Congress moves to shield healthcare from cyberattacks—quietly, without new funding

What it does

This bill directs the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) to coordinate on protecting healthcare systems from cyberattacks. It requires them to appoint a liaison, develop training for hospital and clinic operators, update a sector-specific risk management plan within one year, and identify high-risk healthcare assets. The bill aims to reduce the rising tide of healthcare data breaches (up 107% since 2018) by improving information sharing, threat awareness, and cybersecurity resources for healthcare providers—particularly rural and smaller facilities.

Why we flagged it

The bill's core function is to mandate inter-agency coordination and information-sharing between CISA and HHS to improve cybersecurity defenses in the healthcare sector. It is a governance and infrastructure-protection measure, not a regulatory carve-out or appropriation.

What the text implies

• The 'high-risk covered asset' designation (Section 7) may create a tiered system where smaller, rural healthcare providers receive less federal support if they fall below the threshold, potentially widening disparities in cybersecurity resilience.
• The bill mandates no new funding but relies on existing CISA and HHS budgets; if resources are not reallocated internally, coordination may be nominal rather than substantive.
• The liaison role and inter-agency coordination may create bureaucratic overhead without clear enforcement mechanisms if either agency deprioritizes healthcare cybersecurity.
• The sector-specific risk management plan update (Section 6) includes evaluation of medical device vulnerabilities, but the bill does not authorize FDA or device manufacturers to implement fixes—only to identify gaps.

Who it affects

Ordinary citizens benefit from stronger cybersecurity protections for their health data and uninterrupted healthcare delivery. The bill addresses a documented public health crisis (42 million individuals affected by breaches in 2022 alone) and mandates coordination, training, and resource-sharing to reduce cyberattacks on hospitals and clinics. No new taxes or fees are imposed; the bill explicitly prohibits new appropriations.

Who stands to gain

• Cybersecurity consulting firms
• Healthcare IT vendors
• Information security training providers
• Medical device manufacturers (indirectly, via vulnerability identification)

Named in the bill

CISA (Cybersecurity and Infrastructure Security Agency), HHS (Department of Health and Human Services), Homeland Security Act of 2002, National Security Memorandum NSM-22, Critical Infrastructures Protection Act of 2001, Office for Civil Rights (HHS), Information Sharing and Analysis Organizations (ISAOs), Sector Coordinating Councils

Where it stands

3 cosponsors: 2 Republicans, 1 Independents.

• May 21, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• May 21, 2025 — Referred to Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Read twice and referred to the Committee on Homeland Security and Governmental Affairs”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.