,,ii ,cal5d> ,no4 #fhc #aah? ,,congress 
#b;d ,session  ,s4 #dfig ,report ,no4   
#aah-bhj ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,july #aa 7legislative day1   
,july #aj71 #bjbd,ms4 ,ros5 7= h]self1  
,mr4 ,"y1 ,mr4 ,k+1 & ,mr4 ,oss(f7      
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,decemb] #i1 #bjbd,report$ by ,mr4    
,pet]s1 ) an amendment,strike out all   
aft] ! enact+ clause & ins]t ! "p pr9t$ 
9 italic  ,a ,,bill  ,to enhance !      
cyb]security ( ! ,heal?c>e & ,public    
,heal? ,sector4  #a4 ,%ort title ,?is   
,act may be cit$ z ! ,heal?c>e          
,cyb]security ,act ( #bjbd4  #b4        
,def9itions ,9 ?is ,act-- 7#a7 ! t]m    
,ag5cy means ! ,cyb]security &          
,infra/ructure ,security ,ag5cy2  7#b7 !
 t]m cov]$ asset means a ,heal?c>e &    
,public ,heal? ,sector asset1 includ+   
te*nologies1 s]vices1 & utilities2  7#c7
 ! t]m ,cyb]security ,/ate ,coord9ator  
means a ,cyb]security ,/ate ,coord9ator 

appo9t$ "u section #bbag7;a7 ( ! ,homel&
 ,security ,act ( #bjjb 7#f ,u4,s4,c4   
#ffe;c7a772  7#d7 ! t]m ,dep>tm5t means 
! ,dep>tm5t ( ,heal? & ,human ,s]vices2 
7#e7 ! t]m ,director means ! ,director (
 ! ,ag5cy2  7#f7 ! t]m ,heal?c>e &      
,public ,heal? ,sector means ! ,heal?c>e
 & ,public ,heal? sector1 z id5tifi$ 9  
,presid5tial ,policy ,directive #ba     
7,febru>y #ab1 #bjac2 relat+ to critical
 infra/ructure security & resili5ce72   
7#g7 ! t]m ,in=mation ,%>+ & ,analysis  
,organizations has ! mean+ giv5 t t]m 9 
section #bbjj ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #fej72  7#h7 !   
t]m ,plan means ! ,heal?c>e & ,public   
,heal? ,sector ,specific ,plan2 &  7#i7 
! t]m ,secret>y means ! ,secret>y (     
,heal? & ,human ,s]vices4  #c4 ,f9d+s   
,congress f9ds ! foll[+3 7#a7 ,cov]$    
assets are increas+ly ! t>gets (        
malici\s cyb]attacks1 :i* result n only 
9 data brea*es1 b also increas$ heal?c>e
 deliv]y co/s1 & c ultimately affect    
pati5t heal? outcomes4  7#b7 ,data      

report$ to ! ,dep>tm5t %[s t l>ge cyb]  
brea*es ( ! in=mation sy/ems ( heal?c>e 
facilities rose #ic p]c5t betwe5 #bjah  
to #bjbb 4  7#c7 ,accord+ to data f !   
,(fice = ,civil ,rights ( ! ,dep>tm5t1  
heal? in=mation brea*es h increas$ s9ce 
#bjaf1 & 9 #bjbb alone1 ! ,dep>tm5t     
report$ #fbf brea*es on cov]$ entities1 
z def9$ "u ! ,heal? ,insurance          
,portability & ,acc\ntability ,act (    
#aiif 7,public ,law #ajd-aia71 affect+ m
 ?an #ejj p1 ) ne>ly #db1jjj1jjj total p
 affect$ by heal? in=mation brea*es4    
#d4 ,ag5cy coord9ation ) ! ,dep>tm5t    
7a7 ,9 g5]al ,! ,ag5cy %all coord9ate ) 
! ,dep>tm5t1 includ+ by ent]+ into an   
agreem5t1 z appropriate1 to improve     
cyb]security 9 ! ,heal?c>e & ,public    
,heal? ,sector4  7b7 ,ag5cy liaison to !
 ,dep>tm5t  7#a7 ,appo9tm5t ,! ,director
 %all1 9 coord9ation ) ! ,secret>y1     
appo9t an individual1 :o %all be an     
employee ( ! ,ag5cy or a detailee       
assign$ to ! ,dep>tm5t by ! ,director1  
to s]ve z ! liaison ( ! ,ag5cy to !     

,dep>tm5t1 :o %all-- 7,a7 h appropriate 
cyb]security qualifications & exp]tise2 
&  7,b7 report directly to ! ,director4 
7#b7 ,responsibilities & duties ,!      
liaison appo9t$ "u p>agraph 7#a7 %all-- 
7,a7 provide to ! own]s & op]ators (    
cov]$ assets te*nical assi/ance reg>d+1 
in=mation on1 & be/ practices relat+ to 
improv+ cyb]security2  7,b7 s]ve z a    
prim>y contact ( ! ,dep>tm5t to         
coord9ate cyb]security issues ) !       
,ag5cy2  7,c7 support ! implem5tation & 
execution ( ! ,plan & assi/ 9 !         
developm5t ( updates to ! ,plan2  7,d7  
facilitate ! %>+ ( cyb] ?reat in=mation 
to improve und]/&+ ( cyb]security risks 
& situational aw>5ess ( cyb]security    
incid5ts2  7,e7 manage ! implem5tation (
 ! agreem5t ent]$ into "u subsection    
7a72  7,f7 implem5t ! tra9+ describ$ 9  
section #e2  7,g7 coord9ate betwe5 !    
,ag5cy & ! ,dep>tm5t dur+ cyb]security  
incid5ts )9 ! ,heal?c>e & ,public ,heal?
 ,sector2 &  7,h7 p]=m su* o!r duties z 
det]m9$ necess>y by ! ,secret>y to      

a*ieve ! goal ( improv+ ! cyb]security (
 ! ,heal?c>e & ,public ,heal? ,sector4  
7#c7 ,report ,n lat] ?an #ah mon?s aft] 
! date ( enactm5t ( ?is ,act1 ! liaison 
appo9t$ "u p>agraph 7#a71 9 consultation
 ) ! ,secret>y & ! ,director1 %all      
submit a report t describes ! activities
 und]tak5 to improve cyb]security       
coord9ation betwe5 ! ,ag5cy & !         
,dep>tm5t to-- 7,a7 ! ,committee on     
,heal?1 ,education1 ,labor1 & ,p5sions1 
! ,committee on ,f9ance1 & ! ,committee 
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate2 &  7,b7 !          
,committee on ,en]gy & ,comm]ce1 !      
,committee on ,ways & ,means1 & !       
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  7c7 ,assi/ance
  7#a7 ,9 g5]al ,! ,ag5cy %all coord9ate
 ) & make res\rces available to         
,in=mation ,%>+ & ,analysis             
,organizations1 in=mation %>+ & analysis
 c5t]s1 ! sector coord9at+ c\ncils1 &   
non-,f$]al entities t are receiv+       
in=mation %>$ ?r\gh programs manag$ by !

 ,dep>tm5t4  7#b7 ,scope ,! coord9ation 
"u p>agraph 7#a7 %all include-- 7,a7    
develop+ products specific to ! ne$s (  
,heal?c>e & ,public ,heal? ,sector      
entities2 &  7,b7 %>+ in=mation relat+  
to cyb] ?reat indicators & appropriate  
def5sive measures4  #e4 ,tra9+ =        
heal?c>e exp]ts ,! ,cyb] ,security      
,advisors & ,cyb]security ,/ate         
,coord9ators ( ! ,ag5cy %all1 9         
coord9ation1 z appropriate1 ) ! liaison 
appo9t$ "u section #d7;b77#a7 & private 
sector heal?c>e exp]ts1 provide tra9+ to
 ! own]s & op]ators ( cov]$ assets on-- 
7#a7 cyb]security risks to ! ,heal?c>e &
 ,public ,heal? ,sector & cov]$ assets2 
&  7#b7 ways to mitigate ! risks to     
in=mation sy/ems 9 ! ,heal?c>e & ,public
 ,heal? ,sector4  #f4 ,sector-specific  
plan  7a7 ,9 g5]al ,n lat] ?an #a ye>   
aft] ! date ( enactm5t ( ?is ,act1 !    
,secret>y1 9 coord9ation ) ! ,director1 
%all update ! ,plan1 :i* %all include ! 
foll[+ elem5ts3 7#a7 ,an analysis ( h[  
id5tifi$ cyb]security risks specifically

 impact cov]$ assets1 includ+ ! impact  
on rural & small & m$ium-siz$ cov]$     
assets4  7#b7 ,an evaluation ( !        
*all5ges ! own]s & op]ators ( cov]$     
assets face 9-- 7,a7 secur+-- 7i7 updat$
 in=mation sy/ems own$1 leas$1 or reli$ 
^u by cov]$ assets2  7ii7 m$ical devices
 or equipm5t own$1 leas$1 or reli$ ^u by
 cov]$ assets1 :i* %all include an      
analysis ( ! ?reat l&scape &            
cyb]security vuln]abilities ( su* m$ical
 devices or equipm5t2 &  7iii7 s5sitive 
pati5t heal? in=mation & electronic     
heal? records2  7,b7 implem5t+          
cyb]security protocols2 &  7,c7 respond+
 to data brea*es or cyb]security        
attacks1 includ+ ! impact on pati5t     
access to c>e1 quality ( pati5t c>e1    
timel9ess ( heal? c>e deliv]y1 & heal?  
outcomes4  7#c7 ,an evaluation ( be/    
practices = ! deploym5t ( tra9$ ,cyb]   
,security ,advisors & ,cyb]security     
,/ate ,coord9ators ( ! ,ag5cy into cov]$
 assets be=e1 dur+1 & aft] data brea*es 
or cyb]security attacks4  7#d7 ,an      

assessm5t ( relevant ,heal?c>e & ,public
 ,heal? ,sector cyb]security work=ce    
%ortages1 includ+-- 7,a7 tra9+1         
recruitm5t1 & ret5tion issues2 &  7,b7  
recomm5dations = h[ to address ^!       
%ortages & issues1 p>ticul>ly at rural &
 small & m$ium-siz$ cov]$ assets4  7#e7 
,an evaluation ( ! mo/ accessible &     
timely ways = ! ,ag5cy & ! ,dep>tm5t to 
communicate & deploy cyb]security       
recomm5dations & tools to ! own]s &     
op]ators ( cov]$ assets4  7b7           
,congressional brief+ ,n lat] ?an #abj  
days aft] ! date ( enactm5t ( ?is ,act1 
! ,secret>y1 9 consultation ) !         
,director1 %all provide a brief+ on !   
updat+ ( ! ,plan "u subsection 7a7 to-- 
7#a7 ! ,committee on ,heal?1 ,education1
 ,labor1 & ,p5sions1 ! ,committee on    
,f9ance1 & ! ,committee on ,homel&      
,security & ,gov]nm5tal ,affairs ( !    
,s5ate2 &  7#b7 ! ,committee on ,en]gy &
 ,comm]ce1 ! ,committee on ,ways &      
,means1 & ! ,committee on ,homel&       
,security ( ! ,h\se ( ,repres5tatives4  

#g4 ,id5tify+ high-risk cov]$ assets    
7a7 ,9 g5]al ,n lat] ?an #ij days aft] !
 date ( enactm5t ( ?is ,act1 ! ,director
 %all e/abli% objective crit]ia =       
det]m9+ :e!r a cov]$ asset %\ld be      
designat$ z a high-risk cov]$ asset4    
7b7 ,me?odology ,! ,director1 9         
consultation ) ! ,secret>y1 z           
appropriate1 %all e/abli% a me?odology =
 det]m9+ :e!r a cov]$ asset meets !     
crit]ia e/abli%$ "u subsection 7a7 to be
 designat$ z a high-risk cov]$ asset4   
7c7 ,li/ ( high-,risk cov]$ assets  7#a7
 ,9 g5]al ,! ,secret>y %all develop a   
li/ (1 & notify1 ! own]s & op]ators (   
ea* cov]$ asset det]m9$ to be a         
high-risk cov]$ asset us+ ! me?odology  
e/abli%$ "u subsection 7b74  7#b7       
,biannual updat+ ,! ,secret>y %all--    
7,a7 biannually review & update ! li/ ( 
high-risk cov]$ assets develop$ "u      
p>agraph 7#a72 &  7,b7 notify ! own]s & 
op]ators ( ea* cov]$ asset add$ to or   
remov$ f ! li/ z "p ( a review & update 
( ! li/ "u subp>agraph 7,a74  7#c7      

,notice to ,congress ,! ,secret>y %all  
notify ,congress :5 ! initial li/ (     
high-risk cov]$ assets is develop$ "u   
p>agraph 7#a7 & ea* "t ! li/ is updat$  
"u p>agraph 7#b74  7#d7 ,use ,! li/     
develop$ & updat$ "u ?is subsection %all
 be us$ by ! ,dep>tm5t to prioritize    
res\rce allocation to high-risk cov]$   
assets to bol/] cyb] resili5ce4  #h4    
,report on ,assi/ance ,provid$ to       
,entities ( ,heal?c>e & ,public ,heal?  
,sector ,n lat] ?an #abj days aft] !    
date ( enactm5t ( ?is ,act1 ! ,ag5cy    
%all submit to ,congress a report on !  
organization-wide level ( support &     
activities t ! ,ag5cy has provid$ to !  
heal?c>e & public heal? sector to       
proactively prep>e ! sector to face cyb]
 ?reats & respond to cyb] attacks :5 su*
 ?reats or attacks occur4  #a4 ,%ort    
title ,?is ,act may be cit$ z !         
,heal?c>e ,cyb]security ,act ( #bjbd4   
#b4 ,def9itions ,9 ?is ,act-- 7#a7 ! t]m
 ,ag5cy means ! ,cyb]security &         
,infra/ructure ,security ,ag5cy2  7#b7 !

 t]m cov]$ asset means a ,heal?c>e &    
,public ,heal? ,sector asset1 includ+   
te*nologies1 s]vices1 & utilities2  7#c7
 ! t]m ,cyb]security ,/ate ,coord9ator  
means a ,cyb]security ,/ate ,coord9ator 
appo9t$ "u section #bbag7;a7 ( ! ,homel&
 ,security ,act ( #bjjb 7#f ,u4,s4,c4   
#ffe;c7a772  7#d7 ! t]m ,dep>tm5t means 
! ,dep>tm5t ( ,heal? & ,human ,s]vices2 
7#e7 ! t]m ,director means ! ,director (
 ! ,ag5cy2  7#f7 ! t]m ,heal?c>e &      
,public ,heal? ,sector means ! ,heal?c>e
 & ,public ,heal? sector1 z id5tifi$ 9 !
 ,national ,security ,memor&um on       
,critical ,infra/ructure & ,resili5ce   
7,,nsm-#bb71 issu$ ,april #cj1 #bjbd2   
7#g7 ! t]m ,in=mation ,%>+ & ,analysis  
,organizations has ! mean+ giv5 t t]m 9 
section #bbjj ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #fej72  7#h7 !   
t]m ,plan means ! ,heal?c>e & ,public   
,heal? ,sector-specific ,risk ,managem5t
 ,plan2 &  7#i7 ! t]m ,secret>y means ! 
,secret>y ( ,heal? & ,human ,s]vices4   
#c4 ,f9d+s ,congress f9ds ! foll[+3 7#a7

 ,cov]$ assets are increas+ly ! t>gets (
 malici\s cyb]attacks1 :i* result n only
 9 data brea*es1 b also increas$        
heal?c>e deliv]y co/s1 & c ultimately   
affect pati5t heal? outcomes4  7#b7     
,data report$ to ! ,dep>tm5t %[s t l>ge 
cyb] brea*es ( ! in=mation sy/ems (     
heal?c>e facilities rose #ic p]c5t      
betwe5 #bjah to #bjbb4  7#c7 ,accord+ to
 ! ,annual ,report to ,congress on      
,brea*es ( ,unsecur$ ,protect$ ,heal?   
,in=mation = ,cal5d> ,ye> #bjbb issu$ by
 ! ,(fice = ,civil ,rights ( !          
,dep>tm5t1 brea*es ( unsecur$ protect$  
heal? in=mation h increas$ #ajg p]c5t   
s9ce #bjah1 &1 9 #bjbb alone1 !         
,dep>tm5t receiv$ #fbf report$ brea*es  
affect+ n less ?an #ejj individuals at  
cov]$ entities or bus9ess associates 7z 
def9$ 9 section #afj4ajc ( title #de1   
,code ( ,f$]al ,regulations7 t occurr$  
or end$ 9 #bjbb1 ) ne>ly #db1jjj1jjj    
individuals affect$4  #d4 ,ag5cy        
coord9ation ) ! ,dep>tm5t  7a7 ,9 g5]al 
,! ,ag5cy %all coord9ate ) ! ,dep>tm5t  

to improve cyb]security 9 ! ,heal?c>e & 
,public ,heal? ,sector4  7b7 ,ag5cy     
liaison to ! ,dep>tm5t  7#a7 ,appo9tm5t 
,! ,director %all1 9 coord9ation ) !    
,secret>y1 appo9t an individual1 :o %all
 be an employee ( ! ,ag5cy or a detailee
 assign$ to ! ,adm9i/ration = ,/rategic 
,prep>$ness & ,response ,(fice ( !      
,dep>tm5t by ! ,director1 to s]ve z a   
liaison ( ! ,ag5cy to ! ,dep>tm5t1 :o   
%all-- 7,a7 h appropriate cyb]security  
qualifications & exp]tise2 &  7,b7      
report directly to ! ,director4  7#b7   
,responsibilities & duties ,! liaison   
appo9t$ "u p>agraph 7#a7 %all-- 7,a7    
s]ve z a prim>y contact ( ! ,dep>tm5t to
 coord9ate cyb]security issues ) !      
,ag5cy2  7,b7 support ! implem5tation & 
execution ( ! ,plan & assi/ 9 !         
developm5t ( updates to ! ,plan2  7,c7  
facilitate ! %>+ ( cyb] ?reat in=mation 
betwe5 ! ,dep>tm5t & ! ,ag5cy to improve
 und]/&+ ( cyb]security risks &         
situational aw>5ess ( cyb]security      
incid5ts2  7,d7 assi/ 9 implem5t+ !     

tra9+ describ$ 9 section #e2  7,e7      
facilitate coord9ation betwe5 ! ,ag5cy &
 ! ,dep>tm5t dur+ cyb]security incid5ts 
)9 ! ,heal?c>e & ,public ,heal? ,sector2
 &  7,f7 p]=m su* o!r duties z det]m9$  
necess>y by ! ,secret>y to a*ieve ! goal
 ( improv+ ! cyb]security ( ! ,heal?c>e 
& ,public ,heal? ,sector4  7#c7 ,report 
7,a7 ,requirem5t ,n lat] ?an #ah mon?s  
aft] ! date ( enactm5t ( ?is ,act1 !    
,secret>y1 9 coord9ation ) ! ,director1 
%all submit a report t describes !      
activities und]tak5 to improve          
cyb]security coord9ation betwe5 ! ,ag5cy
 & ! ,dep>tm5t to-- 7i7 ! ,committee on 
,heal?1 ,education1 ,labor1 & ,p5sions1 
! ,committee on ,f9ance1 & ! ,committee 
on ,homel& ,security & ,gov]nm5tal      
,affairs ( ! ,s5ate2 &  7ii7 !          
,committee on ,en]gy & ,comm]ce1 !      
,committee on ,ways & ,means1 & !       
,committee on ,homel& ,security ( !     
,h\se ( ,repres5tatives4  7,b7 ,cont5ts 
,! report submitt$ "u subp>agraph 7,a7  
%all include-- 7i7 a summ>y ( !         

activities ( ! liaison appo9t$ "u       
p>agraph 7#a72  7ii7 a description ( any
 *all5ges to ! effectiv5ess ( ! liaison 
appo9t$ "u p>agraph 7#a7 complet+ !     
requir$ duties ( ! liaison2 &  7iii7 a  
/udy ( ! feasibility ( an agreem5t to   
improve cyb]security 9 ! public sector (
 heal?c>e4  7c7 ,res\rces  7#a7 ,9 g5]al
 ,! ,ag5cy %all coord9ate ) & make      
res\rces available to ,in=mation ,%>+ & 
,analysis ,organizations1 in=mation %>+ 
& analysis c5t]s1 ! sector coord9at+    
c\ncils1 & non-,f$]al entities t are    
receiv+ in=mation %>$ ?r\gh programs    
manag$ by ! ,dep>tm5t4  7#b7 ,scope ,!  
coord9ation "u p>agraph 7#a7 %all       
include-- 7,a7 develop+ products        
specific to ! ne$s ( ,heal?c>e & ,public
 ,heal? ,sector entities2 &  7,b7 %>+   
in=mation relat+ to cyb] ?reat          
indicators & appropriate def5sive       
measures4  #e4 ,tra9+ = heal?c>e own]s &
 op]ators ,! ,ag5cy %all make available 
tra9+ to ! own]s & op]ators ( cov]$     
assets on-- 7#a7 cyb]security risks to !

 ,heal?c>e & ,public ,heal? ,sector &   
cov]$ assets2 &  7#b7 ways to mitigate !
 risks to in=mation sy/ems 9 ! ,heal?c>e
 & ,public ,heal? ,sector4  #f4         
,sector-specific risk managem5t plan    
7a7 ,9 g5]al ,n lat] ?an #a ye> aft] !  
date ( enactm5t ( ?is ,act1 ! ,secret>y1
 9 coord9ation ) ! ,director1 %all      
update ! ,plan1 :i* %all include !      
foll[+ elem5ts3 7#a7 ,an analysis ( h[  
id5tifi$ cyb]security risks specifically
 impact cov]$ assets1 includ+ ! impact  
on rural & small- & m$ium-siz$ cov]$    
assets4  7#b7 ,an evaluation ( !        
*all5ges ! own]s & op]ators ( cov]$     
assets face 9-- 7,a7 secur+-- 7i7 updat$
 in=mation sy/ems own$1 leas$1 or reli$ 
^u by cov]$ assets2  7ii7 m$ical devices
 or equipm5t own$1 leas$1 or reli$ ^u by
 cov]$ assets1 :i* %all include an      
analysis ( ! ?reat l&scape &            
cyb]security vuln]abilities ( su* m$ical
 devices or equipm5t2 &  7iii7 s5sitive 
pati5t heal? in=mation & electronic     
heal? records2  7,b7 implem5t+          

cyb]security protocols2 &  7,c7 respond+
 to data brea*es or cyb]security        
attacks1 includ+ ! impact on pati5t     
access to c>e1 quality ( pati5t c>e1    
timel9ess ( heal? c>e deliv]y1 & heal?  
outcomes4  7#c7 ,an evaluation ( ! be/  
practices = utilization ( res\rces f !  
,ag5cy to support cov]$ assets be=e1    
dur+1 & aft] data brea*es or            
cyb]security attacks1 su* z by ,cyb]    
,security ,advisors & ,cyb]security     
,/ate ,coord9ators ( ! ,ag5cy or o!r    
simil> res\rces4  7#d7 ,an assessm5t (  
relevant ,heal?c>e & ,public ,heal?     
,sector cyb]security work=ce %ortages1  
includ+-- 7,a7 tra9+1 recruitm5t1 &     
ret5tion issues2 &  7,b7 recomm5dations 
= h[ to address ^! %ortages & issues1   
p>ticul>ly at rural & small- &          
m$ium-siz$ cov]$ assets4  7#e7 ,an      
evaluation ( ! mo/ accessible & timely  
ways = ! ,ag5cy & ! ,dep>tm5t to        
communicate & deploy cyb]security       
recomm5dations & tools to ! own]s &     
op]ators ( cov]$ assets4  7b7           

,congressional brief+ ,n lat] ?an #abj  
days aft] ! date ( enactm5t ( ?is ,act1 
! ,secret>y1 9 consultation ) !         
,director1 %all provide a brief+ on !   
updat+ ( ! ,plan "u subsection 7a7 to-- 
7#a7 ! ,committee on ,heal?1 ,education1
 ,labor1 & ,p5sions1 ! ,committee on    
,f9ance1 & ! ,committee on ,homel&      
,security & ,gov]nm5tal ,affairs ( !    
,s5ate2 &  7#b7 ! ,committee on ,en]gy &
 ,comm]ce1 ! ,committee on ,ways &      
,means1 & ! ,committee on ,homel&       
,security ( ! ,h\se ( ,repres5tatives4  
#g4 ,id5tify+ high-risk cov]$ assets    
7a7 ,9 g5]al ,! ,secret>y1 9            
consultation ) ! ,director & heal?      
sector own]s & op]ators1 z appropriate1 
may e/abli% objective crit]ia = det]m9+ 
:e!r a cov]$ asset may be designat$ z a 
high-risk cov]$ asset1 provid$ t su*    
crit]ia %all align ) ! me?odology       
promulgat$ by ! ,director = id5tify+    
functions relat+ to critical            
infra/ructure1 z def9$ 9 section        
#ajaf7;e7 ( ! ,critical ,infra/ructures 

,protection ,act ( #bjja 7#db ,u4,s4,c4 
#eaie;c7e771 & associat$ risk           
assessm5ts4  7b7 ,li/ ( high-risk cov]$ 
assets  7#a7 ,9 g5]al ,! ,secret>y may  
develop a li/ (1 & notify1 ! own]s &    
op]ators ( ea* cov]$ asset det]m9$ to be
 a high-risk cov]$ asset us+ !          
me?odology promulgat$ by ! ,director    
pursuant to subsection 7a74  7#b7       
,biannual updat+ ,! ,secret>y may-- 7,a7
 biannually review & update ! li/ (     
high-risk cov]$ assets develop$ "u      
p>agraph 7#a72 &  7,b7 notify ! own]s & 
op]ators ( ea* cov]$ asset add$ to or   
remov$ f ! li/ z "p ( a review & update 
( ! li/ "u subp>agraph 7,a74  7#c7      
,notice to ,congress ,! ,secret>y %all  
notify ,congress :5 an initial li/ (    
high-risk cov]$ assets is develop$ "u   
p>agraph 7#a7 & ea* "t ! li/ is updat$  
"u p>agraph 7#b74  7#d7 ,use ,! li/     
develop$ & updat$ "u ?is subsection may 
be us$ by ! ,dep>tm5t to prioritize     
res\rce allocation to high-risk cov]$   
assets to bol/] cyb] resili5ce4  #h4    

,reports  7a7 ,report on ,assi/ance     
,provid$ to ,entities ( ,heal?c>e &     
,public ,heal? ,sector ,n lat] ?an #abj 
days aft] ! date ( enactm5t ( ?is ,act1 
! ,ag5cy %all submit to ,congress a     
report on ! organization-wide level (   
support & activities t ! ,ag5cy has     
provid$ to ! heal?c>e & public heal?    
sector to proactively prep>e ! sector to
 face cyb] ?reats & respond to cyb]     
attacks :5 su* ?reats or attacks occur4 
7b7 ,report on critical infra/ructure   
res\rces ,n lat] ?an #ah mon?s aft] !   
date ( enactm5t ( ?is ,act1 !           
,comptroll] ,g5]al ( ! ,unit$ ,/ates    
%all submit to ,congress a report on    
,f$]al res\rces available1 z ( ! date ( 
enactm5t ( ?is ,act1 = ! ,heal?c>e &    
,public ,heal? ,sector relat+ to        
critical infra/ructure1 z def9$ 9       
section #ajaf7;e7 ( ! ,critical         
,infra/ructures ,protection ,act ( #bjja
 7#db ,u4,s4,c4 #eaie;c7e771 includ+    
res\rces available f rec5t & ongo+      
collaboration ) ! ,director & !         

,secret>y4  #i4 ,rules ( con/ruction    
7a7 ,ag5cy actions ,no?+ 9 ?is ,act %all
 be con/ru$ to au?orize ! ,secret>y or  
,director to take an action t is n      
au?oriz$ by ?is ,act or exi/+ law4  7b7 
,protection ( rights ,no?+ 9 ?is ,act   
%all be con/ru$ to p]mit ! violation ( !
 rights ( any individual protect$ by !  
,con/itution ( ! ,unit$ ,/ates1 includ+ 
?r\gh c5sor%ip ( spee* protect$ by !    
,con/itution ( ! ,unit$ ,/ates or       
unau?oriz$ surveillance4  7c7 ,no       
additional funds ,no additional funds   
are au?oriz$ to be appropriat$ = !      
purpose ( c>ry+ out ?is ,act4  ,decemb] 
#i1 #bjbd,report$ ) an am5dm5t