H. R. 2029—741 
(6) HEALTH
CARE
INDUSTRY
STAKEHOLDER.—The term 
‘‘health care industry stakeholder’’ means any— 
(A) health plan, health care clearinghouse, or health 
care provider; 
(B) advocate for patients or consumers; 
(C) pharmacist; 
(D) developer or vendor of health information tech-
nology; 
(E) laboratory; 
(F) pharmaceutical or medical device manufacturer; 
or 
(G) additional stakeholder the Secretary determines 
necessary for purposes of subsection (b)(1), (c)(1), (c)(3), 
or (d)(1). 
(7) SECRETARY.—The term ‘‘Secretary’’ means the Secretary 
of Health and Human Services. 
(b) REPORT.— 
(1) IN
GENERAL.—Not later than 1 year after the date 
of enactment of this Act, the Secretary shall submit to the 
Committee on Health, Education, Labor, and Pensions of the 
Senate and the Committee on Energy and Commerce of the 
House of Representatives a report on the preparedness of the 
Department of Health and Human Services and health care 
industry stakeholders in responding to cybersecurity threats. 
(2) CONTENTS OF REPORT.—With respect to the internal 
response of the Department of Health and Human Services 
to emerging cybersecurity threats, the report under paragraph 
(1) shall include— 
(A) a clear statement of the official within the Depart-
ment of Health and Human Services to be responsible 
for leading and coordinating efforts of the Department 
regarding cybersecurity threats in the health care industry; 
and 
(B) a plan from each relevant operating division and 
subdivision of the Department of Health and Human Serv-
ices on how such division or subdivision will address cyber-
security threats in the health care industry, including a 
clear delineation of how each such division or subdivision 
will divide responsibility among the personnel of such divi-
sion or subdivision and communicate with other such divi-
sions and subdivisions regarding efforts to address such 
threats. 
(c) HEALTH CARE INDUSTRY CYBERSECURITY TASK FORCE.— 
(1) IN GENERAL.—Not later than 90 days after the date 
of the enactment of this Act, the Secretary, in consultation 
with the Director of the National Institute of Standards and 
Technology and the Secretary of Homeland Security, shall con-
vene health care industry stakeholders, cybersecurity experts, 
and any Federal agencies or entities the Secretary determines 
appropriate to establish a task force to— 
(A) analyze how industries, other than the health care 
industry, have implemented strategies and safeguards for 
addressing cybersecurity threats within their respective 
industries; 
(B) analyze challenges and barriers private entities 
(excluding any State, tribal, or local government) in the
H. R. 2029—742 
health care industry face securing themselves against cyber 
attacks; 
(C) review challenges that covered entities and busi-
ness associates face in securing networked medical devices 
and other software or systems that connect to an electronic 
health record; 
(D) provide the Secretary with information to dissemi-
nate to health care industry stakeholders of all sizes for 
purposes of improving their preparedness for, and response 
to, cybersecurity threats affecting the health care industry; 
(E) establish a plan for implementing title I of this 
division, so that the Federal Government and health care 
industry stakeholders may in real time, share actionable 
cyber threat indicators and defensive measures; and 
(F) report to the appropriate congressional committees 
on the findings and recommendations of the task force 
regarding carrying out subparagraphs (A) through (E). 
(2) TERMINATION.—The task force established under this 
subsection shall terminate on the date that is 1 year after 
the date on which such task force is established. 
(3) DISSEMINATION.—Not later than 60 days after the termi-
nation of the task force established under this subsection, the 
Secretary shall disseminate the information described in para-
graph (1)(D) to health care industry stakeholders in accordance 
with such paragraph. 
(d) ALIGNING HEALTH CARE INDUSTRY SECURITY APPROACHES.— 
(1) IN GENERAL.—The Secretary shall establish, through 
a collaborative process with the Secretary of Homeland Secu-
rity, health care industry stakeholders, the Director of the 
National Institute of Standards and Technology, and any Fed-
eral entity or non-Federal entity the Secretary determines 
appropriate, a common set of voluntary, consensus-based, and 
industry-led guidelines, best practices, methodologies, proce-
dures, and processes that— 
(A) serve as a resource for cost-effectively reducing 
cybersecurity risks for a range of health care organizations; 
(B) support voluntary adoption and implementation 
efforts to improve safeguards to address cybersecurity 
threats; 
(C) are consistent with— 
(i) the standards, guidelines, best practices, meth-
odologies, procedures, and processes developed under 
section 2(c)(15) of the National Institute of Standards 
and Technology Act (15 U.S.C. 272(c)(15)); 
(ii) the security and privacy regulations promul-
gated under section 264(c) of the Health Insurance 
Portability and Accountability Act of 1996 (42 U.S.C. 
1320d–2 note); and 
(iii) the provisions of the Health Information Tech-
nology for Economic and Clinical Health Act (title XIII 
of division A, and title IV of division B, of Public 
Law 111–5), and the amendments made by such Act; 
and 
(D) are updated on a regular basis and applicable 
to a range of health care organizations. 
(2) LIMITATION.—Nothing in this subsection shall be inter-
preted as granting the Secretary authority to—
H. R. 2029—743 
(A) provide for audits to ensure that health care 
organizations are in compliance with this subsection; or 
(B) mandate, direct, or condition the award of any 
Federal grant, contract, or purchase, on compliance with 
this subsection. 
(3) NO LIABILITY FOR NONPARTICIPATION.—Nothing in this 
section shall be construed to subject a health care industry 
stakeholder to liability for choosing not to engage in the vol-
untary activities authorized or guidelines developed under this 
subsection. 
(e) INCORPORATING ONGOING ACTIVITIES.—In carrying out the 
activities under this section, the Secretary may incorporate activi-
ties that are ongoing as of the day before the date of enactment 
of this Act and that are consistent with the objectives of this 
section. 
(f) RULE OF CONSTRUCTION.—Nothing in this section shall be 
construed to limit the antitrust exemption under section 104(e) 
or the protection from liability under section 106. 
SEC. 406. FEDERAL COMPUTER SECURITY. 
(a) DEFINITIONS.—In this section: 
(1) COVERED
SYSTEM.—The term ‘‘covered system’’ shall 
mean a national security system as defined in section 11103 
of title 40, United States Code, or a Federal computer system 
that provides access to personally identifiable information. 
(2) COVERED AGENCY.—The term ‘‘covered agency’’ means 
an agency that operates a covered system. 
(3) LOGICAL ACCESS CONTROL.—The term ‘‘logical access 
control’’ means a process of granting or denying specific 
requests to obtain and use information and related information 
processing services. 
(4) MULTI-FACTOR
AUTHENTICATION.—The term ‘‘multi- 
factor authentication’’ means the use of not fewer than 2 
authentication factors, such as the following: 
(A) Something that is known to the user, such as 
a password or personal identification number. 
(B) An access device that is provided to the user, 
such as a cryptographic identification device or token. 
(C) A unique biometric characteristic of the user. 
(5) PRIVILEGED USER.—The term ‘‘privileged user’’ means 
a user who has access to system control, monitoring, or adminis-
trative functions. 
(b) INSPECTOR GENERAL REPORTS ON COVERED SYSTEMS.— 
(1) IN GENERAL.—Not later than 240 days after the date 
of enactment of this Act, the Inspector General of each covered 
agency shall submit to the appropriate committees of jurisdic-
tion in the Senate and the House of Representatives a report, 
which shall include information collected from the covered 
agency for the contents described in paragraph (2) regarding 
the Federal computer systems of the covered agency. 
(2) CONTENTS.—The report submitted by each Inspector 
General of a covered agency under paragraph (1) shall include, 
with respect to the covered agency, the following: 
(A) A description of the logical access policies and 
practices used by the covered agency to access a covered 
system, including whether appropriate standards were fol-
lowed.
H. R. 2029—744 
(B) A description and list of the logical access controls 
and multi-factor authentication used by the covered agency 
to govern access to covered systems by privileged users. 
(C) If the covered agency does not use logical access 
controls or multi-factor authentication to access a covered 
system, a description of the reasons for not using such 
logical access controls or multi-factor authentication. 
(D) A description of the following information security 
management practices used by the covered agency 
regarding covered systems: 
(i) The policies and procedures followed to conduct 
inventories of the software present on the covered sys-
tems of the covered agency and the licenses associated 
with such software. 
(ii) What capabilities the covered agency utilizes 
to monitor and detect exfiltration and other threats, 
including— 
(I) data loss prevention capabilities; 
(II) forensics and visibility capabilities; or 
(III) digital rights management capabilities. 
(iii) A description of how the covered agency is 
using the capabilities described in clause (ii). 
(iv) If the covered agency is not utilizing capabili-
ties described in clause (ii), a description of the reasons 
for not utilizing such capabilities. 
(E) A description of the policies and procedures of 
the covered agency with respect to ensuring that entities, 
including contractors, that provide services to the covered 
agency are implementing the information security manage-
ment practices described in subparagraph (D). 
(3) EXISTING REVIEW.—The reports required under this sub-
section may be based in whole or in part on an audit, evalua-
tion, or report relating to programs or practices of the covered 
agency, and may be submitted as part of another report, 
including the report required under section 3555 of title 44, 
United States Code. 
(4) CLASSIFIED
INFORMATION.—Reports submitted under 
this subsection shall be in unclassified form, but may include 
a classified annex. 
SEC. 407. STOPPING THE FRAUDULENT SALE OF FINANCIAL INFORMA-
TION OF PEOPLE OF THE UNITED STATES. 
Section 1029(h) of title 18, United States Code, is amended 
by striking ‘‘title if—’’ and all that follows through ‘‘therefrom.’’ 
and inserting ‘‘title if the offense involves an access device issued, 
owned, managed, or controlled by a financial institution, account 
issuer, credit card system member, or other entity organized under 
the laws of the United States, or any State, the District of Columbia, 
or other territory of the United States.’’.