Healthcare Cybersecurity Act of 2025
Sponsored By: Senator Rosen, Jacky [D-NV]
Introduced
Summary
A sector-specific cybersecurity framework for the Healthcare and Public Health Sector would coordinate CISA and HHS, set a dedicated HHS liaison, and require updated risk planning, training, and ongoing asset risk reporting.
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
5 provisions identified: 3 benefits, 0 costs, 2 mixed.
Update healthcare cyber risk plan
This bill would require HHS, working with CISA, to update the Healthcare and Public Health Sector Risk Management Plan within one year. The update would analyze risks to covered assets, with emphasis on rural and small- and mid-sized providers. It would assess medical device and patient data vulnerabilities and workforce shortages and recommend fixes. HHS must brief Congress on the update within 120 days.
Which healthcare assets are covered and prioritized
This bill would define what counts as a covered Healthcare and Public Health Sector asset. The definition would follow NSM-22 (April 30, 2024). HHS, with CISA, could set objective rules to call some assets "high-risk." HHS would keep a list, tell owners when assets are added or removed, notify Congress when the initial list is made, and review the list twice a year.
GAO report on healthcare cyber resources
This bill would require the Comptroller General (GAO) to report to Congress within 18 months. The report would list federal resources for Healthcare and Public Health Sector critical infrastructure and note recent collaboration with CISA and HHS. The report would inform congressional oversight and future resource choices.
CISA-HHS cybersecurity liaison and training
This bill would require CISA to assign a qualified cybersecurity liaison to HHS. The liaison would coordinate threats, help during incidents, and assist with Plan updates. CISA would provide training for owners and operators on cyber risks and how to protect systems. CISA would also coordinate with ISAOs, ISACs, and other groups and must report to Congress within 120 days on its sector support.
No new money or extra powers
This bill would say nothing in it lets HHS or CISA act beyond existing law. It would also say it cannot be used to violate constitutional rights. The bill would not authorize any new money to carry out its provisions.
Sponsors & CoSponsors
Sponsor
Rosen, Jacky [D-NV]
NV • D
Cosponsors
Sen. Young, Todd [R-IN]
IN • R
Sponsored 5/21/2025
Sen. King, Angus S., Jr. [I-ME]
ME • I
Sponsored 6/2/2025
Sen. Tillis, Thomas [R-NC]
NC • R
Sponsored 6/2/2025
Roll Call Votes
No roll call votes available for this bill.
View on Congress.gov