§1533 Improving Cybersecurity in the Health Care Industry

Summary

Requires the Secretary of Health and Human Services to report to Congress within 1 year after December 18, 2015 on how ready HHS and the health care industry are to handle cybersecurity threats. The report must name the HHS official who will lead and coordinate responses and include a plan from each HHS division showing who is responsible, how duties are split, and how they will talk to each other about cyber threats. Within 90 days after December 18, 2015 the Secretary must bring together health care groups, cyber experts, NIST, DHS, and other agencies to form a one‑year task force to study how other industries handle cyber risks, identify barriers for private health care entities, review device and system security issues, create guidance to share with all sizes of health care organizations, plan how to share cyber threat information in real time, and report findings to the listed congressional committees. The task force ends one year after it starts, and the Secretary must share the task force’s guidance within 60 days after it ends. The Secretary must also work with partners to create voluntary, consensus-based cybersecurity guidelines for health care that align with existing federal standards and HIPAA/HITECH rules, and the guidelines cannot be made mandatory, audited, or used to punish organizations for not taking part. Defined terms (one line each): “Appropriate congressional committees” — specific Senate and House committees named in the law; “Business associate” — as defined in 45 C.F.R. 160.103 (as of the day before December 18, 2015); “Covered entity” — as defined in 45 C.F.R. 160.103 (same date); “Cybersecurity threat,” “cyber threat indicator,” “defensive measure,” “Federal entity,” “non‑Federal entity,” “private entity” — as defined in section 1501 of this title; “Health care clearinghouse,” “health care provider,” “health plan” — as defined in 45 C.F.R. 160.103 (same date); “Health care industry stakeholder” — includes health plans, clearinghouses, providers, patient/consumer advocates, pharmacists, health IT developers/vendors, labs, drug and device makers, and others the Secretary adds; “Secretary” — the Secretary of Health and Human Services.