I 
113TH CONGRESS 
2D SESSION 
H. R. 3847 
To require the Secretary of Homeland Security the responsibility to develop 
and provide to the Secretary of Health and Human Services risk-based, 
performance-based cybersecurity standards for the Federal information 
technology requirements under the Patient Protection and Affordable 
Care Act, including the healthcare.gov website, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JANUARY 10, 2014 
Mr. BARBER (for himself, Mr. DAINES, and Ms. SINEMA) introduced the fol-
lowing bill; which was referred to the Committee on Energy and Com-
merce, and in addition to the Committee on Oversight and Government 
Reform, for a period to be subsequently determined by the Speaker, in 
each case for consideration of such provisions as fall within the jurisdic-
tion of the committee concerned 
A BILL 
To require the Secretary of Homeland Security the responsi-
bility to develop and provide to the Secretary of Health 
and Human Services risk-based, performance-based cy-
bersecurity standards for the Federal information tech-
nology requirements under the Patient Protection and 
Affordable Care Act, including the healthcare.gov 
website, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Mar 15 2010 
02:01 Jan 11, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3847.IH
H3847
tjames on DSK6SPTVN1PROD with BILLS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cyber Awareness and 
Recovery Enhancement Act of 2013’’ or the ‘‘CARE Act 
of 2013’’. 
SEC. 2. CYBERSECURITY FOR HEALTHCARE.GOV WEBSITE. 
(a) IN
GENERAL.—Notwithstanding the require-
ments of the Federal Information Security Management 
Act of 2002 (44 U.S.C. 3531 et seq.) or any other provi-
sion of law, not later than 90 days after the date of the 
enactment of this Act, the Secretary of Homeland Security 
shall develop and provide to the Secretary of Health and 
Human Services risk-based, performance-based cybersecu-
rity standards for the Federal information technology re-
quirements under the Patient Protection and Affordable 
Care 
Act 
(Public 
Law 
111–148), 
including 
the 
healthcare.gov website (or any successor website). Such 
standards shall be based on cybersecurity best practices, 
and on homeland security information that the Secretary 
of Homeland Security has collected, analyzed, and dis-
seminated about cyber threats, vulnerabilities, and con-
sequences. 
(b) CONSULTATION.—In carrying out the cybersecu-
rity standards described in subsection (a), the Secretary 
of Homeland Security shall consult with the Secretary of 
Health and Human Services. 
VerDate Mar 15 2010 
02:01 Jan 11, 2014
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3847.IH
H3847
tjames on DSK6SPTVN1PROD with BILLS
(c) IMPLEMENTATION
AND
ENFORCEMENT.—Not 
later than 90 days after receiving the cybersecurity stand-
ards described in subsection (a), the Secretary of Health 
and Human Services shall adopt and implement such cy-
bersecurity standards. 
(d) ENFORCEMENT.—The Secretary of Health and 
Human Services shall submit to Congress an annual re-
port on cyber incidents relating to the Federal information 
technology requirements under the Patient Protection and 
Affordable Care Act, including the healthcare.gov website 
(or any successor website). 
Æ 
VerDate Mar 15 2010 
02:01 Jan 11, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6301
E:\BILLS\H3847.IH
H3847
tjames on DSK6SPTVN1PROD with BILLS