Grants to enhance cybersecurity in the health and public health sectors

Part P of title III of the Public Health Service Act (42 U.S.C. 280g et seq.) is amended by adding at the end the following: 399V–8. Grants (a) In general The Secretary may award grants to eligible entities for the adoption and use of cybersecurity best practices. (b) Eligible entity To be eligible to receive a grant under subsection (a) an entity shall be— (1) a public or nonprofit private health center (including a Federally qualified health center (as defined in section 1861(aa)(4) of the Social Security Act)); (2) a health facility operated by or pursuant to a contract with the Indian Health Service; (3) a hospital; (4) a cancer center; (5) a rural health clinic; (6) an academic health center; or (7) a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs (1) through (6). (c) Use of funds In adopting and using cybersecurity best practices pursuant to a grant under subsection (a), an eligible entity may use grant funds— (1) to hire and train personnel in such cybersecurity best practices; (2) to update electronic data systems, such as by migrating to cloud based platforms; (3) to join and participate in health cybersecurity threat information sharing organizations; (4) to reduce the use of legacy systems; and (5) to contract with third parties to assist with the activities described in paragraphs (1) through (5). (d) Grant period The Secretary may award a grant under this section for a period of not more than 3 years. (e) Application An eligible entity seeking a grant under subsection (a) shall submit to the Secretary an application at such time, in such manner, and containing such information as the Secretary may require including, at a minimum a description of how the eligible entity will establish baseline measures and benchmarks that meet the Secretary’s requirements to evaluate program outcomes. (f) Authorization of appropriations There are authorized to be appropriated to carry out this section such sums as may be necessary for each of fiscal years 2025 through 2030..

Part P of title III of the Public Health Service Act (42 U.S.C. 280g et seq.) is amended by adding at the end the following: 399V–8. Grants (a) In general The Secretary may award grants to eligible entities for the adoption and use of cybersecurity best practices. (b) Eligible entity To be eligible to receive a grant under subsection (a) an entity shall be— (1) a public or nonprofit private health center (including a Federally qualified health center (as defined in section 1861(aa)(4) of the Social Security Act)); (2) a health facility operated by or pursuant to a contract with the Indian Health Service; (3) a hospital; (4) a cancer center; (5) a rural health clinic; (6) an academic health center; or (7) a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs (1) through (6). (c) Use of funds In adopting and using cybersecurity best practices pursuant to a grant under subsection (a), an eligible entity may use grant funds— (1) to hire and train personnel in such cybersecurity best practices; (2) to update electronic data systems, such as by migrating to cloud based platforms; (3) to join and participate in health cybersecurity threat information sharing organizations; (4) to reduce the use of legacy systems; and (5) to contract with third parties to assist with the activities described in paragraphs (1) through (5). (d) Grant period The Secretary may award a grant under this section for a period of not more than 3 years. (e) Application An eligible entity seeking a grant under subsection (a) shall submit to the Secretary an application at such time, in such manner, and containing such information as the Secretary may require including, at a minimum a description of how the eligible entity will establish baseline measures and benchmarks that meet the Secretary’s requirements to evaluate program outcomes. (f) Authorization of appropriations There are authorized to be appropriated to carry out this section such sums as may be necessary for each of fiscal years 2025 through 2030..