S1851-119

1. Short title This Act may be cited as the Healthcare Cybersecurity Act of 2025.

2. Definitions In this Act— the term Agency means the Cybersecurity and Infrastructure Security Agency; the term covered asset means a Healthcare and Public Health Sector asset, including technologies, services, and utilities; the term Cybersecurity State Coordinator means a Cybersecurity State Coordinator appointed under section 2217(a) of the Homeland Security Act of 2002 (6 U.S.C. 665c(a)); the term Department means the Department of Health and Human Services; the term Director means the Director of the Agency; the term Healthcare and Public Health Sector means the Healthcare and Public Health sector, as identified in the National Security Memorandum on Critical Infrastructure and Resilience (NSM–22), issued April 30, 2024; the term Information Sharing and Analysis Organizations has the meaning given the term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650); the term Plan means the Healthcare and Public Health Sector-specific Risk Management Plan; and the term Secretary means the Secretary of Health and Human Services.

3. Findings Congress finds the following: Covered assets are increasingly the targets of malicious cyberattacks, which result not only in data breaches but also increased healthcare delivery costs and can ultimately affect patient health outcomes. Data reported to the Department shows that large cyber breaches of the information systems of healthcare facilities rose 93 percent between 2018 and 2022. According to the Annual Report to Congress on Breaches of Unsecured Protected Health Information for Calendar Year 2022 issued by the Office for Civil Rights of the Department, breaches of unsecured protected health information have increased 107 percent since 2018, and, in 2022 alone, the Department received 626 reported breaches affecting not fewer than 500 individuals at covered entities or business associates (as defined in section 160.103 of title 45, Code of Federal Regulations) that occurred or ended in 2022, with nearly 42,000,000 individuals affected.

4. Agency coordination with the Department The Agency shall coordinate with the Department to improve cybersecurity in the Healthcare and Public Health Sector. The Director shall, in coordination with the Secretary, appoint an individual, who shall be an employee of the Agency or a detailee assigned to the Administration for Strategic Preparedness and Response Office of the Department by the Director, to serve as a liaison of the Agency to the Department, who shall— have appropriate cybersecurity qualifications and expertise; and report directly to the Director. The liaison appointed under paragraph (1) shall— serve as a primary contact of the Department to coordinate cybersecurity issues with the Agency; support the implementation and execution of the Plan and assist in the development of updates to the Plan; facilitate the sharing of cyber threat information between the Department and the Agency to improve understanding of cybersecurity risks and situational awareness of cybersecurity incidents; assist in implementing the training described in section 5; facilitate coordination between the Agency and the Department during cybersecurity incidents within the Healthcare and Public Health Sector; and perform such other duties as determined necessary by the Secretary to achieve the goal of improving the cybersecurity of the Healthcare and Public Health Sector. Not later than 18 months after the date of enactment of this Act, the Secretary, in coordination with the Director, shall submit a report that describes the activities undertaken to improve cybersecurity coordination between the Agency and the Department to— the Committee on Health, Education, Labor, and Pensions, the Committee on Finance, and the Committee on Homeland Security and Governmental Affairs of the Senate; and the Committee on Energy and Commerce, the Committee on Ways and Means, and the Committee on Homeland Security of the House of Representatives. The report submitted under subparagraph (A) shall include— a summary of the activities of the liaison appointed under paragraph (1); a description of any challenges to the effectiveness of the liaison appointed under paragraph (1) completing the required duties of the liaison; and a study of the feasibility of an agreement to improve cybersecurity in the public sector of healthcare. The Agency shall coordinate with and make resources available to Information Sharing and Analysis Organizations, information sharing and analysis centers, the sector coordinating councils, and non-Federal entities that are receiving information shared through programs managed by the Department. The coordination under paragraph (1) shall include— developing products specific to the needs of Healthcare and Public Health Sector entities; and sharing information relating to cyber threat indicators and appropriate defensive measures.

5. Training for healthcare owners and operators The Agency shall make available training to the owners and operators of covered assets on— cybersecurity risks to the Healthcare and Public Health Sector and covered assets; and ways to mitigate the risks to information systems in the Healthcare and Public Health Sector.

6. Sector-specific risk management plan Not later than 1 year after the date of enactment of this Act, the Secretary, in coordination with the Director, shall update the Plan, which shall include the following elements: An analysis of how identified cybersecurity risks specifically impact covered assets, including the impact on rural and small- and medium-sized covered assets. An evaluation of the challenges the owners and operators of covered assets face in— securing— updated information systems owned, leased, or relied upon by covered assets; medical devices or equipment owned, leased, or relied upon by covered assets, which shall include an analysis of the threat landscape and cybersecurity vulnerabilities of such medical devices or equipment; and sensitive patient health information and electronic health records; implementing cybersecurity protocols; and responding to data breaches or cybersecurity attacks, including the impact on patient access to care, quality of patient care, timeliness of health care delivery, and health outcomes. An evaluation of the best practices for utilization of resources from the Agency to support covered assets before, during, and after data breaches or cybersecurity attacks, such as by Cyber Security Advisors and Cybersecurity State Coordinators of the Agency or other similar resources. An assessment of relevant Healthcare and Public Health Sector cybersecurity workforce shortages, including— training, recruitment, and retention issues; and recommendations for how to address these shortages and issues, particularly at rural and small- and medium-sized covered assets. An evaluation of the most accessible and timely ways for the Agency and the Department to communicate and deploy cybersecurity recommendations and tools to the owners and operators of covered assets. Not later than 120 days after the date of enactment of this Act, the Secretary, in consultation with the Director, shall provide a briefing on the updating of the Plan under subsection (a) to— the Committee on Health, Education, Labor, and Pensions, the Committee on Finance, and the Committee on Homeland Security and Governmental Affairs of the Senate; and the Committee on Energy and Commerce, the Committee on Ways and Means, and the Committee on Homeland Security of the House of Representatives.

7. Identifying high-risk covered assets The Secretary, in consultation with the Director and health sector owners and operators, as appropriate, may establish objective criteria for determining whether a covered asset may be designated as a high-risk covered asset, provided that such criteria shall align with the methodology promulgated by the Director for identifying functions relating to critical infrastructure, as defined in section 1016(e) of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c(e)), and associated risk assessments. The Secretary may develop a list of, and notify, the owners and operators of each covered asset determined to be a high-risk covered asset using the methodology promulgated by the Director pursuant to subsection (a). The Secretary may— biannually review and update the list of high-risk covered assets developed under paragraph (1); and notify the owners and operators of each covered asset added to or removed from the list as part of a review and update of the list under subparagraph (A). The Secretary shall notify Congress when an initial list of high-risk covered assets is developed under paragraph (1) and each time the list is updated under paragraph (2). The list developed and updated under this subsection may be used by the Department to prioritize resource allocation to high-risk covered assets to bolster cyber resilience.

8. Reports Not later than 120 days after the date of enactment of this Act, the Agency shall submit to Congress a report on the organization-wide level of support and activities that the Agency has provided to the healthcare and public health sector to proactively prepare the sector to face cyber threats and respond to cyber attacks when such threats or attacks occur. Not later than 18 months after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report on Federal resources available, as of the date of enactment of this Act, for the Healthcare and Public Health Sector relating to critical infrastructure, as defined in section 1016(e) of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c(e)), including resources available from recent and ongoing collaboration with the Director and the Secretary.

9. Rules of construction Nothing in this Act shall be construed to authorize the Secretary or Director to take an action that is not authorized by this Act or existing law. Nothing in this Act shall be construed to permit the violation of the rights of any individual protected by the Constitution of the United States, including through censorship of speech protected by the Constitution of the United States or unauthorized surveillance. No additional funds are authorized to be appropriated for the purpose of carrying out this Act.