Security requirements

(a) In general Section 1173(d)(1) of the Social Security Act (42 U.S.C. 1320d–2(d)(1)) is amended— (1) in subparagraph (A), by redesignating clauses (i) through (v) as subclauses (I) through (V) respectively and indenting appropriately; (2) by redesignating subparagraphs (A) and (B) as clauses (i) and (ii) respectively and indenting appropriately; (3) by striking Security Standards.—The Secretary and inserting the following: Minimum Security Standards.— (A) In general The Secretary; (4) in subparagraph (A), as added by paragraph (3)— (A) in clause (i)(V), by striking and at the end; (B) in clause (ii), by striking the period at the end and inserting; and; and (C) by adding at the end the following new clause: (iii) include minimum and enhanced security requirements adopted under subparagraph (B); and (5) by adding at the end the following new subparagraph: (B) Minimum and enhanced security requirements (i) Adoption Subject to clauses (iii) and (iv), in order to protect health information, protect patient safety, and ensure the availability and resiliency of health care information systems and health care transactions, the Secretary shall adopt— (I) minimum security requirements for covered entities and business associates; and (II) enhanced security requirements for covered entities and business associates that— (aa) are of systemic importance, as determined by the Secretary; or (bb) are important to national security, as determined by the Secretary, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of National Intelligence. (ii) Application of enhanced security requirements (I) Notification The Secretary shall, at a time and in a manner determined appropriate by the Secretary, notify each covered entity and business associate that is subject to the enhanced security requirements under clause (i)(II). (II) Limitation on review There shall be no administrative or judicial review under section 1869, 1878, or otherwise of the methodology the Secretary uses to determine whether a covered entity or business associate is subject to the enhanced security requirements under clause (i)(II). (iii) Factors In addition to the factors described in subparagraph (A)(i), in developing— (I) the minimum security requirements under clause (i)(I), the Secretary shall, in consultation with the Director of Cybersecurity and Infrastructure Security Agency and the Director of National Intelligence, design the requirements to prevent— (aa) cyber incidents utilizing the tools and strategies used to target covered entities or business associates; (bb) the potential harms, as defined by the Secretary, to national security that could result from a cyber incident involving a covered entity or business associate; (cc) the potential harms, as defined by the Secretary, to patients that could result from a cyber incident involving a covered entity or business associate; and (dd) other potential harms from cyber incidents, as determined appropriate by the Secretary; and (II) the enhanced security requirements under clause (i)(II), the Secretary shall, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of National Intelligence, design the requirements to prevent the potential harms described in subclause (I) and protect against the specific threats the covered entities and business associates described in such clause face. (iv) Review and update of requirements The Secretary shall review and update the minimum and enhanced security requirements adopted under clause (i) not less frequently than every 2 years. (v) Effective date and rulemaking (I) Effective date The requirements under this subparagraph shall take effect on the date that is 2 years after the date of enactment of this subparagraph. (II) Rulemaking Not later than 18 months after the date of enactment of this subparagraph, the Secretary shall promulgate regulations to carry out this subparagraph. (vi) Definitions For purposes of this subsection: (I) Business associate The term business associate has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation). (II) Covered entity The term covered entity has the meaning given that term in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation). (III) Systemic importance The term systemic importance means, with respect to a covered entity or business associate, that the failure of, or a disruption to, such entity or associate would have a debilitating impact on access to health care or the stability of the health care system of the United States (as determined by the Secretary).. (b) Availability of health information Section 1173(d)(2)(A) of the Social Security Act (42 U.S.C. 1320d–2(d)(2)(A)) is amended by striking the integrity and confidentiality and inserting “the availability, integrity, and confidentiality.