Required cybersecurity standards

(a) In general The Secretary shall update the security regulations under part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or any successor regulation), to require non-governmental entities in the Healthcare and Public Health Sector and covered entities and business associates to adopt minimum risk-based cybersecurity practices, including— (1) multifactor authentication, or a successor technology; (2) encryption of protected health information, or a successor technology; (3) requirements to conduct monitoring, including penetration testing, to maintain the protections of information systems; and (4) other minimum cybersecurity standards, as reflected in national cybersecurity frameworks. (b) Requirements The minimum risk-based cybersecurity practices adopted pursuant to subsection (a) shall be based on— (1) national cybersecurity frameworks, as appropriate, such as— (A) the National Institute of Standards and Technology Risk Management Framework (or a successor framework); (B) the National Institute of Standards and Technology Cybersecurity Framework (or a successor framework); (C) the National Institute of Standards and Technology SP 800–53 r5 Security and Privacy Controls for Information Systems and Organizations (or a successor special publication), with relevant components of the National Institute of Standards and Technology Privacy Framework; or (D) the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework; (2) the Health Sector Coordinating Council Cybersecurity Healthcare and Public Health Cybersecurity Performance Goals; and (3) the health care-specific cybersecurity performance goals of the Cybersecurity and Infrastructure Security Agency. (c) Effective dates The regulations updated in accordance with subsection (a), including each new requirement established, shall take effect on the date that is 36 months after the date of enactment of this Act. (d) Enforcement The Secretary may exercise enforcement discretion for entities experiencing extraordinary circumstances in complying with the requirements of subsection (a).