I 

113TH CONGRESS 

2D SESSION H. R. 3847 

To require the Secretary of Homeland Security the responsibility to develop 

and provide to the Secretary of Health and Human Services risk-based, 

performance-based cybersecurity standards for the Federal information 

technology requirements under the Patient Protection and Affordable 

Care Act, including the healthcare.gov website, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 10, 2014 

Mr. BARBER (for himself, Mr. DAINES, and Ms. SINEMA) introduced the following bill; which was referred to the Committee on Energy and Commerce, and in addition to the Committee on Oversight and Government 

Reform, for a period to be subsequently determined by the Speaker, in 

each case for consideration of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To require the Secretary of Homeland Security the responsibility to develop and provide to the Secretary of Health 

and Human Services risk-based, performance-based cybersecurity standards for the Federal information technology requirements under the Patient Protection and 

Affordable Care Act, including the healthcare.gov 

website, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


tjames on DSK6SPTVN1PROD with BILLS
2 

•HR 3847 IH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Cyber Awareness and 

3 Recovery Enhancement Act of 2013’’ or the ‘‘CARE Act 

4 of 2013’’. 

5 SEC. 2. CYBERSECURITY FOR HEALTHCARE.GOV WEBSITE. 

6 (a) IN GENERAL.—Notwithstanding the require7 ments of the Federal Information Security Management 

8 Act of 2002 (44 U.S.C. 3531 et seq.) or any other provi9 sion of law, not later than 90 days after the date of the 

10 enactment of this Act, the Secretary of Homeland Security 

11 shall develop and provide to the Secretary of Health and 

12 Human Services risk-based, performance-based cybersecu13 rity standards for the Federal information technology re14 quirements under the Patient Protection and Affordable 

15 Care Act (Public Law 111–148), including the 

16 healthcare.gov website (or any successor website). Such 

17 standards shall be based on cybersecurity best practices, 

18 and on homeland security information that the Secretary 

19 of Homeland Security has collected, analyzed, and dis20 seminated about cyber threats, vulnerabilities, and con21 sequences. 

22 (b) CONSULTATION.—In carrying out the cybersecu23 rity standards described in subsection (a), the Secretary 

24 of Homeland Security shall consult with the Secretary of 

25 Health and Human Services. 


tjames on DSK6SPTVN1PROD with BILLS
3 

•HR 3847 IH

1 (c) IMPLEMENTATION AND ENFORCEMENT.—Not 

2 later than 90 days after receiving the cybersecurity stand3 ards described in subsection (a), the Secretary of Health 

4 and Human Services shall adopt and implement such cy5 bersecurity standards. 

6 (d) ENFORCEMENT.—The Secretary of Health and 

7 Human Services shall submit to Congress an annual re8 port on cyber incidents relating to the Federal information 

9 technology requirements under the Patient Protection and 

10 Affordable Care Act, including the healthcare.gov website 

11 (or any successor website). 

Æ 


tjames on DSK6SPTVN1PROD with BILLS