I 
115TH CONGRESS 
1ST SESSION H. R. 4191 
To amend the Public Health Service Act to authorize the Secretary of Health 
and Human Services to designate an officer within the Department 
of Health and Human Services as having primary responsibility for 
the information security (including cybersecurity) programs of the De-
partment, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
OCTOBER 31, 2017 
Mr. LONG (for himself and Ms. MATSUI) introduced the following bill; which 
was referred to the Committee on Energy and Commerce 
A BILL 
To amend the Public Health Service Act to authorize the 
Secretary of Health and Human Services to designate 
an officer within the Department of Health and Human 
Services as having primary responsibility for the informa-
tion security (including cybersecurity) programs of the 
Department, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘HHS Cybersecurity 
Modernization Act’’. 
VerDate Sep 11 2014 
23:43 Nov 02, 2017
Jkt 079200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4191.IH
H4191
lotter on DSKBCFDHB2PROD with BILLS
SEC. 2. INFORMATION SECURITY. 
(a) AUTHORITY TO DESIGNATE CHIEF INFORMA-
TION SECURITY OFFICER.—Title II of the Public Health 
Service Act is amended by inserting after section 229 of 
such Act (42 U.S.C. 237a) the following: 
‘‘SEC. 229A. AUTHORITY TO DESIGNATE CHIEF INFORMA-
TION SECURITY OFFICER. 
‘‘Notwithstanding any other provision of law— 
‘‘(1) the Secretary may designate an officer 
within the Department as having primary responsi-
bility for the information security (including cyberse-
curity) programs of the Department; 
‘‘(2) any such designated officer shall report di-
rectly to the Secretary or directly to another senior 
officer within the Department of the Secretary’s 
choosing; and 
‘‘(3) the Secretary may transfer the functions, 
personnel, assets, and liabilities of the Chief Infor-
mation Security Officer in the Office of the Chief In-
formation Officer of the Department of Health and 
Human Services, as such position exists on Sep-
tember 30, 2017, to such designated officer.’’. 
(b) REPORT.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act, the Secretary of 
Health and Human Services shall develop and sub-
VerDate Sep 11 2014 
23:43 Nov 02, 2017
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4191.IH
H4191
lotter on DSKBCFDHB2PROD with BILLS
mit to the Committee on Energy and Commerce of 
the House of Representatives and the Committee on 
Health, Education, Labor, and Pensions of the Sen-
ate a plan on the role of the Department of Health 
and Human Services (in this subsection referred to 
as the ‘‘Department’’) in preparing for and respond-
ing to cybersecurity threats. 
(2) CONTENTS.—The plan under paragraph (1) 
shall— 
(A) differentiate between— 
(i) the responsibilities of the Depart-
ment overall and each of its agencies and 
offices in maintaining the security and in-
tegrity of their respective information sys-
tems; and 
(ii) the responsibilities of the Depart-
ment overall and each of its agencies and 
offices in regulating and providing guid-
ance, information, education, training, and 
assistance to the health care sector; 
(B) specify how the Department overall 
and each of its agencies and offices delineates 
between the responsibilities described in sub-
paragraph (A)(i) and those described in sub-
VerDate Sep 11 2014 
23:43 Nov 02, 2017
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4191.IH
H4191
lotter on DSKBCFDHB2PROD with BILLS
paragraph (A)(ii) through organization, per-
sonnel, policies, and procedures; 
(C) address the coordination of the respon-
sibilities described in subparagraph (A)(i) and 
those described in subparagraph (A)(ii) across 
the agencies and offices of the Department; 
(D) address any types of conflicts that can 
arise (within the Department or the health care 
sector) because of the Department having both 
the responsibilities described in subparagraph 
(A)(i) and those described in subparagraph 
(A)(ii); 
(E) differentiate between— 
(i) the role of the Department in reg-
ulating the health care sector; and 
(ii) the role of the Department as a 
Sector-Specific Agency for the health care 
sector under Presidential Policy Directive 
21 (signed on February 12, 2013); and 
(F) specify how the Department delineates 
between the role described in subparagraph 
(E)(i) and the role described in subparagraph 
(E)(ii) through organization, personnel, policies, 
and procedures. 
VerDate Sep 11 2014 
23:43 Nov 02, 2017
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4191.IH
H4191
lotter on DSKBCFDHB2PROD with BILLS
(c) NO
ADDITIONAL
APPROPRIATIONS
AUTHOR-
IZED.—No additional funds are authorized to be appro-
priated to carry out this Act, or the amendments made 
by this Act. This Act, and the amendments made by this 
Act, shall be carried out using amounts otherwise author-
ized or appropriated. 
Æ 
VerDate Sep 11 2014 
23:43 Nov 02, 2017
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H4191.IH
H4191
lotter on DSKBCFDHB2PROD with BILLS