No official summary available for this bill.
[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 10455 Introduced in House (IH)]
<DOC>
118th CONGRESS
2d Session
H. R. 10455
To direct the Secretary of Health and Human Services to establish the
Health Sector Cybersecurity Coordination Center, and for other
purposes.
_______________________________________________________________________
IN THE HOUSE OF REPRESENTATIVES
December 17, 2024
Ms. Kelly of Illinois introduced the following bill; which was referred
to the Committee on Energy and Commerce, and in addition to the
Committees on Ways and Means, and Science, Space, and Technology, for a
period to be subsequently determined by the Speaker, in each case for
consideration of such provisions as fall within the jurisdiction of the
committee concerned
_______________________________________________________________________
A BILL
To direct the Secretary of Health and Human Services to establish the
Health Sector Cybersecurity Coordination Center, and for other
purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Healthcare Cybersecurity Improvement
Act''.
SEC. 2 FINDINGS.
Congress finds that--
(1) the Department of Health and Human Services found that
ransomware attacks on hospitals have more than doubled from
2019 to 2020, with more than 239,000,000 attacks attempted;
(2) in 2020, over 630 health care organizations were
subject to data breaches, leading to over 29,000,000 health
records publicly released; and
(3) studies indicate that attacks on our nation's health
care systems will only increase as hospitals are forced to
balance health care costs with an increasingly digital health
care system.
SEC. 3 HEALTH SECTOR CYBERSECURITY COORDINATION CENTER.
(a) Establishment.--Not later than 120 days after the date of the
enactment of this Act, the Secretary of Health and Human Services (in
this Act referred to as the ``Secretary'') shall, in consultation, as
appropriate, with other relevant officials within the Department of
Health and Human Services, including the Commissioner of Food and
Drugs, the Assistant Secretary for Preparedness and Response, and the
Officer for Civil Rights and Civil Liberties, establish a center for
purposes of coordinating cybersecurity across the health care sector to
be known as the Health Sector Cybersecurity Coordination Center (in
this section referred to as the ``Center'').
(b) Duties.--The Center shall--
(1) support the defense of the information technology
infrastructure of the health care sector, including by--
(A) strengthening coordination and information
sharing within the sector; and
(B) developing a plan to protect, detect, respond
to, and recover from cybersecurity risks and incidents,
including for entities with limited technical capacity;
and
(2) develop and support technical capabilities and provide
advice regarding the development of standards, to prevent and
mitigate cyber attacks, including--
(A) the Commissioner of Food and Drugs; and
(B) the Assistant Secretary for Preparedness and
Response.
SEC. 4 HEALTH CARE CYBERSECURITY GRANT PROGRAM.
(a) Establishment.--Not later than 1 year after the date of the
enactment of this Act, the Secretary shall establish a program to be
known as the Health Care Cybersecurity Grant Program for the purpose of
awarding grants to eligible entities to obtain equipment and software
and hire information technology staff to ensure the protection of
critical information systems.
(b) Grant Amount.--Not later than 90 days after funds are made
available to carry out this section, the Secretary shall publish the
maximum amount of a grant available under this section, as determined
by the Secretary.
(c) Report.--Not later than 5 years after the date of the enactment
of this Act, the Secretary shall prepare and submit to the Committee on
Health, Education, Labor, and Pensions of the Senate and the Committee
on Energy and Commerce of the House of Representatives a report on the
activities and outcomes of the grant program under this section.
(d) Definitions.--In this section:
(1) Eligible entity.--The term ``eligible entity'' means
a--
(A) hospital with fewer than 300 beds for the
provision of patient care; or
(B) rural health clinic.
(2) Hospital.--The term ``hospital'' means a hospital, as
defined in section 1861(e) of the Social Security Act (42
U.S.C. 1395x(e)), or a critical access hospital, as defined in
section 1861(mm)(1) of such Act (42 U.S.C. 1395x(mm)(1)).
(3) Rural health clinic.--The term ``rural health clinic''
has the meaning given such term in section 1861(aa) of the
Social Security Act (42 U.S.C. 1395x(aa)(2)).
(e) Authorization of Appropriations.--There are authorized to be
appropriated to carry out this section $100,000,000 for fiscal year
2022, to remain available through fiscal year 2023.
SEC. 5. STANDARDS FOR MEDICAL DEVICES AND INFORMATION SECURITY NETWORKS
IN HOSPITALS.
(a) Establishment.--Not later than 1 year after the date of the
enactment of this Act, the Director of the National Institute of
Standards and Technology, in consultation with the Director of the
Cybersecurity and Infrastructure Security Agency and the heads of
appropriate Federal agencies, shall develop standards for the
protection of information security networks and digital medical devices
in hospitals.
(b) Consideration.--In developing standards under subsection (a),
the Director shall take into consideration--
(1) current Federal standards and guidelines, including--
(A) standards and guidelines developed under
section 4 of the Internet of Things Cybersecurity
Improvement Act of 2020 (15 U.S.C. 278g-b);
(B) standards promulgated under section 405(d) of
the Cybersecurity Act of 2015 (6 U.S.C. 1533); and
(C) standards developed by the Cybersecurity and
Infrastructure Security Agency of the Department of
Homeland Security with respect to critical
infrastructure (as defined in section 1016(e) of the
USA PATRIOT Act (42 U.S.C. 5195c(e)); and
(2) general security practices, including--
(A) network segmentation between medical devices
and patient information; and
(B) the methods used to detect medical devices
connected to the internal network of a hospital.
(c) Enforcement Under Medicare and Medicaid.--
(1) Medicare.--Section 1866(a)(1) of the Social Security
Act (42 U.S.C. 1395cc(a)(1)) is amended--
(A) in subparagraph (X), by striking ``and'' at the
end;
(B) in subparagraph (Y)(ii)(V), by striking the
period and inserting ``, and''; and
(C) by inserting after subparagraph (Y) the
following new subparagraph:
``(Z) in the case of a hospital or a critical access
hospital, beginning on the date that is 2 years after the date
of the enactment of this subparagraph, to comply with the
standards developed under section 5(a) of the Healthcare
Cybersecurity Improvement Act.''.
(2) Medicaid.--Section 1902(a) of the Social Security Act
(42 U.S.C. 1396a(a)) is amended--
(A) in paragraph (86), by striking ``and'' at the
end;
(B) in paragraph (87)(D), by striking the period
and inserting ``; and''; and
(C) by inserting after paragraph (87) the following
new paragraph:
``(88) provide that, beginning on the date that is 2 years
after the date of the enactment of this paragraph, no hospital
be eligible to participate under the plan (or a waiver of such
plan) unless such hospital complies with the standards
developed under section 5(a) of the Healthcare Cybersecurity
Improvement Act.''.
(d) Quinquennial Review and Revision.--Not later than 5 years after
the date on which the Secretary publishes the standards under
subsection (a), and not less frequently than once every 5 years
thereafter, the Secretary, shall review and revise such standards, as
appropriate.
SEC. 6. LIMITATION ON LIABILITY FOR A LARGE HOSPITAL.
(a) In General.--Notwithstanding any other provision of law, a
large hospital shall not be liable in any covered civil action to a
smaller health entity if such hospital provided cybersecurity
assistance to such entity with respect to electronic data, unless such
entity can prove by clear and convincing evidence that the alleged harm
was caused by gross negligence or willful misconduct.
(b) Exception.--For purposes of this section, any acts or omissions
by a large hospital resulting from a resource or staffing shortage
shall not be considered willful misconduct or gross negligence.
(c) Definitions.--In this section:
(1) Covered civil action.--The term ``covered civil
action'' means a civil action under State law from harm
resulting from the acquisition, storage, security, use, misuse,
disclosure, or transmission of electronic data of any kind,
including--
(A) information security and privacy;
(B) penalties, including for regulatory defense;
(C) misuse of website media content; and
(D) disclosure, misuse, or improper (or inadequate)
storage or security of personal and confidential
information.
(2) Large hospital.--The term ``large hospital'' means a
hospital with 300 or more beds for the provision of patient
care.
(3) Hospital.--The term ``hospital'' has the meaning given
such term in section 1861(e) of the Social Security Act (42
U.S.C. 1395x).
(4) Rural health clinic.--The term ``rural health clinic''
has the meaning given such term in section 1861(aa) of the
Social Security Act (42 U.S.C. 1395x(aa)(2)).
(5) Small health entity.--The term ``small health entity''
means--
(A) a hospital with fewer than 299 beds for the
provision of patient care; and
(B) a rural health clinic.
<all>
Introduced in House
Introduced in House
Referred to the Committee on Energy and Commerce, and in addition to the Committees on Ways and Means, and Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Referred to the Committee on Energy and Commerce, and in addition to the Committees on Ways and Means, and Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Referred to the Committee on Energy and Commerce, and in addition to the Committees on Ways and Means, and Science, Space, and Technology, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
Llama 3.2 · runs locally in your browser
Ask anything about this bill. The AI reads the full text to answer.
Enter to send · Shift+Enter for new line