An Act Requiring
Maine Legislature, Session 132, LD 2103
Committee Amendment CA_A_H937 (House)
Amends: 22 MRSA §1832

COMMITTEE AMENDMENT "/^ " to H.P. 1418, L.D. 2103, "An Act Requiring
Hospitals to Adopt Cybersecurity Plans"
Amend the bill by striking out everything after the enacting clause and inserting the
following:
'See. 1. 22 MRSA §1832, as enacted by PL 2011,c. 254, §1 and affected by §2, is
repealed and the following enacted in its place:
§1832. Safehr and security in hospitals: cvbersecuritv
1. Safety and security plan. A hospital licensed under this chapter shall.on an annual
basis, adopt a safety and security plan to protect the pa.tjents. visitors and emplovees of the
hospital from aeeressive and violent behavior. The safety and security plan must include
a process for hospitals to receive and record incidents and threats of violent behauor
occurring at or arising out of employment at the hospital. The safety and security plan must
prohibit a representative or employee of the hospital from interferine with a person makine
a report as provided in the olan.
2. Cvbersecurihr plan. A hospital licensed under this chapter shall adopt a
cvbersecuritv plan. The cvbersecuritv plan must be consistent with^^^te^ practices
established by the United States Department of Homeland Security. Cvbersecuritv and
Infrastructure Security Agency; the United States Department of Commerce^National
Institute of Standards and Technoloev; and the Healthcare and Public Health Sector
Coordinatme Council or its successor oreanization. The cvbersecuritv olan must be
consistent with applicable federal laws and resMlations. includme the federal Health
Insurance Portability and Accountability Act of 1996. The hospital shall review the
cvbersecuritv plan at least once peryear and. ifreauested bv the deoartment. immediately
submit the most current plan to the department.
A. As used in this subsection, the followme terms have the following meanines.
d) "Cvbersecuritv" means the process of Dreventmgjmauthorized modification.
misuse pr denial of use. or the unauthorized use, of information that is stored.
accessed or transferred from an electronic device to an external recipient.
COMMITTEE AMENDMENT
^os
COMMITTEE AMENDMENT 'X4, " to H,P. 1418, L.D. 2103
(2} "Cvbersecuritv intmsion" means an unwanted intrusion into a computer system
that impacts patient care. protected health information or hospital security..
C3) "Security incident" means the attempted or successful unauthorized access,
use. disclosure, modification or destruction of information or interference with
system operations in a computer system.
(4~) "Security incident response plan" means the part of a cvbersecuritv plan
adopted by a hospital detailine how a hospital employee must report suspected or
known security incidents and how a hospital will respond to suspected or known
security incidents.
B. The cvbersecurifrv plan must include. at a minimum:
d) A urovision for the timely notification, by electronic means and by mail. of a
cvbersecuritv intmsion to aporooriate parties. includuie. but not limited to. law
enforcement agencies, patients, municioalities, state regulators, media and hospital
employees. The hospital shall include jn_all_m.ibUc commumcations related to the
cvbersecuritv intmsion information reearding patient riehts and the contact
information for reeisterine a patient complaint:
f2) A backup communication response provision that ensures continuity of care
for uatients in the event ofadisniDtion ofhosoital comouter systems caused bv a
cvbersecuritv intmsion or a natural or human-made disaster and that includes a
complaint process for patients who are experiencing cha.llenges accessine medical
care and a system to triaee patient complamts. includme:
fa) A requirement that emereent concerns receive a response within 48 hours
of the submission of the complaint and that nonemergent concerns receive a
response within 7 days of the submission of the complaint. For the ourooses of
this division, emereent concern" means a condition that reauires immediate
attention, or action due to its serious or life-threatening nature: and
fb) A requirement for the timely manaeement of comDlaints related_to
prescriptions;
(3) A provision reauirine that all manually charted records be timely inteerated
into the hospital's electronic record system:
(4~) A provision to ensure proper triaee of hospital serYJces in the event of a.
disruption of hospital computer systems. includine:
Ca) A provision for the aDoropriate triaee of^ll hosmtaLservices. including
elective procedures, based on hospital capacities and patient needs:
(b} A provision for the diversion of hospital services as necessary, includine
6 assisting patients in an-anging emergency and nonemereencv transoortation
services to access health care not available at the hospital as a result of the
cvbersecuritv intrusion: and
fc) A requirement for the hospital to enter into written aereements^with_^
sufficient number of other health care providers to facilitate continuity of care
for patients during the disruution;
COMMITTEE AMENDMENT
¥tOS
COMMITTEE AMENDMENT "M " to H.P. 1418, L.D. 2103
(5} A written security mcident response plan documentine how hospital employees
are to report suspected or known security incidents and how the hospital will
respond clinically to suspected or Imown security incidents. The security incident
response plan must include crovisions detailine how hospital employees can
effectively communicate with one_another and witiioutside medical providers in
Ae_eventjiosmtal electronic systems are not operative. The security incident
resoonse plan must be made available to all hosoital emulovees;
C6) A provision for. at a minimum, annual cvbersecurity training for hospital
employees, hospital board members and oreanizations affiliated with the hospital.
including new emolovee and annual tramine for all hospital emplovees who use
electronic health recordsystems for__Batient care. The training must mclude
information relating to the management of patient records in the event of unplanned
downtime of the hospital's electronic health record system, mcludine tramine on
paper chartine:
f7) A requirement that the hospital perform an annual test involvine all hospital
shifts and units of downtime procedures for the hospital's cvbersecuritv plan and a
requirement that all downtime paperwork be reviewed and updated at the time of
the annual test. This requirement is waived if the hospital experiences a security
incident durine the prior year and conducted a oost-incident review in accordance
with subDaraeraoh (11). For the UUTDOSCS of this suboaraBraDh. downtime
paperwork" means documentation a hospital maintains to ensure care can be
documented manually when a hospital's computer systems are not ODeratiYe;
(S) Written procedures for testine and revisiae the cvbersecuritv plan. includine:
fa) A requirement that the hospital oerform an annual review of the criticalitv
of its information systems and technoloev assets to determine the orioritv for
restoration:
Cb) A requirement that the hospital perform a tabletop simulation of a security
incident resulting in the disruution of hospital computer systems: and
fc)^requiremenLthat the hosBit^ continuous vulnerabiUty scans and
annual penetration testing to identify network vuhierabilities;
(9) A provision for timelv restoration of communication with the state-desienated
statewide health information exchange described in section 1711-C. subsection 18.
This subuaraeraoh does not impose additional duties, standards or reeulatory
oblieations on the state-desienated statewide health information exchange;
{10) A provision reauirine the review of the hosmtalsresponse to^anv security
incidents that have taken place at the hospital since January 1.2024. As part of the
review, the hospital shall produce a report that includes a part that describes the
lessons learned from the security incidents and a description of any actions taken
by the hosmtal to prevent future security incidents and to mitigate the hami caused
bv similar events. The report must include information reearding the involvement
of security consultants, law enforcement and cvbersecuritv insurance Droviders;
and
d I) A provision reauirine the hospital to conduct a timely post-incident review
of any security incident experienced by the hospital. The review must include an
COMMIUEE AMENDMENT
COMMTTTEE AMENDMENT "f-\ " to H.P. 1418, L.D. 2103
evaluation of the effectiveness of the hospital's cybersecurity plan and timely
revision of any required updates to the plan.
C. The cvbersecuritv plan must be developed and maintained with the input of an
annual working group convened by the hospital that includes health care workers
employed by the hosuital and_thosejyQrkerst labor unions,
D. A hosoital licensed under this chaoter shall maintain ohvsical cooies of all forms
and other paperwork required to maintain continuity of care durine a dismotion of
hospital computer systems.
E. A hospital licensed under this chapter shall annuaUv submit the hospital's
cvberseouritv plan to an audit by an independent, certified cvbersecuritv auditor or
certified cvbersecuritv expert to determine the adequacy of the cvbersecuritv nlan and
identify any necessary imorovements to the ulan and processes. The hospital shall
submit a hieh-level summary of the results of each audit to the department upon the
request of the department.
F. A hospital licensed under this chapter shall make available to hospital employees
and the public information reeardine how to file a comolaint under the comolaint
process developed pursuant tODaragraRhB^ubDaragraph (2). including bv posting this
information in oublic areas of the hosnital.
G. In the event of a cvbersecuritv incident, a hosmtal licensed under this chaBtershall
coordinate with persounel from the Maine Center for Disease Control and Prevention
and shall allow such personnel access to the hosoital facility. The State shall indemnify
and hold the hospital harmless for the actions of state personnel related to the
cvbersecuritv incident response.
H. A cvbersecuritv olan submitted to the deoartment under this section and the hie:h-
level summary of the results of an audit submitted to the department in accordance with
oaraerauh E are confidential only to the extent that release of information contained m
the record could reasonably be expected to jeopardize the physical safety of
government personnel or the public, as determined by the department.
3. Statutory construction. This section may not be constmed or aooUed to be less
restrictive than or in a manner that conflicts with applicable federal law and related
reeulations. This section may be construed or aoolied to be more restrictive than federal
law.
4. Effective date. This section takes effect January 1. 2027.'
Amend the bill by relettering or renumbering any nonconsecutive Part letter or section
number to read consecutively.
SUMMARY
This amendment replaces the bill. The amendment requires hospitals, beginning
January 1, 2027, to adopt a cybersecurity plan that is consistent with best practices
established by fhe United States Department of Homeland Security, Cybersecurity and
Infrastructure Security Agency; the United States Department of Commerce, National
Institute of Standards and Technology; and the Healthcare and Public Health Sector
Coordinating Council or its successor organization. The amendment establishes
COMMITTEE AMENDMENT
A"
COMMITTEE AMENDMENT "/^" to H.P. 1418, L.D. 2103
requirements regarding testing and revising such plans, training of employees, post-
incident review, auditing and confidentiality.
COMMITTEE AMENDMENT