Clarifying cybersecurity responsibilities at the Department of Health and Human Services

Part A of title III of the Public Health Service Act (42 U.S.C. 241 et seq.) is amended by adding at the end the following: 310C. Oversight of cybersecurity activities (a) In general The Secretary, acting through the Assistant Secretary for Preparedness and Response, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency pursuant shall delegate a representative to section 2218 of the Homeland Security Act of 2002, shall lead oversight and coordination of activities within the Department of Health and Human Services to support internal and external cybersecurity resiliency resilience within the Healthcare and Public Health Sector (as defined in section 2 of the Health Care Cybersecurity and Resiliency Act of 2025), Sector, including coordination and communication with other public and private entities related to preparedness for, and responses to, cybersecurity incidents, consistent with applicable provisions of this Act, the Public Health Service Act (42 U.S.C. 201 et seq.), other applicable laws, and Presidential Policy Directive 21 (February 12, 2013; National Security Memorandum–22 (April 30, 2024; relating to critical infrastructure security and resilience)..resilience). Such activities shall not include implementation or enforcement of part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or successor regulations) (commonly known as the HIPAA Security Rule). (b) Reports (1) Report on delegation Not later than 60 days after delegating a representative under subsection (a), and any time a new representative is delegated under such subsection, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that describes how such representative will implement steps to improve internal and external cybersecurity resilience within the Healthcare and Public Health Sector. (2) Annual report Not later than 1 year after the date of enactment of this Act, and annually thereafter, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report on the state of cybersecurity in the Healthcare and Public Health Sector, including— (A) an assessment of the most significant cybersecurity threats and vulnerabilities facing the Healthcare and Public Health Sector; (B) a summary of major cybersecurity incidents affecting the Healthcare and Public Health Sector during the preceding year; (C) an assessment of the overall cybersecurity posture of the Healthcare and Public Health Sector; (D) a description of actions taken by the Department of Health and Human Services to improve cybersecurity; and (E) recommendations to improve Healthcare and Public Health Sector cybersecurity.