Healthcare Cybersecurity Improvement Act

This bill directs the Secretary of Health and Human Services to establish a Health Sector Cybersecurity Coordination Center, create a grant program for healthcare cybersecurity, develop standards for medical devices and information security networks in hospitals, and limit liability for large hospitals that provide cybersecurity assistance to smaller health entities.

Sec. 3, Health Sector Cybersecurity Coordination Center: Within 120 days of enactment, the Secretary must establish a center to coordinate cybersecurity across the healthcare sector. Its duties include supporting defense of healthcare IT infrastructure, strengthening coordination and information sharing, developing a plan to protect against cybersecurity risks, and developing technical capabilities and standards to prevent and mitigate cyber attacks.

Sec. 4, Health Care Cybersecurity Grant Program: Within one year, the Secretary must establish a grant program to award grants to eligible entities (hospitals with fewer than 300 beds or rural health clinics) for equipment, software, and IT staff to protect critical information systems. The Secretary will publish the maximum grant amount within 90 days of available funds. A report on the program's activities and outcomes is due within five years. $100,000,000 is authorized for fiscal year 2022, available through fiscal year 2023.

Sec. 5, Standards for Medical Devices and Information Security Networks in Hospitals: Within one year, the Director of the National Institute of Standards and Technology, in consultation with other agencies, must develop standards for protecting information security networks and digital medical devices in hospitals. The standards must consider current federal standards and general security practices like network segmentation. Hospitals and critical access hospitals must comply with these standards within two years to participate in Medicare and Medicaid. The standards must be reviewed and revised at least every five years.

Sec. 6, Limitation on Liability for a Large Hospital: A large hospital (300 or more beds) is not liable in a state civil action for harm from providing cybersecurity assistance to a smaller health entity (fewer than 299 beds or a rural health clinic), unless the smaller entity proves gross negligence or willful misconduct. Acts or omissions due to resource or staffing shortages are not considered willful misconduct or gross negligence.