I 

118TH CONGRESS 

2D SESSION H. R. 10455 

To direct the Secretary of Health and Human Services to establish the 

Health Sector Cybersecurity Coordination Center, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 17, 2024 

Ms. KELLY of Illinois introduced the following bill; which was referred to the 

Committee on Energy and Commerce, and in addition to the Committees 

on Ways and Means, and Science, Space, and Technology, for a period 

to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee 

concerned 

A BILL 

To direct the Secretary of Health and Human Services to 

establish the Health Sector Cybersecurity Coordination 

Center, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Healthcare Cybersecu5 rity Improvement Act’’. 

6 SEC. 2 FINDINGS. 

7 Congress finds that— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•HR 10455 IH

1 (1) the Department of Health and Human 

2 Services found that ransomware attacks on hospitals 

3 have more than doubled from 2019 to 2020, with 

4 more than 239,000,000 attacks attempted; 

5 (2) in 2020, over 630 health care organizations 

6 were subject to data breaches, leading to over 

7 29,000,000 health records publicly released; and 

8 (3) studies indicate that attacks on our nation’s 

9 health care systems will only increase as hospitals 

10 are forced to balance health care costs with an in11 creasingly digital health care system. 

12 SEC. 3 HEALTH SECTOR CYBERSECURITY COORDINATION 

13 CENTER. 

14 (a) ESTABLISHMENT.—Not later than 120 days after 

15 the date of the enactment of this Act, the Secretary of 

16 Health and Human Services (in this Act referred to as 

17 the ‘‘Secretary’’) shall, in consultation, as appropriate, 

18 with other relevant officials within the Department of 

19 Health and Human Services, including the Commissioner 

20 of Food and Drugs, the Assistant Secretary for Prepared21 ness and Response, and the Officer for Civil Rights and 

22 Civil Liberties, establish a center for purposes of coordi23 nating cybersecurity across the health care sector to be 

24 known as the Health Sector Cybersecurity Coordination 

25 Center (in this section referred to as the ‘‘Center’’). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•HR 10455 IH

1 (b) DUTIES.—The Center shall— 

2 (1) support the defense of the information tech3 nology infrastructure of the health care sector, in4 cluding by— 

5 (A) strengthening coordination and infor6 mation sharing within the sector; and 

7 (B) developing a plan to protect, detect, 

8 respond to, and recover from cybersecurity risks 

9 and incidents, including for entities with limited 

10 technical capacity; and 

11 (2) develop and support technical capabilities 

12 and provide advice regarding the development of 

13 standards, to prevent and mitigate cyber attacks, in14 cluding— 

15 (A) the Commissioner of Food and Drugs; 

16 and 

17 (B) the Assistant Secretary for Prepared18 ness and Response. 

19 SEC. 4 HEALTH CARE CYBERSECURITY GRANT PROGRAM. 

20 (a) ESTABLISHMENT.—Not later than 1 year after 

21 the date of the enactment of this Act, the Secretary shall 

22 establish a program to be known as the Health Care Cy23 bersecurity Grant Program for the purpose of awarding 

24 grants to eligible entities to obtain equipment and softVerDate Sep 11 2014 02:24 Jan 22, 2025 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H10455.IH H10455

kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•HR 10455 IH

1 ware and hire information technology staff to ensure the 

2 protection of critical information systems. 

3 (b) GRANT AMOUNT.—Not later than 90 days after 

4 funds are made available to carry out this section, the Sec5 retary shall publish the maximum amount of a grant avail6 able under this section, as determined by the Secretary. 

7 (c) REPORT.—Not later than 5 years after the date 

8 of the enactment of this Act, the Secretary shall prepare 

9 and submit to the Committee on Health, Education, 

10 Labor, and Pensions of the Senate and the Committee on 

11 Energy and Commerce of the House of Representatives 

12 a report on the activities and outcomes of the grant pro13 gram under this section. 

14 (d) DEFINITIONS.—In this section: 

15 (1) ELIGIBLE ENTITY.—The term ‘‘eligible enti16 ty’’ means a— 

17 (A) hospital with fewer than 300 beds for 

18 the provision of patient care; or 

19 (B) rural health clinic. 

20 (2) HOSPITAL.—The term ‘‘hospital’’ means a 

21 hospital, as defined in section 1861(e) of the Social 

22 Security Act (42 U.S.C. 1395x(e)), or a critical ac23 cess hospital, as defined in section 1861(mm)(1) of 

24 such Act (42 U.S.C. 1395x(mm)(1)). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•HR 10455 IH

1 (3) RURAL HEALTH CLINIC.—The term ‘‘rural 

2 health clinic’’ has the meaning given such term in 

3 section 1861(aa) of the Social Security Act (42 

4 U.S.C. 1395x(aa)(2)). 

5 (e) AUTHORIZATION OF APPROPRIATIONS.—There 

6 are authorized to be appropriated to carry out this section 

7 $100,000,000 for fiscal year 2022, to remain available 

8 through fiscal year 2023. 

9 SEC. 5. STANDARDS FOR MEDICAL DEVICES AND INFORMA10 TION SECURITY NETWORKS IN HOSPITALS. 

11 (a) ESTABLISHMENT.—Not later than 1 year after 

12 the date of the enactment of this Act, the Director of the 

13 National Institute of Standards and Technology, in con14 sultation with the Director of the Cybersecurity and Infra15 structure Security Agency and the heads of appropriate 

16 Federal agencies, shall develop standards for the protec17 tion of information security networks and digital medical 

18 devices in hospitals. 

19 (b) CONSIDERATION.—In developing standards under 

20 subsection (a), the Director shall take into consideration— 

21 (1) current Federal standards and guidelines, 

22 including— 

23 (A) standards and guidelines developed 

24 under section 4 of the Internet of Things CyVerDate Sep 11 2014 02:24 Jan 22, 2025 Jkt 059200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H10455.IH H10455

kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•HR 10455 IH

1 bersecurity Improvement Act of 2020 (15 

2 U.S.C. 278g–b); 

3 (B) standards promulgated under section 

4 405(d) of the Cybersecurity Act of 2015 (6 

5 U.S.C. 1533); and 

6 (C) standards developed by the Cybersecu7 rity and Infrastructure Security Agency of the 

8 Department of Homeland Security with respect 

9 to critical infrastructure (as defined in section 

10 1016(e) of the USA PATRIOT Act (42 U.S.C. 

11 5195c(e)); and 

12 (2) general security practices, including— 

13 (A) network segmentation between medical 

14 devices and patient information; and 

15 (B) the methods used to detect medical de16 vices connected to the internal network of a 

17 hospital. 

18 (c) ENFORCEMENT UNDER MEDICARE AND MED19 ICAID.— 

20 (1) MEDICARE.—Section 1866(a)(1) of the So21 cial Security Act (42 U.S.C. 1395cc(a)(1)) is 

22 amended— 

23 (A) in subparagraph (X), by striking 

24 ‘‘and’’ at the end; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•HR 10455 IH

1 (B) in subparagraph (Y)(ii)(V), by striking 

2 the period and inserting ‘‘, and’’; and 

3 (C) by inserting after subparagraph (Y) 

4 the following new subparagraph: 

5 ‘‘(Z) in the case of a hospital or a critical ac6 cess hospital, beginning on the date that is 2 years 

7 after the date of the enactment of this subpara8 graph, to comply with the standards developed under 

9 section 5(a) of the Healthcare Cybersecurity Im10 provement Act.’’. 

11 (2) MEDICAID.—Section 1902(a) of the Social 

12 Security Act (42 U.S.C. 1396a(a)) is amended— 

13 (A) in paragraph (86), by striking ‘‘and’’ 

14 at the end; 

15 (B) in paragraph (87)(D), by striking the 

16 period and inserting ‘‘; and’’; and 

17 (C) by inserting after paragraph (87) the 

18 following new paragraph: 

19 ‘‘(88) provide that, beginning on the date that 

20 is 2 years after the date of the enactment of this 

21 paragraph, no hospital be eligible to participate 

22 under the plan (or a waiver of such plan) unless 

23 such hospital complies with the standards developed 

24 under section 5(a) of the Healthcare Cybersecurity 

25 Improvement Act.’’. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•HR 10455 IH

1 (d) QUINQUENNIAL REVIEW AND REVISION.—Not 

2 later than 5 years after the date on which the Secretary 

3 publishes the standards under subsection (a), and not less 

4 frequently than once every 5 years thereafter, the Sec5 retary, shall review and revise such standards, as appro6 priate. 

7 SEC. 6. LIMITATION ON LIABILITY FOR A LARGE HOSPITAL. 

8 (a) IN GENERAL.—Notwithstanding any other provi9 sion of law, a large hospital shall not be liable in any cov10 ered civil action to a smaller health entity if such hospital 

11 provided cybersecurity assistance to such entity with re12 spect to electronic data, unless such entity can prove by 

13 clear and convincing evidence that the alleged harm was 

14 caused by gross negligence or willful misconduct. 

15 (b) EXCEPTION.—For purposes of this section, any 

16 acts or omissions by a large hospital resulting from a re17 source or staffing shortage shall not be considered willful 

18 misconduct or gross negligence. 

19 (c) DEFINITIONS.—In this section: 

20 (1) COVERED CIVIL ACTION.—The term ‘‘cov21 ered civil action’’ means a civil action under State 

22 law from harm resulting from the acquisition, stor23 age, security, use, misuse, disclosure, or trans24 mission of electronic data of any kind, including— 

25 (A) information security and privacy; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•HR 10455 IH

1 (B) penalties, including for regulatory de2 fense; 

3 (C) misuse of website media content; and 

4 (D) disclosure, misuse, or improper (or in5 adequate) storage or security of personal and 

6 confidential information. 

7 (2) LARGE HOSPITAL.—The term ‘‘large hos8 pital’’ means a hospital with 300 or more beds for 

9 the provision of patient care. 

10 (3) HOSPITAL.—The term ‘‘hospital’’ has the 

11 meaning given such term in section 1861(e) of the 

12 Social Security Act (42 U.S.C. 1395x). 

13 (4) RURAL HEALTH CLINIC.—The term ‘‘rural 

14 health clinic’’ has the meaning given such term in 

15 section 1861(aa) of the Social Security Act (42 

16 U.S.C. 1395x(aa)(2)). 

17 (5) SMALL HEALTH ENTITY.—The term ‘‘small 

18 health entity’’ means— 

19 (A) a hospital with fewer than 299 beds 

20 for the provision of patient care; and 

21 (B) a rural health clinic. 

Æ 


kjohnson on DSK7ZCZBW3PROD with $$_JOB