Health care organizations would adopt minimum cybersecurity safeguards

The Secretary would update regulations to require minimum cybersecurity practices. The requirements would cover non-governmental health sector entities, covered entities, and business associates. The practices must be risk-based and draw on national cybersecurity frameworks and health care cybersecurity goals. The Secretary may use enforcement discretion for entities facing extraordinary circumstances. The updated regulations and each new requirement would take effect 36 months after enactment.

The Secretary could award grants for adopting cybersecurity practices. Eligible applicants include federally qualified health centers, Indian Health Service facilities, nonprofit hospitals, rural health clinics, and nonprofit partners of those groups. Eligible groups would apply and describe how they would measure results and sustain the work after the grant ends. The Secretary may consider an applicant's demonstrated need when awarding grants. Each grant could last up to three years.

The Secretary and the Cybersecurity and Infrastructure Security Agency Director would coordinate sector cybersecurity work and prepare a joint response plan. The coordination and plan would address cybersecurity in the health care and public health sector, including serious incidents. The plan would set out rapid information sharing during sector-wide incidents, work with the sector coordinating council, and coordination with state coordinators for incidents affecting multiple states. They would establish the plan and send it to Congress within one year after enactment; the Secretary would also send updates if the plan changes.