Grants to enhance cybersecurity in the health and public health sectors

(a) In general The Secretary may award grants to eligible entities for the adoption and implementation of cybersecurity best practices. (b) Eligible entity To be eligible to receive a grant under subsection (a), an entity shall be— (1) a Federally qualified health center (as defined in section 1861(aa)(4) of the Social Security Act (42 U.S.C. 1395x(aa)(4))); (2) a health facility operated by or pursuant to a contract with the Indian Health Service; (3) a nonprofit hospital; (4) a rural health clinic (as defined in section 1861(aa)(2) of the Social Security Act (42 U.S.C. 1395x(aa)(2))); or (5) a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs (1) through (4). (c) Use of funds In adopting and implementing cybersecurity best practices pursuant to a grant under subsection (a), an eligible entity may use grant funds— (1) to hire individuals with demonstrated cybersecurity expertise and train personnel in such cybersecurity best practices; (2) to update electronic data systems, such as by migrating to cloud-based platforms; (3) to join and participate in health cybersecurity threat information sharing organizations; (4) to contract with third parties to assist the eligible entity in carrying out the activities described in this subsection; (5) to conduct cybersecurity risk assessments and vulnerability assessments; and (6) to develop or improve cybersecurity incident response plans. (d) Grant period A grant awarded under this section shall be for a period of not more than 3 years. (e) Priority In awarding grants under this section, the Secretary may give consideration to the demonstrated need of eligible entities. (f) Application An eligible entity seeking a grant under subsection (a) shall submit to the Secretary an application at such time, in such manner, and containing such information as the Secretary may require, including— (1) a description of how the eligible entity will establish baseline measures and benchmarks that meet the Secretary’s requirements to evaluate performance outcomes; and (2) a strategic plan for how, after the end of the grant period, the eligible entity will sustain the activities funded under the grant and continue to adopt cybersecurity best practices.