This bill creates a coordinated effort between the Department of Health and Human Services and the federal Cybersecurity and Infrastructure Security Agency to strengthen protections against cyber attacks in hospitals, clinics, and other health care organizations. Right now, health care systems are frequent targets for hackers, and this bill aims to make them more resilient and better prepared to respond when attacks happen.

The bill requires health care organizations to implement specific security measures, including multifactor authentication (like using your phone to verify logins), encryption of patient data, and regular security testing. It also mandates that health care providers report breaches more transparently, with public information about what happened and what corrective actions were taken. The bill gives the government one year to update its rules to reflect these new requirements and provides reasonable time for health care organizations to comply.

To help health care providers actually implement these protections, the bill creates a grant program offering federal funding for smaller hospitals, rural clinics, and community health centers to hire cybersecurity experts, upgrade outdated computer systems, and join information-sharing networks where they can learn about emerging threats. The bill also funds training programs and workforce development to help health care workers understand cybersecurity risks. Special attention is given to rural areas, which often struggle with limited resources and outdated technology, through targeted guidance and a study to track how well these recommendations are being adopted.