What does Preamble of Healthcare Cybersecurity Act of 2025 do?

This bill is formally titled 'To enhance the cybersecurity of the Healthcare and Public Health Sector.' The bill aims to enhance cybersecurity within the Healthcare and Public Health Sector.

What does SHORT TITLE. of Healthcare Cybersecurity Act of 2025 do?

This bill is formally titled the Healthcare Cybersecurity Act of 2025.

What does DEFINITIONS. of Healthcare Cybersecurity Act of 2025 do?

This section defines terms used in the Act Definitions include Agency, covered asset, and Cybersecurity State Coordinator Terms related to the Healthcare and Public Health Sector are specified

What does FINDINGS. of Healthcare Cybersecurity Act of 2025 do?

This section outlines findings related to cyberattacks targeting healthcare assets. These attacks reportedly result in data breaches, increased healthcare costs, and potential impacts on patient health outcomes. Data indicates a significant increase in large cyber breaches of healthcare facilities, rising 93 percent between 2018 and 2022. Breaches of unsecured protected health information have increased 107 percent since 2018. In 2022, the Department received 626 reported breaches affecting at least 500 individuals each, impacting nearly 42 million individuals.

What does AGENCY COORDINATION WITH THE DEPARTMENT. of Healthcare Cybersecurity Act of 2025 do?

This section establishes coordination between an Agency and the Department to improve cybersecurity within the Healthcare and Public Health Sector. The Director, in coordination with the Secretary, must appoint a liaison with cybersecurity qualifications to facilitate communication and coordination between the Agency and the Department. The liaison's responsibilities include serving as a primary contact, supporting the implementation of a plan, sharing cyber threat information, assisting with training, and coordinating during cybersecurity incidents. The Secretary, in coordination with the Director, must submit a report within 18 months of enactment detailing cybersecurity coordination activities, challenges faced by the liaison, and a feasibility study for an agreement to improve cybersecurity in the public sector of healthcare. The Agency must coordinate with and provide resources to various organizations, including Information Sharing and Analysis Organizations, to support cybersecurity efforts within the Healthcare and Public Health Sector. This coordination includes developing sector-specific products and sharing cyber threat indicators and defensive measures.

What does TRAINING FOR HEALTHCARE OWNERS AND OPERATORS. of Healthcare Cybersecurity Act of 2025 do?

This section requires the Agency to provide training to owners and operators of covered assets. The training will focus on cybersecurity risks to the Healthcare and Public Health Sector. The training will also cover methods to mitigate risks to information systems within the Healthcare and Public Health Sector.

What does SECTOR-SPECIFIC RISK MANAGEMENT PLAN. of Healthcare Cybersecurity Act of 2025 do?

This section requires the Secretary, in coordination with the Director, to update a plan within one year of the Act's enactment. The updated plan must include an analysis of how cybersecurity risks impact covered assets, specifically addressing the impact on rural and small- and medium-sized assets. The plan must evaluate challenges faced by owners and operators of covered assets in securing information systems, medical devices, and sensitive health information. It also requires an evaluation of best practices for utilizing Agency resources to support covered assets during and after cybersecurity incidents. The plan must assess healthcare cybersecurity workforce shortages, including training, recruitment, and retention issues, particularly at smaller facilities. The plan must evaluate methods for the Agency and Department to communicate cybersecurity recommendations and tools. Within 120 days of enactment, the Secretary must brief specified Senate and House committees on the plan's updating.

What does IDENTIFYING HIGH-RISK COVERED ASSETS. of Healthcare Cybersecurity Act of 2025 do?

This section outlines a process for identifying and managing high-risk covered assets. The Secretary, in consultation with the Director and relevant stakeholders, may establish objective criteria for designating covered assets as high-risk, aligning with existing methodology for critical infrastructure. The Secretary can develop and maintain a list of high-risk covered assets, notifying owners and operators. This list must be reviewed and updated biannually, with notifications sent to affected owners and operators. Congress will be notified when the initial list is developed and each time it is updated. The Department may use this list to prioritize resource allocation to bolster cyber resilience for high-risk assets.

What does REPORTS. of Healthcare Cybersecurity Act of 2025 do?

This section mandates two reports related to support for the healthcare and public health sector. The Agency must submit a report within 120 days of the Act's enactment detailing support provided to the healthcare and public health sector for cybersecurity preparedness and response. The Comptroller General of the United States must submit a report within 18 months of enactment outlining Federal resources available to the Healthcare and Public Health Sector for critical infrastructure. The report on critical infrastructure resources must consider resources from recent and ongoing collaboration with the Director and the Secretary.

What does RULES OF CONSTRUCTION. of Healthcare Cybersecurity Act of 2025 do?

This section outlines rules of construction for the Act. The Secretary or Director's actions are limited to those authorized by the Act or existing law. The Act cannot be construed to permit the violation of individual rights protected by the U.S. Constitution, including freedom of speech and protection from unauthorized surveillance. No additional funds are authorized for carrying out the Act.

Back to bills

Healthcare Cybersecurity Act of 2025

Last updated: 6/10/2025 · Introduced: 6/9/2025

Author: Jason Crow (D-CO)

TL;DR (AI)

The bill establishes coordination between an Agency and the Department of Health and Human Services to improve cybersecurity within the Healthcare and Public Health Sector.
It requires the Agency to provide cybersecurity training to owners and operators of healthcare facilities and assets.
The bill mandates the development and updating of a sector-specific risk management plan, addressing cybersecurity impacts on rural and small healthcare providers and workforce shortages.
The Secretary may identify and designate high-risk covered assets, prioritizing resource allocation to bolster their cyber resilience.
The bill requires reports detailing cybersecurity support provided to the healthcare sector and a comprehensive overview of available federal resources for critical infrastructure.

119th Congressin committeeOfficial page

Verified Votes

No verified votes yet.

Community Votes

No community votes yet. Be the first!

Voting as guest · Sign in for verified votes

Other Sections

Includes provisions on preamble, short title., and 8 more.

10 sections

Click "Show details" to explore individual sections. Use the community vote above or visit All Sections to vote per section.

Read official text

Want the full experience?

Create a free account to cast verified votes on each section, get a personalized summary, and track your voting history.

Create Free Account