,,ii #aaith ,,congress #ast ,session ,s4 #ccae ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,december #b1 #bjbe,mr4 ,cassidy 7for himself1 ,ms4 ,hassan1 ,mr4 ,cornyn1 and ,mr4 ,warner7 introduced the following bill2 which was read twice and referred to the ,committee on ,health1 ,education1 ,labor1 and ,pensions ,a ,,bill ,to require the ,secretary of ,health and ,human ,services and the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to coordinate to improve cybersecurity in the health care and public health sectors1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbe4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term ,agency means the ,cybersecurity and ,infrastructure ,security ,agency4 7#b7 ,cybersecurity incident ,the term cybersecurity incident has the meaning given the term incident in section #ceeb of title #dd1 ,united ,states ,code4 7#c7 ,cybersecurity ,state ,coordinator ,the term ,cybersecurity ,state ,coordinator means a ,cybersecurity ,state ,coordinator appointed under section #bbag7;a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;c7a774 7#d7 ,director ,the term ,director means the ,director of the ,agency4 7#e7 ,healthcare and ,public ,health ,sector ,the term ,healthcare and ,public ,health ,sector means the ,healthcare and ,public ,health sector1 as identified in ,presidential ,policy ,directive #ba 7,february #ab1 #bjac2 relating to critical infrastructure security and resilience74 7#f7 ,information ,sharing and ,analysis ,organization ,the term ,information ,sharing and ,analysis ,organization has the meaning given such term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#g7 ,information system ,the term information system has the meaning given such term in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7#h7 ,secretary ,the term ,secretary means the ,secretary of ,health and ,human ,services4 #c4 ,department coordination with the ,agency 7a7 ,in general ,the ,secretary and the ,director shall coordinate1 including by entering into a cooperative agreement1 as appropriate1 to improve cybersecurity in the ,healthcare and ,public ,health ,sector4 7b7 ,assistance 7#a7 ,in general ,the ,secretary shall coordinate with the ,director to make resources available to entities that are receiving information shared through programs managed by the ,director or the ,secretary1 including ,information ,sharing and ,analysis ,organizations1 information sharing and analysis centers1 and non-,federal entities4 7#b7 ,scope ,the coordination under paragraph 7#a7 shall include-- 7,a7 developing products specific to the needs of ,healthcare and ,public ,health ,sector entities2 and 7,b7 sharing information relating to cyber threat indicators and appropriate defensive measures4 #d4 ,clarifying cybersecurity responsibilities at the ,department of ,health and ,human ,services ,part ,a of title ,,iii of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bda et seq47 is amended by adding at the end the following3 #caj;,c4 ,oversight of cybersecurity activities ,the ,secretary1 acting through the ,assistant ,secretary for ,preparedness and ,response1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency pursuant to section #bbah of the ,homeland ,security ,act of #bjjb1 shall lead oversight and coordination of activities within the ,department of ,health and ,human ,services to support cybersecurity resiliency within the ,healthcare and ,public ,health ,sector 7as defined in section #b of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbe71 including coordination and communication with other public and private entities related to preparedness for1 and responses to1 cybersecurity incidents1 consistent with applicable provisions of this ,act1 other applicable laws1 and ,presidential ,policy ,directive #ba 7,february #ab1 #bjac2 relating to critical infrastructure security and resilience74 4 #e4 ,cybersecurity incident response plan ,section #dje of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aecc7 is amended-- 7#a7 in subsection 7a7-- 7,a7 in paragraph 7#d7-- 7i7 in the paragraph heading1 by inserting information system2 after ,federal entity22 and 7ii7 by inserting information system1 after ,federal entity12 7,b7 by redesignating paragraphs 7#d7 through 7#g7 as paragraphs 7#f7 through 7#i71 respectively2 and 7,c7 by inserting after paragraph 7#c7 the following3 7#d7 ,cybersecurity incident ,the term cybersecurity incident has the meaning given the term incident in section #ceeb of title #dd1 ,united ,states ,code4 7#e7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given such term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 2 and 7#b7 in subsection 7d71 by adding at the end the following3 7#d7 ,plan 7,a7 ,in general ,not later than #a year after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbe1 the ,secretary shall develop and implement a cybersecurity incident response plan to inform applicable personnel within the ,department of ,health and ,human ,services of processes and protocols to prepare for1 and respond to1 cybersecurity incidents involving information1 including hardware1 software1 databases1 and networks1 used or maintained by1 or on behalf of1 the ,department1 including strategies-- 7i7 to assess cybersecurity risks2 7ii7 to prevent cybersecurity incidents2 7iii7 to detect and identify cybersecurity incidents2 7iv7 to minimize damage in the event of a cybersecurity incident2 7v7 to protect data2 and 7vi7 to recover from any cybersecurity incidents expeditiously4 7,b7 ,consultation ,in developing the plan under subparagraph 7,a71 the ,secretary shall consult with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,director of the ,office of ,management and ,budget1 and the ,director of the ,national ,institute of ,standards and ,technology1 and relevant experts1 as appropriate4 7,c7 ,report ,not later than #fj days before the date on which the ,secretary begins implementing the plan under subparagraph 7,a71 the ,secretary shall submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,energy and ,commerce1 the ,committee on ,oversight and ,reform1 and the ,committee on ,homeland ,security of the ,house of ,representatives a report that describes such plan4 4 #f4 ,breach reporting portal 7a7 ,updates to breach reporting portal ,section #acdjb of the ,,hitech ,act 7#db ,u4,s4,c4 #agicb7 is amended by adding at the end the following3 7k7 ,updates to regulations ,not later than #a year after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbe1 the ,secretary shall update the regulations promulgated pursuant to subsection 7j7 to require that information required to be publicly displayed in the breach reporting portal established pursuant to this section includes-- 7#a7 information on any corrective action taken against a covered entity that provided notification of a breach under this section2 7#b7 information on whether and to what extent1 as appropriate1 recognized security practices 7as defined in section #acdab7;b77#a77 were considered in the investigation of such a breach2 and 7#c7 such additional information about such a breach as the ,secretary may require4 4 #g4 ,clarifying breach reporting obligations ,section #acdjb7;f7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agicb7;f77 is amended by adding at the end the following3 7#f7 ,the number of individuals affected by the breach4 4 #h4 ,enhancing recognition of security practices 7a7 ,recognized security practices ,section #acdab7;b77#a7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agida7;b77#a77 is amended1 in the first sentence1 by inserting 1 investments1 after other programs4 7b7 ,guidance ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall issue guidance on the implementation of section #acdab of the ,,hitech ,act 7#db ,u4,s4,c4 #agida71 which shall include-- 7#a7 recognized security practices 7as defined in subsection 7b77#a7 of such section7 that the ,secretary may consider when determining fines under such section2 7#b7 the extent to which such recognized security practices should be in place for consideration by the ,secretary2 and 7#c7 procedural requirements or information that shall be submitted by a covered entity or business associate 7as such terms are defined in section #acdjj of the ,,hitech ,act 7#db ,u4,s4,c4 #agiba77 to the ,secretary for consideration4 7c7 ,annual report ,not later than #b years after the date of enactment of this ,act1 and annually thereafter1 the ,secretary shall include in the annual report required under section #acdbd7;a7 of the ,,hitech ,act 7#db ,u4,s4,c4 #agiec7;a77 information on implementation of section #acdab of such ,act 7#db ,u4,s4,c4 #agida71 including an accounting of every case in which the ,secretary considered recognized security practices 7as defined in subsection 7b77#a7 of such section7 when effectuating audits and assessing fines under such section4 #i4 ,required cybersecurity standards 7a7 ,in general ,the ,secretary shall update the privacy1 security1 and breach notification regulations under parts #afj and #afd of title #de1 ,code of ,federal ,regulations 7or any successor regulation7 to require covered entities and business associates to adopt the following cybersecurity practices3 7#a7 ,multifactor authentication1 or a successor technology1 for access to any information systems that may include protected health information4 7#b7 ,safeguards to encrypt protected health information4 7#c7 ,requirements to conduct audits1 including penetration testing1 to maintain the protections of information systems4 7#d7 ,other minimum cybersecurity standards1 as determined by the ,secretary1 in consultation with private sector entities1 based on landscape analysis of emerging and existing cybersecurity vulnerabilities and consensus-based best practices4 7b7 ,effective dates ,the ,secretary shall specify in the regulations the effective date for each of the new requirements under the regulations updated in accordance with subsection 7a74 ,each such effective date shall provide reasonable time for the entities subject to the requirement to come into compliance4 #aj4 ,guidance on rural cybersecurity readiness ,section #dje7;d7 of the ,cybersecurity ,act of #bjae 7#f ,u4,s4,c4 #aecc7;d77 7as amended by section #e7b77 is amended by adding at the end the following3 7#e7 ,rural cybersecurity guidance 7,a7 ,definition of rural ,in this paragraph1 the term rural has the meaning given such term by the ,health ,resources and ,services ,administration4 7,b7 ,guidance on rural cybersecurity readiness ,not later than #a year after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbe1 the ,secretary shall issue guidance to rural entities on best practices to improve cyber readiness1 including strategies-- 7i7 to improve cyber infrastructure1 including any technical safeguards to mitigate cybersecurity risk2 7ii7 to integrate best practices issued by the ,secretary to improve cybersecurity preparedness2 7iii7 to improve employee preparation to mitigate any cybersecurity risks1 including existing public-private programs to support educational initiatives2 and 7iv7 to implement policies to facilitate mandatory cybersecurity incident reporting requirements under law4 7,c7 ,,gao study and report 7i7 ,in general ,not later than #c years after the date of enactment of the ,health ,care ,cybersecurity and ,resiliency ,act of #bjbe1 the ,comptroller ,general of the ,united ,states shall conduct1 and submit to the ,committee on ,health1 ,education1 ,labor1 and ,pensions of the ,senate and the ,committee on ,energy and ,commerce of the ,house of ,representatives a report that describes the results of1 a study to examine how rural entities have implemented the recommendations included in the guidance under subparagraph 7,b74 7ii7 ,requirements ,the study under clause 7i7 shall assess-- 7,i7 how rural entities have implemented any technical safeguards and any challenges faced by such rural entities in areas for which safeguards were not implemented2 7,,ii7 steps to further support cyber resilience for rural entities2 7,,iii7 areas to improve coordination between ,federal agencies1 including for the purposes of required cyber reporting2 and 7,,iv7 any opportunities to support public-private collaboration in the area of cyber readiness4 4 #aa4 ,grants to enhance cybersecurity in the health and public health sectors ,part ,p of title ,,iii of the ,public ,health ,service ,act 7#db ,u4,s4,c4 #bhj;g et seq47 is amended by adding at the end the following3 #cii,v-#h4 ,grants 7a7 ,in general ,the ,secretary may award grants to eligible entities for the adoption and use of cybersecurity best practices4 7b7 ,eligible entity ,to be eligible to receive a grant under subsection 7a7 an entity shall be-- 7#a7 a public or nonprofit private health center 7including a ,federally qualified health center 7as defined in section #ahfa7;aa77#d7 of the ,social ,security ,act772 7#b7 a health facility operated by or pursuant to a contract with the ,indian ,health ,service2 7#c7 a hospital2 7#d7 a cancer center2 7#e7 a rural health clinic2 7#f7 an academic health center2 or 7#g7 a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs 7#a7 through 7#f74 7c7 ,use of funds ,in adopting and using cybersecurity best practices pursuant to a grant under subsection 7a71 an eligible entity may use grant funds-- 7#a7 to hire and train personnel in such cybersecurity best practices2 7#b7 to update electronic data systems1 such as by migrating to cloud based platforms2 7#c7 to join and participate in health cybersecurity threat information sharing organizations2 7#d7 to reduce the use of legacy systems2 and 7#e7 to contract with third parties to assist with the activities described in paragraphs 7#a7 through 7#e74 7d7 ,grant period ,the ,secretary may award a grant under this section for a period of not more than #c years4 7e7 ,application ,an eligible entity seeking a grant under subsection 7a7 shall submit to the ,secretary an application at such time1 in such manner1 and containing such information as the ,secretary may require including1 at a minimum a description of how the eligible entity will establish baseline measures and benchmarks that meet the ,secretary's requirements to evaluate program outcomes4 7f7 ,authorization of appropriations ,there are authorized to be appropriated to carry out this section such sums as may be necessary for each of fiscal years #bjbe through #bjcj4 4 #ab4 ,healthcare cybersecurity workforce 7a7 ,training for healthcare experts ,the ,secretary1 in coordination with the ,cybersecurity ,state ,coordinators of the ,agency and private sector health care experts1 as appropriate1 shall provide training to ,healthcare and ,public ,health ,sector asset owners and operators on-- 7#a7 cybersecurity risks to information systems within the ,healthcare and ,public ,health ,sector2 and 7#b7 ways to mitigate the risks to information systems in the ,healthcare and ,public ,health ,sector4 7b7 ,cross-,agency educational tools 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary1 acting through the ,administrator of the ,health ,resources and ,services ,administration1 in coordination with the ,agency1 shall develop a strategic plan to support growing the cybersecurity workforce for health care entities4 7#b7 ,inclusions ,the strategic plan under paragraph 7#a7 shall include-- 7,a7 recommendations for existing educational programs that can be used to support cybersecurity training2 7,b7 dissemination and development of educational materials on how to improve cybersecurity resilience2 7,c7 development of best practices to train the health care workforce on cybersecurity best practices2 and 7,d7 opportunities for public-private collaboration to strengthen the cybersecurity workforce4