iHouse Energy and Commerce Committee members Reps. Billy Long (R-Mo.) and Doris Matsui (D-Calif.) introduced the HHS Cybersecurity Modernization Act earlier this month in a bipartisan effort to address cybersecurity threats to the Department of Health and Human Services (HHS). Representatives Long and Matsui have both described the bill, H.R. 4191, as a stepping-stone towards improving cybersecurity at HHS and the health care industry at large. However, the bill does not authorize any additional appropriations to do so.
The proposal would amend Title II of the Public Health Service Act by adding a section that:
-
Authorizes the Secretary of HHS to designate an officer with the primary responsibility of overlooking HHS information security programs, including cybersecurity, and who will report directly to either the Secretary or his or her designee. As a reminder, earlier this year, the Healthcare Cybersecurity Task Force, a working group created under Section 405 of the Cybersecurity Act of 2015, recommended such a leadership position to supervise and oversee industry efforts. (For additional information, read our team’s insights on the task force’s report and the big take-aways for the health care industry.)
-
Provides the Secretary the authority to transfer, and in effect consolidate, the function and role of the HHS Chief Information Security Officer with the new officer position.
-
Directs the Secretary of HHS to develop and submit a plan to the House Committee on Energy and Commerce and the Senate Committee on Health, Education, Labor, and Pensions on how HHS will prepare for and respond to cybersecurity threats. The plan must:
-
Describe how HHS and its agencies will coordinate to maintain the security and integrity of their respective information systems, and how they will provide regulation, guidance, information, education, training and assistance to the health care industry, and any anticipated challenges in doing so.
-
Differentiate between HHS’s role in regulating the health care industry and its role as a coordinator, namely the Sector-Specific Agency, for the health care industry.
The bill’s introduction came on the heels of the departure of Deven McGraw, deputy director for health information privacy for HHS’s Office for Civil Rights (HHS-OCR). Illiana Peters is currently the acting deputy director for health information privacy at HHS-OCR. Peters’ appointment combined with the push to improve health care cybersecurity under H.R. 4191 indicates a great likelihood that HHS-OCR is zeroing in on health care cybersecurity.
