I 
117TH CONGRESS 
2D SESSION 
H. R. 8806 
To enhance the cybersecurity of the Healthcare and Public Health Sector. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 13, 2022 
Mr. CROW (for himself and Mr. FITZPATRICK) introduced the following bill; 
which was referred to the Committee on Homeland Security 
A BILL 
To enhance the cybersecurity of the Healthcare and Public 
Health Sector. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Healthcare Cybersecu-
rity Act of 2022’’. 
SEC. 2. DEFINITIONS. 
In this Act— 
(1) the term ‘‘Agency’’ means the Cybersecurity 
and Infrastructure Security Agency; 
(2) the term ‘‘Cybersecurity State Coordinator’’ 
means a Cybersecurity State Coordinator appointed 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
under section 2217(a) of the Homeland Security Act 
of 2002 (6 U.S.C. 665c(a)); 
(3) the term ‘‘Department’’ means the Depart-
ment of Health and Human Services; 
(4) the term ‘‘Director’’ means the Director of 
the Agency; 
(5) the term ‘‘Healthcare and Public Health 
Sector’’ means the Healthcare and Public Health 
sector, as identified in Presidential Policy Directive 
21 (February 12, 2013; relating to critical infra-
structure security and resilience); 
(6) the term ‘‘Information Sharing and Anal-
ysis Organizations’’ has the meaning given that term 
in section 2222 of the Homeland Security Act of 
2002 (6 U.S.C. 671); and 
(7) the term ‘‘Secretary’’ means the Secretary 
of Health and Human Services. 
SEC. 3. FINDINGS. 
Congress finds the following: 
(1) Healthcare and Public Health Sector assets 
are 
increasingly 
the 
targets 
of 
malicious 
cyberattacks, which result not only in data breaches, 
but also increased healthcare delivery costs, and can 
ultimately affect patient health outcomes. 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) Data reported to the Department shows 
that almost every month in 2020, more than 
1,000,000 people were affected by data breaches at 
healthcare organizations. Cyberattacks on healthcare 
facilities rose 55 percent in 2020, and these attacks 
also resulted in a 16 percent increase in the average 
cost of recovering a patient record in 2020, as com-
pared to 2019. 
(3) According to data from the Office for Civil 
Rights of the Department, health information 
breaches have increased since 2016, and in 2020 
alone, the Department reported 663 breaches on 
covered entities, as defined under the Health Insur-
ance Portability and Accountability Act of 1996 
(Public Law 104–191), affecting more than 500 peo-
ple, with over 33,000,000 total people affected by 
health information breaches. 
SEC. 4. AGENCY COLLABORATION WITH THE DEPARTMENT. 
(a) IN GENERAL.—The Agency shall collaborate with 
the Department, including by entering into an agreement, 
as appropriate, to improve cybersecurity in the Healthcare 
and Public Health Sector. 
(b) ASSISTANCE.— 
(1) IN GENERAL.—The Agency shall coordinate 
with and make resources available to Information 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
Sharing and Analysis Organizations, information 
sharing and analysis centers, and non-Federal enti-
ties that are receiving information shared through 
programs managed by the Department. 
(2) SCOPE.—The coordination under paragraph 
(1) shall include— 
(A) developing products specific to the 
needs of Healthcare and Public Health Sector 
entities; and 
(B) sharing information relating to cyber 
threat indicators and appropriate defensive 
measures. 
SEC. 5. TRAINING FOR HEALTHCARE EXPERTS. 
The Cyber Security Advisors and Cybersecurity State 
Coordinators of the Agency shall, in coordination, as ap-
propriate, with private sector healthcare experts, provide 
training to Healthcare and Public Health Sector asset 
owners and operators on— 
(1) cybersecurity risks to the Healthcare and 
Public Health Sector and assets within the sector; 
and 
(2) ways to mitigate the risks to information 
systems in the Healthcare and Public Health Sector. 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
SEC. 6. SECTOR-SPECIFIC STUDY AND REPORT. 
(a) IN GENERAL.—Not later than 1 year after the 
date of enactment of this Act, the Director, in consultation 
with the Secretary, shall conduct a study and issue a re-
port, which shall include the following elements: 
(1) An analysis of how identified cybersecurity 
risks specifically impact Healthcare and Public 
Health Sector assets, including the impact on rural 
and small and medium-sized Healthcare and Public 
Health Sector assets. 
(2) An evaluation of the challenges Healthcare 
and Public Health Sector assets face in— 
(A) securing— 
(i) 
updated 
information 
systems 
owned, 
leased, 
or 
relied 
upon 
by 
Healthcare and Public Health Sector as-
sets; 
(ii) medical devices or equipment 
owned, 
leased, 
or 
relied 
upon 
by 
Healthcare and Public Health Sector as-
sets, which shall include an analysis of the 
threat 
landscape 
and 
cybersecurity 
vulnerabilities of such medical devices or 
equipment; and 
(iii) sensitive patient health informa-
tion and electronic health records; 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
(B) implementing cybersecurity protocols; 
and 
(C) responding to data breaches or cyber-
security attacks, including the impact on pa-
tient access to care, quality of patient care, 
timeliness of health care delivery, and health 
outcomes. 
(3) An evaluation of best practices for the de-
ployment of trained Cyber Security Advisors and Cy-
bersecurity State Coordinators of the Agency into 
Healthcare and Public Health Sector assets before, 
during, and after data breaches or cybersecurity at-
tacks. 
(4) An assessment of relevant Healthcare and 
Public Health Sector cybersecurity workforce short-
ages, including— 
(A) training, recruitment, and retention 
issues; and 
(B) recommendations for how to address 
these shortages and issues, particularly at rural 
and small and medium-sized Healthcare and 
Public Health Sector assets. 
(5) An identification of cybersecurity challenges 
related to or brought on by the public health emer-
gency declared by the Secretary under section 319 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
of the Public Health Service Act (42 U.S.C. 247d) 
on January 27, 2020, with respect to COVID–19. 
(6) An evaluation of the most accessible and 
timely ways for the Agency and the Department to 
communicate and deploy cybersecurity recommenda-
tions and tools to Healthcare and Public Health Sec-
tor assets. 
(b) REPORT TRANSMITTAL.—Not later than 60 days 
after completing the study and report required under sub-
section (a), the Director shall present the completed report 
to the Secretary, which the Secretary may, in consultation 
with the Director, consult when updating the Healthcare 
and Public Health Sector Specific Plan of the Secretary. 
(c) CONGRESSIONAL BRIEFING.—Not later than 120 
days after the date of enactment of this Act, the Director, 
in consultation with the Secretary, as appropriate, shall 
provide a briefing on the status of the study and report 
required under subsection (a) to— 
(1) the Committee on Health, Education, 
Labor, and Pensions and the Committee on Home-
land Security and Governmental Affairs of the Sen-
ate; and 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB
(2) the Committee on Energy and Commerce 
and the Committee on Homeland Security of the 
House of Representatives. 
Æ 
VerDate Sep 11 2014 
02:50 Sep 16, 2022
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H8806.IH
H8806
pbinns on DSKJLVW7X2PROD with $$_JOB