Cybersecurity incident reporting coordination working group

(a) Working group (1) In general Not later than 1 year after the date of enactment of this Act, the Secretary shall convene a working group to examine how to streamline and reduce duplicative reporting for cybersecurity incidents. (2) Membership The working group described in paragraph (1) shall include representatives of— (A) the Cybersecurity and Infrastructure Security Agency; (B) the Securities and Exchange Commission; (C) the Office of the National Cyber Director; (D) the Federal Bureau of Investigation; (E) the Federal Trade Commission; (F) State attorneys general; (G) State health departments; and (H) private sector health care entities. (3) Conclusion The working group shall conclude not later than 18 months after the date of the first meeting of the working group. (b) Report Not later than 1 year after the conclusion of the working group under subsection (a)(3), the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that— (1) identifies areas the working group has identified to streamline and reduce duplicative reporting; (2) includes recommendations to Congress on further streamlining such reporting; and (3) addresses coordination with State breach notification laws.