Congress orders federal agencies to coordinate on hospital cybersecurity.
H.R. 3841 — Healthcare Cybersecurity Act of 2025 · Filed by Jason Crow (D-CO) · 2 cosponsors · Introduced Jun 9, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill directs the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) to coordinate on protecting hospitals, clinics, and public health systems from cyberattacks. It requires them to appoint a liaison, develop training for healthcare operators, update a sector-specific risk management plan, identify high-risk healthcare assets, and report to Congress on their efforts—all without new federal funding.
Why we flagged it
The bill's operative mechanism is interagency coordination and information-sharing to strengthen cybersecurity defenses in healthcare. It is a straightforward public-health and critical-infrastructure protection measure with no private carve-outs, subsidies, or liability shields.
What the text implies
- The bill does not authorize new funding, so implementation depends on existing agency budgets and congressional appropriations—delays or underfunding could limit effectiveness.
- The 'high-risk covered asset' list may create a two-tier system where smaller rural and medium-sized healthcare providers receive less federal support if they fall below the threshold.
- Biannual updates to the high-risk list and sector-specific plan create ongoing reporting obligations but no enforcement mechanism if agencies fail to meet deadlines.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Citizens depend on hospitals and public health systems for care; cyberattacks disrupt that care and expose patient data. The bill strengthens coordination between federal agencies to prevent attacks and improve resilience, with no new restrictions on individual rights or privacy protections. The explicit rule of construction protecting constitutional rights and prohibiting unauthorized surveillance guards against mission creep.
Named in the bill
Cybersecurity and Infrastructure Security Agency (CISA), Department of Health and Human Services (HHS), Healthcare and Public Health Sector, Information Sharing and Analysis Organizations, Cybersecurity State Coordinators, Office for Civil Rights
Where it stands
2 cosponsors: 2 Republicans.
- Jun 9, 2025 — Introduced · Congress.gov: “Introduced in House”
- Jun 9, 2025 — Referred to House Committee on Energy and Commerce and House Committee on Homeland Security · Congress.gov: “Referred to the Committee on Homeland Security, and in addition to the Committee on Energy and Commerce, for…”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (11,101 characters) on Jun 3, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Congress orders federal agencies to coordinate on hospital cybersecurity.” QuorumCivic. https://share.quorumcivic.app/bill/119/hr3841 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.