H.R. 3841 — Healthcare Cybersecurity Act of 2025

This section provides definitions for the following terms for purposes of the Act: (1) Agency as the Cybersecurity and Infrastructure Security Agency; (2) covered asset as a Healthcare and Public Health Sector asset, including technologies, services, and utilities; (3) Cybersecurity State Coordinator as one appointed under section 2217(a) of the Homeland Security Act of 2002 (6 U.S.C. 665c(a)); (4) Department as the Department of Health and Human Services; (5) Director as the Director of the Agency; (6) Healthcare and Public Health Sector as identified in National Security Memorandum–22 (NSM–22), issued April 30, 2024; (7) Information Sharing and Analysis Organization as defined in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650); (8) Plan as the Healthcare and Public Health Sector-specific Risk Management Plan; and (9) Secretary as the Secretary of Health and Human Services.

This section states congressional findings on increasing cyberattacks targeting covered assets in the healthcare sector, which result in data breaches, higher healthcare delivery costs, and adverse patient health outcomes. The findings cite Department of Health and Human Services data showing a 93 percent rise in large cyber breaches at healthcare facilities between 2018 and 2022 and a 107 percent increase in breaches of unsecured protected health information since 2018, including 626 such breaches in 2022 affecting nearly 42 million individuals at covered entities or business associates.

This section directs the Agency to coordinate with the Department of Health and Human Services (HHS) to improve cybersecurity in the healthcare and public health sector, including by appointing a qualified cybersecurity liaison—who is an Agency employee or detailee to HHS's Administration for Strategic Preparedness and Response (ASPR)—to serve as primary contact for threat information sharing, plan implementation and updates, training support, incident coordination, and related duties. It further requires the Agency, in coordination with HHS, to make resources available to information sharing and analysis organizations (ISACs), information sharing and analysis centers, sector coordinating councils, and non-federal entities receiving Department-managed information, including for developing sector-specific products and sharing cyber threat indicators and defensive measures. Not later than 18 months after enactment, the HHS Secretary and Agency Director must submit to specified congressional committees a report summarizing coordination activities, liaison performance and challenges, and a feasibility study of an agreement to improve public-sector healthcare cybersecurity.

This section directs the Agency to make available training to owners and operators of covered assets on (1) cybersecurity risks to the Healthcare and Public Health Sector and such assets, and (2) ways to mitigate risks to information systems in that sector.

This section directs the Secretary of Health and Human Services, in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) Director, to update the Healthcare and Public Health Sector Risk Management Plan not later than one year after enactment of this Act to include (1) an analysis of cybersecurity risks' impacts on covered assets, including rural and small- and medium-sized assets; (2) an evaluation of challenges faced by owners and operators of covered assets in securing information systems, medical devices and equipment (including their threat landscapes and vulnerabilities), and sensitive patient health information or electronic health records, as well as in implementing cybersecurity protocols and responding to breaches or attacks (including effects on patient care access, quality, timeliness, and outcomes); (3) an evaluation of best practices for using CISA resources (e.g., Cyber Security Advisors and Cybersecurity State Coordinators) to support covered assets before, during, and after incidents; (4) an assessment of sector cybersecurity workforce shortages, including training, recruitment, and retention issues and recommendations to address them (particularly for rural and small- and medium-sized covered assets); and (5) an evaluation of optimal methods for the agency and department to communicate and deploy cybersecurity recommendations and tools. It further requires the Secretary, in consultation with the CISA Director, to brief specified Senate and House committees on the plan update not later than 120 days after enactment.

This section authorizes the Secretary, in consultation with the Director and health sector owners and operators as appropriate, to (1) establish objective criteria, aligned with the Director's methodology under the Critical Infrastructures Protection Act of 2001 for identifying critical infrastructure functions and associated risk assessments, for designating covered assets as high-risk covered assets; and (2) develop a list of such assets, notify their owners and operators, review and update the list biannually with further notifications of changes, notify Congress of the initial list and each update, and use the list to prioritize Department resource allocation for cyber resilience.

This section requires two reports to Congress concerning federal support for the healthcare and public health critical infrastructure sector (one of 16 designated sectors under the Critical Infrastructures Protection Act of 2001): (1) not later than 120 days after enactment, a report from the Agency on its organization-wide support and activities to prepare the sector for cyber threats and responses to cyber attacks; and (2) not later than 18 months after enactment, a report from the Comptroller General on federal resources available as of enactment for the sector, including recent and ongoing collaborations with the Director and the Secretary.

This section specifies rules of construction for the Act, including (1) prohibiting the Secretary or Director from taking any action not authorized by the Act or existing law; (2) preserving the constitutional rights of individuals, including protections against censorship of protected speech or unauthorized surveillance; and (3) authorizing no additional appropriations to carry out the Act.