§1533 Improving Cybersecurity in the Health Care Industry

Summary

Requires the Secretary of Health and Human Services to do three main things: by December 18, 2016, send a report to the Senate Committee on Health, Education, Labor, and Pensions and the House Committee on Energy and Commerce about how ready HHS and health care organizations are to handle cyber attacks; within 90 days after December 18, 2015 (by March 18, 2016), set up a task force with NIST, DHS, industry experts, and others to study other industries’ practices, the problems health care organizations face (including security of networked medical devices), make guidance to help providers prepare and respond, plan for real-time sharing of cyber threat information and defenses, and report its findings to the proper congressional committees; the task force must end one year after it starts and the Secretary must share the task force’s guidance within 60 days after it ends. The Secretary must also work with DHS, NIST, and industry groups to create voluntary, consensus-based best practices and tools that lower cyber risk, help organizations adopt protections, match existing federal privacy and security rules (including HIPAA and HITECH), and get updated regularly. The Secretary may use work already happening as of December 17, 2015. The rules are voluntary: the Secretary cannot audit compliance or force organizations to follow them for grants or contracts, and choosing not to follow them does not create liability. This section does not change certain antitrust or liability protections in other law. Definitions (one line each): “Appropriate congressional committees” — Senate: HELP, Homeland Security and Governmental Affairs, Select Committee on Intelligence; House: Energy and Commerce, Homeland Security, Permanent Select Committee on Intelligence. “Business associate,” “covered entity,” “health care clearinghouse,” “health care provider,” and “health plan” — defined in 45 C.F.R. 160.103 as of December 17, 2015. “Cybersecurity threat,” “cyber threat indicator,” “defensive measure,” “Federal entity,” “non‑Federal entity,” and “private entity” — have the meanings given in section 1501 of this title. “Health care industry stakeholder” — includes health plans, clearinghouses, providers, patient advocates, pharmacists, health IT developers/vendors, labs, drug and device makers, and others the Secretary selects. “Secretary” — the Secretary of Health and Human Services.