to the owners and operators of covered assets4 7b7 ,congressional briefing ,not later than #abj days after the date of enactment of this ,act1 the ,secretary1 in consultation with the ,director1 shall provide a briefing on the updating of the ,plan under subsection 7a7 to-- 7#a7 the ,committee on ,health1 ,education1 ,labor1 and ,pensions1 the ,committee on ,finance1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7#b7 the ,committee on ,energy and ,commerce1 the ,committee on ,ways and ,means1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 #g4 ,identifying high-risk covered assets 7a7 ,in general ,not later than #ij days after the date of enactment of this ,act1 the ,director shall establish objective criteria for determining whether a covered asset should be designated as a high-risk covered asset4 7b7 ,methodology ,the ,director1 in consultation with the ,secretary1 as appropriate1 shall establish a methodology for determining whether a covered asset meets the criteria established under subsection 7a7 to be designated as a high-risk covered asset4 7c7 ,list of high-,risk covered assets 7#a7 ,in general ,the ,secretary shall develop a list of1 and notify1 the owners and operators of each covered asset determined to be a high-risk covered asset using the methodology established under subsection 7b74 7#b7 ,biannual updating ,the ,secretary shall-- 7,a7 biannually review and update the list of high-risk covered assets developed under paragraph 7#a72 and 7,b7 notify the owners and operators of each covered asset added to or removed from the list as part of a review and update of the list under subparagraph 7,a74 7#c7 ,notice to ,congress ,the ,secretary shall notify ,congress when the initial list of high-risk covered assets is developed under paragraph 7#a7 and each time the list is updated under paragraph 7#b74 7#d7 ,use ,the list developed and updated under this subsection shall be used by the ,department to prioritize resource allocation to high-risk covered assets to bolster cyber resilience4 #h4 ,report on ,assistance ,provided to ,entities of ,healthcare and ,public ,health ,sector ,not later than #abj days after the date of enactment of this ,act1 the ,agency shall submit to ,congress a report on the organization-wide level of support and activities that the ,agency has provided to the healthcare and public health sector to proactively prepare the sector to face cyber threats and respond to cyber attacks when such threats or attacks occur4 #a4 ,short title ,this ,act may be cited as the ,healthcare ,cybersecurity ,act of #bjbd4 #b4 ,definitions ,in this ,act-- 7#a7 the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency2 7#b7 the term covered asset means a ,healthcare and ,public ,health ,sector asset1 including technologies1 services1 and utilities2 7#c7 the term ,cybersecurity ,state ,coordinator means a ,cybersecurity ,state ,coordinator appointed under section #bbag7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;c7a772 7#d7 the term ,department means the ,department of ,health and ,human ,services2 7#e7 the term ,director means the ,director of the ,agency2 7#f7 the term ,healthcare and ,public ,health ,sector means the ,healthcare and ,public ,health sector1 as identified in the ,national ,security ,memorandum on ,critical ,infrastructure and ,resilience 7,,nsm-#bb71 issued ,april #cj1 #bjbd2 7#g7 the term ,information ,sharing and ,analysis ,organizations has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej72 7#h7 the term ,plan means the ,healthcare and ,public ,health ,sector-specific ,risk ,management ,plan2 and 7#i7 the term ,secretary means the ,secretary of ,health and ,human ,services4 #c4 ,findings ,congress finds the following3 7#a7 ,covered assets are increasingly the targets of malicious cyberattacks1 which result not only in data breaches1 but also increased healthcare delivery costs1 and can ultimately affect patient health outcomes4 7#b7 ,data reported to the ,department shows that large cyber breaches of the information systems of healthcare facilities rose #ic percent between #bjah to #bjbb4 7#c7 ,according to the ,annual ,report to ,congress on ,breaches of ,unsecured ,protected ,health ,information for ,calendar ,year #bjbb issued by the ,office for ,civil ,rights of the ,department1 breaches of unsecured protected health information have increased #ajg percent since #bjah1 and1 in #bjbb alone1 the ,department received #fbf reported breaches affecting not less than #ejj individuals at covered entities or business associates 7as defined in section #afj4ajc of title #de1 ,code of ,federal ,regulations7 that occurred or ended in #bjbb1 with nearly #db1jjj1jjj individuals affected4 #d4 ,agency coordination with the ,department 7a7 ,in general ,the ,agency shall coordinate with the ,department to improve cybersecurity in the ,healthcare and ,public ,health ,sector4 7b7 ,agency liaison to the ,department 7#a7 ,appointment ,the ,director shall1 in coordination with the ,secretary1 appoint an individual1 who shall be an employee of the ,agency or a detailee assigned to the ,administration for ,strategic ,preparedness and ,response ,office of the ,department by the ,director1 to serve as a liaison of the ,agency to the ,department1 who shall-- 7,a7 have appropriate cybersecurity qualifications and expertise2 and 7,b7 report directly to the ,director4 7#b7 ,responsibilities and duties ,the liaison appointed under paragraph 7#a7 shall-- 7,a7 serve as a primary contact of the ,department to coordinate cybersecurity issues with the ,agency2 7,b7 support the implementation and execution of the ,plan and assist in the development of updates to the ,plan2 7,c7 facilitate the sharing of cyber threat information between the ,department and the ,agency to improve understanding of cybersecurity risks and situational awareness of cybersecurity incidents2 7,d7 assist in implementing the training described in section #e2 7,e7 facilitate coordination between the ,agency and the ,department during cybersecurity incidents within the ,healthcare and ,public ,health ,sector2 and 7,f7 perform such other duties as determined necessary by the ,secretary to achieve the goal of improving the cybersecurity of the ,healthcare and ,public ,health ,sector4 7#c7 ,report 7,a7 ,requirement ,not later than #ah months after the date of enactment of this ,act1 the ,secretary1 in coordination with the ,director1 shall submit a report that describes the activities undertaken to improve cybersecurity coordination between the ,agency and the ,department to-- 7i7 the ,committee on ,health1 ,education1 ,labor1 and ,pensions1 the ,committee on ,finance1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7ii7 the ,committee on ,energy and ,commerce1 the ,committee on ,ways and ,means1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 7,b7 ,contents ,the report submitted under subparagraph 7,a7 shall include-- 7i7 a summary of the activities of the liaison appointed under paragraph 7#a72 7ii7 a description of any challenges to the effectiveness of the liaison appointed under paragraph 7#a7 completing the required duties of the liaison2 and 7iii7 a study of the feasibility of an agreement to improve cybersecurity in the public sector of healthcare4 7c7 ,resources 7#a7 ,in general ,the ,agency shall coordinate with and make resources available to ,information ,sharing and ,analysis ,organizations1 information sharing and analysis centers1 the sector coordinating councils1 and non-,federal entities that are receiving information shared through programs managed by the ,department4 7#b7 ,scope ,the coordination under paragraph 7#a7 shall include-- 7,a7 developing products specific to the needs of ,healthcare and ,public ,health ,sector entities2 and 7,b7 sharing information relating to cyber threat indicators and appropriate defensive measures4 #e4 ,training for healthcare owners and operators ,the ,agency shall make available training to the owners and operators of covered assets on-- 7#a7 cybersecurity risks to the ,healthcare and ,public ,health ,sector and covered assets2 and 7#b7 ways to mitigate the risks to information systems in the ,healthcare and ,public ,health ,sector4 #f4 ,sector-specific risk management plan 7a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary1 in coordination with the ,director1 shall update the ,plan1 which shall include the following elements3 7#a7 ,an analysis of how identified cybersecurity risks specifically impact covered assets1 including the impact on rural and small- and medium-sized covered assets4 7#b7 ,an evaluation of the challenges the owners and operators of covered assets face in-- 7,a7 securing-- 7i7 updated information systems owned1 leased1 or relied upon by covered assets2 7ii7 medical devices or equipment owned1 leased1 or relied upon by covered assets1 which shall include an analysis of the threat landscape and cybersecurity vulnerabilities of such medical devices or equipment2 and 7iii7 sensitive patient health information and electronic health records2 7,b7 implementing cybersecurity protocols2 and 7,c7 responding to data breaches or cybersecurity attacks1 including the impact on patient access to care1 quality of patient care1 timeliness of health care delivery1 and health outcomes4 7#c7 ,an evaluation of the best practices for utilization of resources from the ,agency to support covered assets before1 during1 and after data breaches or cybersecurity attacks1 such as by ,cyber ,security ,advisors and ,cybersecurity ,state ,coordinators of the ,agency or other similar resources4 7#d7 ,an assessment of relevant ,healthcare and ,public ,health ,sector cybersecurity workforce shortages1 including-- 7,a7 training1 recruitment1 and retention issues2 and 7,b7 recommendations for how to address these shortages and issues1 particularly at rural and small- and medium-sized covered assets4 7#e7 ,an evaluation of the most accessible and timely ways for the ,agency and the ,department to communicate and deploy cybersecurity recommendations and tools to the owners and operators of covered assets4 7b7 ,congressional briefing ,not later than #abj days after the date of enactment of this ,act1 the ,secretary1 in consultation with the ,director1 shall provide a briefing on the updating of the ,plan under subsection 7a7 to-- 7#a7 the ,committee on ,health1 ,education1 ,labor1 and ,pensions1 the ,committee on ,finance1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 and 7#b7 the ,committee on ,energy and ,commerce1 the ,committee on ,ways and ,means1 and the ,committee on ,homeland ,security of the ,house of ,representatives4 #g4 ,identifying high-risk covered assets 7a7 ,in general ,the ,secretary1 in consultation with the ,director and health sector owners and operators1 as appropriate1 may establish objective criteria for determining whether a covered asset may be designated as a high-risk covered asset1 provided that such criteria shall align with the methodology promulgated by the ,director for identifying functions relating to critical infrastructure1 as defined in section #ajaf7;e7 of the ,critical ,infrastructures ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e771 and associated risk assessments4 7b7 ,list of high-risk covered assets 7#a7 ,in general ,the ,secretary may develop a list of1 and notify1 the owners and operators of each covered asset determined to be a high-risk covered asset using the methodology promulgated by the ,director pursuant to subsection 7a74 7#b7 ,biannual updating ,the ,secretary may-- 7,a7 biannually review and update the list of high-risk covered assets developed under paragraph 7#a72 and 7,b7 notify the owners and operators of each covered asset added to or removed from the list as part of a review and update of the list under subparagraph 7,a74 7#c7 ,notice to ,congress ,the ,secretary shall notify ,congress when an initial list of high-risk covered assets is developed under paragraph 7#a7 and each time the list is updated under paragraph 7#b74 7#d7 ,use ,the list developed and updated under this subsection may be used by the ,department to prioritize resource allocation to high-risk covered assets to bolster cyber resilience4 #h4 ,reports 7a7 ,report on ,assistance ,provided to ,entities of ,healthcare and ,public ,health ,sector ,not later than #abj days after the date of enactment of this ,act1 the ,agency shall submit to ,congress a report on the organization-wide level of support and activities that the ,agency has provided to the healthcare and public health sector to proactively prepare the sector to face cyber threats and respond to cyber attacks when such threats or attacks occur4 7b7 ,report on critical infrastructure resources ,not later than #ah months after the date of enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to ,congress a report on ,federal resources available1 as of the date of enactment of this ,act1 for the ,healthcare and ,public ,health ,sector relating to critical infrastructure1 as defined in section #ajaf7;e7 of the ,critical ,infrastructures ,protection ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e771 including resources available from recent and ongoing collaboration with the ,director and the ,secretary4 #i4 ,rules of construction 7a7 ,agency actions ,nothing in this ,act shall be construed to authorize the ,secretary or ,director to take an action that is not authorized by this ,act or existing law4 7b7 ,protection of rights ,nothing in this ,act shall be construed to permit the violation of the rights of any individual protected by the ,constitution of the ,united ,states1 including through censorship of speech protected by the ,constitution of the ,united ,states or unauthorized surveillance4 7c7 ,no additional funds ,no additional funds are authorized to be appropriated for the purpose of carrying out this ,act4 ,december #i1 #bjbd,reported with an amendment