Healthcare Cybersecurity Act of 2024

This bill aims to enhance the cybersecurity of the Healthcare and Public Health Sector by improving coordination between the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS), providing training, updating risk management plans, and identifying high-risk assets.

Sec. 2, Definitions: Defines key terms including 'Agency' as CISA, 'covered asset' as a Healthcare and Public Health Sector asset, 'Department' as HHS, 'Director' as the CISA Director, 'Healthcare and Public Health Sector' as defined in a national security memorandum, 'Plan' as the Sector-specific Risk Management Plan, and 'Secretary' as the HHS Secretary.

Sec. 3, Findings: Congress finds that covered assets are increasingly targeted by cyberattacks, leading to data breaches, higher healthcare costs, and potential harm to patient health. Large cyber breaches of healthcare information systems rose 93% from 2018 to 2022, and breaches of unsecured protected health information increased 107% since 2018, with 626 reported breaches affecting nearly 42 million individuals in 2022.

Sec. 4, Agency coordination with the Department: CISA must coordinate with HHS to improve cybersecurity. The CISA Director, with the HHS Secretary, will appoint a liaison with cybersecurity expertise to serve as a primary contact, support the Plan, facilitate cyber threat information sharing, assist with training, coordinate during incidents, and perform other duties. Within 18 months, the Secretary must report to Congress on coordination activities, including a summary of the liaison's work, challenges, and a feasibility study of an agreement to improve public sector healthcare cybersecurity. CISA must also coordinate with and provide resources to information sharing organizations and non-Federal entities.

Sec. 5, Training for healthcare owners and operators: CISA must make training available to owners and operators of covered assets on cybersecurity risks and ways to mitigate risks to information systems in the Healthcare and Public Health Sector.

Sec. 6, Sector-specific risk management plan: Within one year, the HHS Secretary, with the CISA Director, must update the Plan to include: an analysis of how cybersecurity risks impact covered assets, especially rural and small-to-medium ones; an evaluation of challenges in securing information systems, medical devices, and patient data, implementing protocols, and responding to breaches; an evaluation of best practices for using CISA resources; an assessment of cybersecurity workforce shortages and recommendations; and an evaluation of the best ways to communicate and deploy cybersecurity tools. Within 120 days, the Secretary must brief Congress on the Plan update.

Sec. 7, Identifying high-risk covered assets: The HHS Secretary, with the CISA Director and health sector owners, may establish criteria to designate covered assets as high-risk, aligning with CISA's critical infrastructure methodology. The Secretary may develop and biannually update a list of high-risk assets, notify owners, and notify Congress. The list may be used to prioritize resource allocation to bolster cyber resilience.

Sec. 8, Reports: Within 120 days, CISA must report to Congress on its support and activities to help the healthcare sector prepare for and respond to cyber threats. Within 18 months, the Comptroller General must report to Congress on Federal resources available for the Healthcare and Public Health Sector related to critical infrastructure.

Sec. 9, Rules of construction: Nothing in this Act authorizes actions not already permitted by law, permits violation of constitutional rights, or authorizes additional funds for carrying out the Act.