This bill directs the Cybersecurity and Infrastructure Security Agency (the Agency) and the Department of Health and Human Services (the Department) to work together to improve cybersecurity in the Healthcare and Public Health Sector. The Director must appoint an Agency liaison to the Department with cybersecurity expertise. The Agency will share threat information and make training available to owners and operators of covered assets. The Secretary, in coordination with the Director, must update the sector-specific Risk Management Plan within one year. The Plan must analyze risks to covered assets, evaluate challenges faced by owners and operators (including small and rural entities), assess workforce shortages, and describe ways to use Agency resources. The Secretary may set criteria and keep a list of high-risk covered assets and notify owners and operators. The Agency and the Comptroller General must give reports to Congress on support provided and federal resources. The bill states that no additional funds are authorized and includes rules saying the agencies may only act as the law allows and must protect constitutional rights.
The bill says: "No additional funds are authorized to be appropriated for the purpose of carrying out this Act." No publicly available information on estimated costs or budget effects is included in the bill text.
The bill notes that large cyber breaches and breaches of protected health information have increased substantially in recent years. Proponents point to those findings to justify better coordination between the Agency and the Department, more information sharing, training for owners and operators, an updated Risk Management Plan, and reporting to Congress to improve sector cybersecurity.
No publicly available information.