PRIA Logo™
119-hr-3841119th CongressWALLET

Healthcare Cybersecurity Act of 2025

Sponsored By: Representative Crow, Jason [D-CO-6]

In Committee

Summary

Strengthen cybersecurity for the Healthcare and Public Health Sector. This bill would make the Cybersecurity and Infrastructure Security Agency (CISA) the primary coordinator with the Department of Health and Human Services and require a sector risk management plan, training, reporting, and a system to prioritize high-risk health assets.

Show full summary
  • Patients and families: Would see added protections for sensitive patient health information and electronic health records through required risk assessments and sector-specific safeguards.
  • Owners and operators of covered healthcare assets: Would get CISA training, a dedicated Agency liaison, and an updated Sector-Specific Risk Management Plan within 1 year that emphasizes rural and small and medium-sized providers. The bill also lets HHS and CISA identify and update a biannual list of high-risk assets to guide support.
  • Federal oversight and resource targeting: Would require a CISA report to Congress within 120 days, a coordination report from HHS and CISA within 18 months, and a Comptroller General review of federal resources for the sector within 18 months.

*Would not authorize new federal funding for implementation and would rely on existing resources.*

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

3 provisions identified: 2 benefits, 0 costs, 1 mixed.

Stronger CISA–HHS coordination and planning

If enacted, the Agency would appoint a qualified liaison to work with HHS on healthcare cybersecurity. The Secretary and the Agency would update the Healthcare and Public Health Sector Risk Management Plan within one year. The update would study risks to covered assets, especially rural and small or medium providers, workforce shortages, device and records vulnerabilities, and ways to communicate tools. The Agency would also coordinate with health-sector groups and offer training to owners and operators on sector-specific cyber risks.

High-risk healthcare asset list and prioritization

If enacted, the Secretary could set objective criteria and make a list of high-risk healthcare assets. Owners and operators would be notified when assets are added or removed. The list would be reviewed at least twice a year and Congress would be notified on initial creation and each update. The Department could use the list to prioritize limited resources to strengthen those high-risk assets.

Constitutional limits and funding restriction

If enacted, the bill would say nothing in the Act can be used to violate rights protected by the U.S. Constitution, including censoring protected speech or unauthorized surveillance. The bill would also say no new funds are authorized to carry out the Act, so agencies must use existing resources unless Congress provides money. Together, this limits agency actions while potentially slowing how quickly new activities are implemented.

Sponsors & CoSponsors

Sponsor

Crow, Jason [D-CO-6]

CO • D

Cosponsors

  • Rep. Fitzpatrick, Brian K. [R-PA-1]

    PA • R

    Sponsored 6/9/2025

  • Rep. Nunn, Zachary [R-IA-3]

    IA • R

    Sponsored 9/30/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation