#aaith ,,congress #b;d ,session ,s4 #ccae ,,an ,,act ,to require the ,secretary of ,health and ,human ,services and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to coordinate to improve cybersecurity in the health care and public health sectors1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbf4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency4 7#b7 ,business associate ,the term business associate has the meaning given such term in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or a successor regulation74 7#c7 ,covered entity ,the term covered entity has the meaning given such term in section #afj4ajc of title #de1 ,code of ,federal ,regulations 7or a successor regulation74 7#d7 ,cybersecurity incident ,the term cybersecurity incident has the meaning given the term incident in section #ceeb of title #dd1 ,united ,states ,code4 7#e7 ,cybersecurity ,state ,coordinator ,the term ,cybersecurity ,state ,coordinator means a ,cybersecurity ,state ,coordinator appointed under section #bbag7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;c7a774 7#f7 ,director ,the term ,director means the ,director of the ,agency4 7#g7 ,healthcare and ,public ,health ,sector ,the term ,healthcare and ,public ,health ,sector means the ,healthcare and ,public ,health sector1 as identified in ,national ,security ,memorandum-#bb 7,april #cj1 #bjbd2 relating to critical infrastructure security and resilience74 7#h7 ,information ,sharing and ,analysis ,organization ,the term ,information ,sharing and ,analysis ,organization has the meaning given such term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#i7 ,information system ,the term information system has the meaning given such term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#aj7 ,recognized security practices ,the term recognized security practices has the meaning given such term in section #acdab7;b77#a7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agida7;b77#a774 7#aa7 ,secretary ,the term ,secretary means the ,secretary of ,health and ,human ,services4 #c4 ,department coordination with the ,agency 7a7 ,in general ,the ,secretary and the ,director shall coordinate1 including by entering into a cooperative agreement1 as appropriate1 to improve cybersecurity in the ,healthcare and ,public ,health ,sector4 7b7 ,assistance 7#a7 ,in general ,the ,secretary shall coordinate with the ,director to make resources available to entities that are receiving information shared through programs managed by the ,director or the ,secretary1 including ,information ,sharing and ,analysis ,organizations1 sector coordinating councils1 and non-,federal entities4 7#b7 ,scope ,the coordination under paragraph 7#a7 shall include-- 7,a7 developing products specific to the needs of ,healthcare and ,public ,health ,sector entities2 7,b7 sharing information relating to cyber threat indicators and appropriate defensive measures1 including automating cyber threat information sharing1 in a manner that adequately protects against unauthorized access or disclosure2 and 7,c7 providing technical assistance to covered entities and business associates to improve cybersecurity preparedness4 7c7 ,joint cybersecurity planning 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary and the ,director shall establish a joint cybersecurity capability plan to coordinate responses to significant cybersecurity incidents affecting the ,healthcare and ,public ,health ,sector4 7#b7 ,elements ,the joint cybersecurity capability plan established under paragraph 7#a7 shall include-- 7,a7 protocols for rapid information sharing during sector-wide cybersecurity incidents2 7,b7 coordination mechanisms with the sector coordinating council for the ,healthcare and ,public ,health ,sector2 and 7,c7 coordination with ,cybersecurity ,state ,coordinators for incidents affecting multiple ,states4 7#c7 ,submission to ,congress 7,a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives the final joint cybersecurity capability plan prepared under paragraph 7#a7 and a description of how such plan implements the elements required under paragraph 7#b74 7,b7 ,updates ,if the ,secretary and the ,director update the joint cybersecurity capability plan required under this subsection1 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives such updated plan and a description of how such plan implements the elements required under paragraph 7#b74 #d4 ,clarifying cybersecurity responsibilities at the ,department of ,health and ,human ,services 7a7 ,in general ,the ,secretary shall delegate a representative to lead oversight and coordination of activities within the ,department of ,health and ,human ,services to support internal and external cybersecurity resilience within the ,healthcare and ,public ,health ,sector1 including coordination and communication with other public and private entities related to preparedness for1 and responses to1 cybersecurity incidents1 consistent with applicable provisions of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bja et seq471 other applicable laws1 and ,national ,security ,memorandum-#bb 7,april #cj1 #bjbd2 relating to critical infrastructure security and resilience74 ,such activities shall not include implementation or enforcement of part #afj and subparts ,a and ,c of part #afd of title #de1 ,code of ,federal ,regulations 7or successor regulations7 7commonly known as the ,,hipaa ,security ,rule74 7b7 ,reports 7#a7 ,report on delegation ,not later than #fj days after delegating a representative under subsection 7a71 and any time a new representative is delegated under such subsection1 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that describes how such representative will implement steps to improve internal and external cybersecurity resilience within the ,healthcare and ,public ,health ,sector4 7#b7 ,annual report ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report on the state of cybersecurity in the ,healthcare and ,public ,health ,sector1 including-- 7,a7 an assessment of the most significant cybersecurity threats and vulnerabilities facing the ,healthcare and ,public ,health ,sector2 7,b7 a summary of major cybersecurity incidents affecting the ,healthcare and ,public ,health ,sector during the preceding year2 7,c7 an assessment of the overall cybersecurity posture of the ,healthcare and ,public ,health ,sector2 7,d7 a description of actions taken by the ,department of ,health and ,human ,services to improve cybersecurity2 and 7,e7 recommendations to improve ,healthcare and ,public ,health ,sector cybersecurity4 #e4 ,cybersecurity incident response plan ,section #dje of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aecc7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in paragraph 7#d7-- 7i7 in the paragraph heading1 by inserting information system2 after federal entity22 and 7ii7 by inserting information system1 after ,federal entity12 7,b7 by redesignating paragraphs 7#d7 through 7#g7 as paragraphs 7#f7 through 7#i71 respectively2 and 7,c7 by inserting after paragraph 7#c7 the following3 7#d7 ,cybersecurity incident ,the term cybersecurity incident has the meaning given the term incident in section #ceeb of title #dd1 ,united ,states ,code4 7#e7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given such term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 2 and 7#b7 in subsection 7d71 by adding at the end the following3 7#d7 ,plan 7,a7 ,in general ,not later than #a year after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbf1 the ,secretary shall expand and implement the ,cyber ,annex of the ,all ,hazards ,plan of the ,department of ,health and ,human ,services to inform applicable personnel within the ,department of ,health and ,human ,services of processes and protocols to prepare for1 and respond to1 cybersecurity incidents4 7,b7 ,scope ,the plan under subparagraph 7,a7 shall address cybersecurity incidents involving information systems1 including hardware1 software1 databases1 and networks1 used or maintained by1 or on behalf of1 the ,department4 7,c7 ,elements ,the plan under subparagraph 7,a7 shall include strategies-- 7i7 to assess cybersecurity risks2 7ii7 to prevent cybersecurity incidents2 7iii7 to detect and identify cybersecurity incidents2 7iv7 to minimize damage in the event of a cybersecurity incident2 7v7 to protect data2 7vi7 to recover from any cybersecurity incidents expeditiously2 and 7vii7 to communicate and share non-sensitive information about cybersecurity incidents with entities in the ,healthcare and ,public ,health ,sector 7as defined in section #b of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbf74 7,d7 ,consultation ,in developing the plan under subparagraph 7,a71 the ,secretary shall consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,director of the ,office of ,management and ,budget1 the ,director of the ,national ,institute of ,standards and ,technology1 and relevant experts1 as appropriate4 7,e7 ,updates ,the ,secretary shall review and update the plan under subparagraph 7,a7-- 7i7 not less frequently than once every #b years2 and 7ii7 after any significant cybersecurity incident affecting the ,department of ,health and ,human ,services or a ,federal health program4 7,f7 ,report ,not later than #fj days before the date on which the ,secretary begins implementing the plan under subparagraph 7,a71 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,energy and ,commerce1 the ,committee on ,oversight and ,reform1 and the ,committee on ,homeland ,security of the ,house of ,representatives a report that describes such plan4 4 #f4 ,clarifying breach reporting obligations ,section #acdjb7;f7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agicb7;f77 is amended by adding at the end the following3 7#f7 ,the number of individuals affected by the breach4 4 #g4 ,enhancing recognition of security practices 7a7 ,recognized security practices ,section #acdab7;b77#a7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agida7;b77#a77 is amended1 in the first sentence1 by inserting 1 investments1 after other programs4 7b7 ,regulation ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall promulgate regulations implementing section #acdab of the ,,hitech ,act 7#db ,u4,s4,c4 #agida71 which shall include-- 7#a7 recognized security practices that the ,secretary may consider when determining fines under such section2 7#b7 the extent to which such recognized security practices should be in place for consideration by the ,secretary2 7#c7 procedural requirements or information that shall be submitted by a covered entity or business associate to the ,secretary for consideration2 and 7#d7 how the ,secretary will take into account such recognized security practices when determining fines1 earlier favorable termination of audits1 or mitigating remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of part #afj and subparts ,a and ,c of part #afd of title #de1 ,code of ,federal ,regulations 7or successor regulations7 7commonly known as the ,,hipaa ,security ,rule7 between the covered entity or business associate and the ,department of ,health and ,human ,services4 7c7 ,annual report ,not later than #b years after the date of enactment of this ,act1 and annually thereafter1 the ,secretary shall include in the annual report required under section #acdbd7;a7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agiec7;a77 information on implementation of section #acdab of such ,act 7#db ,u4,s4,c4 #agida71 including an accounting of every case in which the ,secretary considered recognized security practices when effectuating audits and assessing fines under such section4 #h4 ,required cybersecurity standards 7a7 ,in general ,the ,secretary shall update the security regulations under part #afj and subparts ,a and ,c of part #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulation71 to require non-governmental entities in the ,healthcare and ,public ,health ,sector and covered entities and business associates to adopt minimum risk-based cybersecurity practices1 including-- 7#a7 multifactor authentication1 or a successor technology2 7#b7 encryption of protected health information1 or a successor technology2 7#c7 requirements to conduct monitoring1 including penetration testing1 to maintain the protections of information systems2 and 7#d7 other minimum cybersecurity standards1 as reflected in national cybersecurity frameworks4 7b7 ,requirements ,the minimum risk-based cybersecurity practices adopted pursuant to subsection 7a7 shall be based on-- 7#a7 national cybersecurity frameworks1 as appropriate1 such as-- 7,a7 the ,national ,institute of ,standards and ,technology ,risk ,management ,framework 7or a successor framework72 7,b7 the ,national ,institute of ,standards and ,technology ,cybersecurity ,framework 7or a successor framework72 7,c7 the ,national ,institute of ,standards and ,technology ,,sp #hjj-ec r#e ,security and ,privacy ,controls for ,information ,systems and ,organizations 7or a successor special publication71 with relevant components of the ,national ,institute of ,standards and ,technology ,privacy ,framework2 or 7,d7 the ,national ,institute of ,standards and ,technology ,artificial ,intelligence ,risk ,management ,framework2 7#b7 the ,health ,sector ,coordinating ,council ,cybersecurity ,healthcare and ,public ,health ,cybersecurity ,performance ,goals2 and 7#c7 the health care-specific cybersecurity performance goals of the ,cybersecurity and ,infrastructure ,security ,agency4 7c7 ,effective dates ,the regulations updated in accordance with subsection 7a71 including each new requirement established1 shall take effect on the date that is #cf months after the date of enactment of this ,act4 7d7 ,enforcement ,the ,secretary may exercise enforcement discretion for entities experiencing extraordinary circumstances in complying with the requirements of subsection 7a74 #i4 ,guidance on rural cybersecurity readiness ,section #dje7;d7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aecc7;d77 7as amended by section #e7b77 is amended by adding at the end the following3 7#e7 ,rural cybersecurity guidance 7,a7 ,definition of rural ,in this paragraph1 the term rural has the meaning given such term by the ,federal ,office of ,rural ,health ,policy4 7,b7 ,guidance on rural cybersecurity readiness ,not later than #a year after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbf1 the ,secretary shall issue guidance to rural entities on best practices to improve cybersecurity readiness1 including strategies-- 7i7 to improve cybersecurity infrastructure1 including any technical safeguards to mitigate cybersecurity risk2 7ii7 to integrate best practices issued by the ,secretary to improve cybersecurity preparedness2 7iii7 to improve workforce preparation to mitigate any cybersecurity risks1 including existing public-private programs to support educational initiatives2 7iv7 to implement policies to facilitate mandatory cybersecurity incident reporting requirements under law2 and 7v7 to explore and recommend best practices1 including-- 7,i7 outsourcing information technology and chief information security officer functions to third parties on a part-time basis2 7,,ii7 participating in regional rural health care information technology management sharing programs2 and 7,,iii7 migrating data to secure cloud-based platforms4 7,c7 ,technical assistance ,the ,secretary shall provide technical assistance to rural entities to implement the recommendations included in the guidance under subparagraph 7,b74 7,d7 ,,gao study and report 7i7 ,in general ,not later than #c years after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbf1 the ,comptroller ,general of the ,united ,states shall conduct a study1 and submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report1 on how rural entities have implemented the recommendations included in the guidance under subparagraph 7,b74 7ii7 ,contents ,the study under clause 7i7 shall assess-- 7,i7 how rural entities have implemented any technical safeguards and any challenges faced by such rural entities in areas for which safeguards were not implemented2 7,,ii7 steps to further support cybersecurity resilience for rural entities2 7,,iii7 areas to improve coordination between ,federal agencies1 including for the purposes of required cyber reporting2 and 7,,iv7 any opportunities to support public-private collaboration in the area of cybersecurity readiness4 4 #aj4 ,grants to enhance cybersecurity in the health and public health sectors 7a7 ,in general ,the ,secretary may award grants to eligible entities for the adoption and implementation of cybersecurity best practices4 7b7 ,eligible entity ,to be eligible to receive a grant under subsection 7a71 an entity shall be-- 7#a7 a ,federally qualified health center 7as defined in section #ahfa7;aa77#d7 of the ,social ,security ,act 7#db ,u4,s4,c4 #aciex7aa77#d7772 7#b7 a health facility operated by or pursuant to a contract with the ,indian ,health ,service2 7#c7 a nonprofit hospital2 7#d7 a rural health clinic 7as defined in section #ahfa7;aa77#b7 of the ,social ,security ,act 7#db ,u4,s4,c4 #aciex7aa77#b7772 or 7#e7 a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs 7#a7 through 7#d74 7c7 ,use of funds ,in adopting and implementing cybersecurity best practices pursuant to a grant under subsection 7a71 an eligible entity may use grant funds-- 7#a7 to hire individuals with demonstrated cybersecurity expertise and train personnel in such cybersecurity best practices2 7#b7 to update electronic data systems1 such as by migrating to cloud-based platforms2 7#c7 to join and participate in health cybersecurity threat information sharing organizations2 7#d7 to contract with third parties to assist the eligible entity in carrying out the activities described in this subsection2 7#e7 to conduct cybersecurity risk assessments and vulnerability assessments2 and 7#f7 to develop or improve cybersecurity incident response plans4 7d7 ,grant period ,a grant awarded under this section shall be for a period of not more than #c years4 7e7 ,priority ,in awarding grants under this section1 the ,secretary may give consideration to the demonstrated need of eligible entities4 7f7 ,application ,an eligible entity seeking a grant under subsection 7a7 shall submit to the ,secretary an application at such time1 in such manner1 and containing such information as the ,secretary may require1 including-- 7#a7 a description of how the eligible entity will establish baseline measures and benchmarks that meet the ,secretary's requirements to evaluate performance outcomes2 and 7#b7 a strategic plan for how1 after the end of the grant period1 the eligible entity will sustain the activities funded under the grant and continue to adopt cybersecurity best practices4 #aa4 ,healthcare cybersecurity workforce 7a7 ,training for healthcare experts ,the ,secretary1 in coordination with the ,cybersecurity ,state ,coordinators of the ,agency1 the ,office of the ,national ,cyber ,director1 and private sector health care experts1 as appropriate1 shall provide training to ,healthcare and ,public ,health ,sector entities on-- 7#a7 cybersecurity risks to information systems within the ,healthcare and ,public ,health ,sector2 and 7#b7 ways to mitigate the risks to information systems in the ,healthcare and ,public ,health ,sector4 7b7 ,strategic plan 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary1 acting through the ,administrator of the ,health ,resources and ,services ,administration1 in coordination with the ,agency1 shall develop a strategic plan to support growing the cybersecurity workforce for health care entities4 7#b7 ,contents ,the strategic plan under paragraph 7#a7 shall include-- 7,a7 recommendations for existing educational programs that can be used to support cybersecurity training2 7,b7 dissemination and development of educational materials on how to improve cybersecurity resilience2 7,c7 development of best practices to train the health care workforce on cybersecurity best practices2 7,d7 development of recommendations specific to rural facilities2 7,e7 development of best practices to leverage artificial intelligence to support cybersecurity preparedness2 7,f7 opportunities for public-private collaboration to strengthen the cybersecurity workforce2 and 7,g7 alignment with the ,national ,initiative for ,cybersecurity ,education ,workforce ,framework4 #ab4 ,cybersecurity incident reporting coordination working group 7a7 ,working group 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall convene a working group to examine how to streamline and reduce duplicative reporting for cybersecurity incidents4 7#b7 ,membership ,the working group described in paragraph 7#a7 shall include representatives of-- 7,a7 the ,cybersecurity and ,infrastructure ,security ,agency2 7,b7 the ,securities and ,exchange ,commission2 7,c7 the ,office of the ,national ,cyber ,director2 7,d7 the ,federal ,bureau of ,investigation2 7,e7 the ,federal ,trade ,commission2 7,f7 ,state attorneys general2 7,g7 ,state health departments2 and 7,h7 private sector health care entities4 7#c7 ,conclusion ,the working group shall conclude not later than #ah months after the date of the first meeting of the working group4 7b7 ,report ,not later than #a year after the conclusion of the working group under subsection 7a77#c71 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that-- 7#a7 identifies areas the working group has identified to streamline and reduce duplicative reporting2 7#b7 includes recommendations to ,congress on further streamlining such reporting2 and 7#c7 addresses coordination with ,state breach notification laws4 ,passed the ,senate ,september #cj1 #bjbf4,secretary