H.R. 9908
Rural Hospital Cybersecurity Enhancement Act
Sponsor: Erin Houchin
Official summary
Written by the Congressional Research Service.
Rural Hospital Cybersecurity Enhancement Act
This bill requires the Department of Health and Human Services (HHS) to create a workforce development strategy to address the need for cybersecurity professionals in rural hospitals.
Among other topics, the strategy must consider (1) partnerships between rural hospitals, hospitals that are not rural hospitals, educational institutions, and private nonprofit or for-profit entities; and (2) the development of a cybersecurity curriculum for use in rural educational institutions. HHS must annually brief Congress on the strategy and any programs or initiatives established thereunder.
Additionally, HHS must disseminate free materials that rural hospitals may use to train staff about cybersecurity.
Text of the bill
(a) In general. Not later than 1 year after the date of enactment of this Act, the Secretary shall develop and transmit to the appropriate committees of Congress a comprehensive rural hospital cybersecurity workforce development strategy to address the growing need for skilled cybersecurity professionals in rural hospitals.
(b) Consultation
(1) Agencies. In carrying out subsection (a), the Secretary shall consult with the Director of the Cybersecurity and Infrastructure Security Agency, the Secretary of Education, the Secretary of Labor, the National Cyber Director, and any other appropriate head of an agency.
(2) Providers. In carrying out subsection (a), the Secretary shall consult with not fewer than 2 representatives of rural health care providers from each geographic division in the United States.
(c) Considerations. The rural hospital cybersecurity workforce development strategy developed under subsection (a) shall, at a minimum, consider the following components:
(1) Partnerships between rural hospitals, hospitals that are not rural hospitals as defined in section 2(4), educational institutions, and private nonprofit or for-profit entities, to develop, promote, and expand the rural hospital cybersecurity workforce, including through education and training programs tailored to the needs of rural hospitals.
(2) The development of a cybersecurity curriculum and teaching resources that focus on teaching technical skills and abilities related to cybersecurity in rural hospitals for use in community colleges, vocational schools, and other educational institutions located in rural areas.
(3) Identification of—
(A) cybersecurity workforce challenges of rural hospitals; and
(B) common practices to mitigate the challenges described in subparagraph (A).
(d) Annual briefing. Not later than 60 days after the date on which the first full fiscal year ends following the date on which the Secretary transmits the rural hospital cybersecurity workforce development strategy developed under subsection (a), and not later than 60 days after the date on which each fiscal year thereafter ends, the Secretary shall provide a briefing to the appropriate committees of Congress that includes, at a minimum, information relating to—
(1) updates to the rural hospital cybersecurity workforce development strategy, as appropriate;
(2) any programs or initiatives established pursuant to the rural hospital cybersecurity workforce development strategy, and the number of individuals trained or educated through such programs or initiatives; and
(3) the effectiveness of the rural hospital cybersecurity workforce development strategy in addressing the need for skilled cybersecurity professionals in rural hospitals.