157 
§ 10593. Improving cybersecurity in the health care industry 
(a) DEFINITIONS.—In this section: 
(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term ‘‘appro-
priate congressional committees’’ means— 
(A) the Committee on Health, Education, Labor, and Pensions, 
the Committee on Homeland Security and Governmental Affairs, 
and the Select Committee on Intelligence of the Senate; and 
(B) the Committee on Energy and Commerce, the Committee 
on Homeland Security, and the Permanent Select Committee on 
Intelligence of the House of Representatives. 
(2) BUSINESS ASSOCIATE.—The term ‘‘business associate’’ has the 
meaning given the term in section 160.103 of title 45, Code of Federal 
Regulations (as in effect on December 17, 2015). 
(3) COVERED ENTITY.—The term ‘‘covered entity’’ has the meaning 
given the term in section 160.103 of title 45, Code of Federal Regula-
tions (as in effect on December 17, 2015). 
(4) CYBERSECURITY THREAT; CYBER THREAT INDICATOR; DEFEN-
SIVE MEASURE; FEDERAL ENTITY.—The terms ‘‘cybersecurity threat’’, 
‘‘cyber threat indicator’’, ‘‘defensive measure’’, and ‘‘Federal entity’’ 
have the meanings given the terms in section 10561 of this title. 
(5) HEALTH
CARE
CLEARINGHOUSE; HEALTH
CARE
PROVIDER; 
HEALTH PLAN.—The terms ‘‘health care clearinghouse’’, ‘‘health care 
provider’’, and ‘‘health plan’’ have the meanings given the terms in sec-
tion 160.103 of title 45, Code of Federal Regulations (as in effect on 
December 17, 2015). 
(6) HEALTH
CARE
INDUSTRY
STAKEHOLDER.—The term ‘‘health 
care industry stakeholder’’ means any— 
(A) health plan, health care clearinghouse, or health care pro-
vider; 
(B) advocate for patients or consumers; 
(C) pharmacist; 
(D) developer or vendor of health information technology; 
(E) laboratory; 
(F) pharmaceutical or medical device manufacturer; or 
(G) additional stakeholder the Secretary determines necessary 
for purposes of subsection (b)(1), (c)(1), (c)(3), or (d)(1). 
(7) NON-FEDERAL ENTITY; PRIVATE ENTITY.—The terms ‘‘non-Fed-
eral entity’’ and ‘‘private entity’’ have the meanings given the terms 
in section 10561 of this title. 
(b) REPORT.— 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00157
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
158 
(1) IN GENERAL.—Not later than December 18, 2016, the Secretary 
of Health and Human Services shall submit to the Committee on 
Health, Education, Labor, and Pensions of the Senate and the Com-
mittee on Energy and Commerce of the House of Representatives a re-
port on the preparedness of the Department of Health and Human 
Services and health care industry stakeholders in responding to cyber-
security threats. 
(2) CONTENTS OF REPORT.—With respect to the internal response 
of the Department of Health and Human Services to emerging cyberse-
curity threats, the report under paragraph (1) shall include— 
(A) a clear statement of the official in the Department of 
Health and Human Services to be responsible for leading and co-
ordinating efforts of the Department of Health and Human Serv-
ices regarding cybersecurity threats in the health care industry; 
and 
(B) a plan from each relevant operating division and subdivision 
of the Department of Health and Human Services on how the di-
vision or subdivision will address cybersecurity threats in the 
health care industry, including a clear delineation of how each the 
division or subdivision will divide responsibility among the per-
sonnel of the division or subdivision and communicate with other 
divisions and subdivisions regarding efforts to address the threats. 
(c) HEALTH CARE INDUSTRY CYBERSECURITY TASK FORCE.— 
(1) IN GENERAL.—The Secretary of Health and Human Services, in 
consultation with the Director of the National Institute of Standards 
and Technology and the Secretary of Homeland Security, shall convene 
health care industry stakeholders, cybersecurity experts, and any Fed-
eral agencies or entities the Secretary of Health and Human Services 
determines appropriate to establish a task force to— 
(A) analyze how industries, other than the health care industry, 
have implemented strategies and safeguards for addressing cyber-
security threats in their respective industries; 
(B) analyze challenges and barriers private entities (excluding 
any State, tribal, or local government) in the health care industry 
face securing themselves against cyberattacks; 
(C) review challenges that covered entities and business associ-
ates face in securing networked medical devices and other software 
or systems that connect to an electronic health record; 
(D) provide the Secretary of Health and Human Services with 
information to disseminate to health care industry stakeholders of 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00158
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
159 
all sizes for purposes of improving their preparedness for, and re-
sponse to, cybersecurity threats affecting the health care industry; 
(E) establish a plan for implementing part B of this subchapter, 
so that the Federal Government and health care industry stake-
holders may in real time, share actionable cyber threat indicators 
and defensive measures; and 
(F) report to the appropriate congressional committees on the 
findings and recommendations of the task force regarding carrying 
out subparagraphs (A) through (E). 
(2) TERMINATION.—The task force established under this subsection 
shall terminate 1 year after the date on which the task force is estab-
lished. 
(3) DISSEMINATION.—Not later than 60 days after the termination 
of the task force established under this subsection, the Secretary of 
Health and Human Services shall disseminate the information de-
scribed in paragraph (1)(D) to health care industry stakeholders in ac-
cordance with paragraph (1)(D). 
(d) ALIGNING HEALTH CARE INDUSTRY SECURITY APPROACHES.— 
(1) IN GENERAL.—The Secretary of Health and Human Services 
shall establish, through a collaborative process with the Secretary of 
Homeland Security, health care industry stakeholders, the Director of 
the National Institute of Standards and Technology, and any Federal 
entity or non-Federal entity the Secretary of Health and Human Serv-
ices determines appropriate, a common set of voluntary, consensus- 
based, and industry-led guidelines, best practices, methodologies, proce-
dures, and processes that— 
(A) serve as a resource for cost-effectively reducing cybersecu-
rity risks for a range of health care organizations; 
(B) support voluntary adoption and implementation efforts to 
improve safeguards to address cybersecurity threats; 
(C) are consistent with— 
(i) the standards, guidelines, best practices, methodologies, 
procedures, and processes developed under section 2(c)(15) of 
the National Institute of Standards and Technology Act (15 
U.S.C. 272(c)(15)); 
(ii) the security and privacy regulations promulgated under 
section 264(c) of the Health Insurance Portability and Ac-
countability Act of 1996 (42 U.S.C. 1320d–2 note); and 
(iii) the provisions of the Health Information Technology 
for Economic and Clinical Health Act (Public Law 111–5, 
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00159
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS
160 
div. A, title XIII, div. B, title IV, 123 Stat. 226, 467), and 
the amendments made by the Act; and 
(D) are updated on a regular basis and applicable to a range 
of health care organizations. 
(2) LIMITATION.—Nothing in this subsection shall be interpreted as 
granting the Secretary of Health and Human Services authority to— 
(A) provide for audits to ensure that health care organizations 
are in compliance with this subsection; or 
(B) mandate, direct, or condition the award of any Federal 
grant, contract, or purchase, on compliance with this subsection. 
(3) NO LIABILITY FOR NONPARTICIPATION.—Nothing in this section 
shall be construed to subject a health care industry stakeholder to li-
ability for choosing not to engage in the voluntary activities authorized, 
or guidelines developed, under this subsection. 
(e) INCORPORATING ONGOING ACTIVITIES.—In carrying out the activities 
under this section, the Secretary of Health and Human Services may incor-
porate activities that are ongoing as of December 17, 2015, and that are 
consistent with the objectives of this section. 
(f) RULE OF CONSTRUCTION.—Nothing in this section shall be construed 
to limit the antitrust exemption under section 10563(e) of this title or the 
protection from liability under section 10565 of this title. 
Subchapter IV—Supporting Anti-Terrorism 
by Fostering Effective Technologies 
§ 10621. Definitions 
In this subchapter: 
(1) ACT OF TERRORISM.—The term ‘‘act of terrorism’’ means an act 
that the Secretary determines meets all of the following requirements, 
as the requirements are further defined and specified by the Secretary: 
(A) The act is unlawful. 
(B) The act causes harm to a person, property, or entity, in the 
United States, or in the case of a domestic United States air car-
rier or a United States-flag vessel (or a vessel based principally 
in the United States on which United States income tax is paid 
and whose insurance coverage is subject to regulation in the 
United States), in or outside the United States. 
(C) The act uses or attempts to use instrumentalities, weapons, 
or other methods designed or intended to cause mass destruction, 
injury, or other loss to citizens or institutions of the United 
States. 
(2) INSURANCE CARRIER.—The term ‘‘insurance carrier’’ means a 
corporation, association, society, order, firm, company, mutual, part-
VerDate Sep 11 2014 
18:05 Jun 12, 2018
Jkt 079200
PO 00000
Frm 00160
Fmt 6652
Sfmt 6221
E:\BILLS\H6063.IH
H6063
pamtmann on DSKBFK8HB2PROD with BILLS