Healthcare Cybersecurity Act of 2025
- Sponsor
- Rep. Crow, Jason [D-CO-6]
- Committees
- Homeland Security Committee (primary)
- Last action
- Jun 10, 2025
Bottom line
The bill seeks to strengthen healthcare cybersecurity through enhanced inter-agency collaboration, targeted training, and strategic risk management without authorizing new federal spending.
What it actually does
This bill aims to enhance the cybersecurity of the Healthcare and Public Health Sector by improving coordination between the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS). It mandates the appointment of a CISA liaison to HHS, requires CISA to provide cybersecurity training to healthcare entities, and directs HHS to update a sector-specific risk management plan. Additionally, it allows HHS to identify and prioritize high-risk healthcare assets for resource allocation.
Proponents argue
Supporters argue that the increasing frequency and severity of cyberattacks on healthcare facilities, as evidenced by significant data breaches affecting millions of individuals, necessitate a more coordinated and proactive federal response. They contend that improved collaboration between CISA's cybersecurity expertise and HHS's sector-specific knowledge, along with tailored training and risk assessment, will better protect patient data, reduce healthcare delivery costs, and ultimately safeguard patient health outcomes.
Opponents contend
Critics might argue that while the goal of enhanced cybersecurity is laudable, the bill's approach might add bureaucratic layers without sufficient new funding or enforcement mechanisms to address the root causes of vulnerabilities. Some may contend that existing agencies already have mandates to coordinate on critical infrastructure protection, and this bill merely formalizes processes that should already be occurring, potentially diverting resources without adding substantial new capabilities.
The bill is concise and clearly structured, making it accessible for an informed reader to understand its core provisions within a reasonable timeframe.
Section 4
Enhanced CISA-HHS Cybersecurity Coordination
This provision mandates that the Cybersecurity and Infrastructure Security Agency (CISA) coordinate with the Department of Health and Human Services (HHS) to improve cybersecurity in the healthcare sector. It requires CISA to appoint a dedicated liaison to HHS, who will facilitate information sharing, support risk management plan implementation, and assist during cyber incidents. CISA is also directed to provide resources and develop sector-specific products for healthcare entities.
Supporters argue
Supporters argue that formalizing and enhancing coordination between CISA, the nation's lead cybersecurity agency, and HHS, the sector-specific agency for healthcare, is crucial for a unified and effective defense against cyber threats. The dedicated liaison will streamline communication and ensure that cybersecurity efforts are tailored to the unique challenges of the healthcare environment.
Critics contend
No specific opposition is typically raised against inter-agency coordination efforts, as they are generally seen as beneficial. However, some might express concern about potential bureaucratic overhead if the coordination mechanisms are not efficiently implemented.
Tradeoffs
The primary tension is balancing the need for robust, formalized coordination with the risk of creating additional bureaucratic layers that could slow down rapid response or resource deployment.
Section 5
CISA Cybersecurity Training for Healthcare
This section requires CISA to make cybersecurity training available to the owners and operators of "covered assets" within the Healthcare and Public Health Sector. The training will cover identified cybersecurity risks specific to the sector and methods to mitigate these risks within their information systems.
Section 6
Updated Healthcare Cybersecurity Risk Management Plan
The bill mandates that the HHS Secretary, in coordination with the CISA Director, update the existing Healthcare and Public Health Sector-specific Risk Management Plan within one year. This updated plan must include detailed analyses of cyber risks, challenges faced by healthcare entities in securing systems and medical devices, best practices for utilizing CISA resources, and an assessment of workforce shortages with recommendations.
Section 7
Designation and Prioritization of High-Risk Healthcare Assets
This provision authorizes the HHS Secretary, in consultation with the CISA Director and health sector stakeholders, to establish criteria for designating "high-risk covered assets" within the Healthcare and Public Health Sector. The Secretary may then develop and biannually update a list of these assets, notifying their owners and Congress. This list can be used by HHS to prioritize the allocation of cybersecurity resources to bolster cyber resilience for the most critical entities.
This subsection explicitly states that no additional funds are authorized to be appropriated for the purpose of carrying out this Act.
Section 9(c)
Why it matters:This is standard legislative practice for bills that intend to operate within existing appropriations or rely on reallocations rather than new spending. It prevents the bill from being scored as requiring new appropriations.
Case for: Supporters would argue that this provision demonstrates fiscal responsibility, ensuring that the bill's objectives are met through more efficient use of existing resources and inter-agency collaboration, rather than increasing federal spending.
Case against: Critics might contend that without new dedicated funding, the mandates and enhanced coordination efforts outlined in the bill may be difficult to implement effectively, potentially straining existing agency budgets and limiting the scope or quality of new programs like training or resource allocation.
Estimated impact: This provision means the bill will have a neutral direct impact on the federal deficit, as it does not authorize new spending. Any costs incurred by CISA or HHS for implementing the bill's provisions must come from their existing budgets.