The Healthcare Cybersecurity Act of 2024 aims to strengthen cyber defenses across the healthcare and public health sector by improving coordination between the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services. The bill requires CISA to appoint a dedicated liaison to HHS who will facilitate threat information sharing, support training programs, and coordinate responses during cybersecurity incidents affecting hospitals, clinics, medical device makers, and other healthcare entities. It also directs HHS to update its sector-specific risk management plan within one year, addressing vulnerabilities in medical devices, patient records, and information systems, with particular attention to challenges faced by rural and smaller healthcare providers, and mandates that agencies offer cybersecurity training to healthcare owners and operators. Additionally, the Secretary of HHS may create a list of "high-risk" healthcare assets to help prioritize federal resources, and the bill requires several reports to Congress, including one from the Government Accountability Office within 18 months reviewing available federal cybersecurity resources for the sector. The legislation affects nearly all healthcare organizations and their patients, particularly relevant given that data breaches affected roughly 42 million people in 2022 alone, though the bill explicitly states no additional funding is authorized to implement these provisions.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.