Lawmakers Introduce Bipartisan Healthcare Cybersecurity Act
Earlier this month, lawmakers in the House and Senate introduced the bipartisan Healthcare Cybersecurity Act to better safeguard healthcare data and improve collaboration between the U.S. Department of Health and Human Services and the Cybersecurity and Infrastructure Security Agency (CISA).
This is not the first time that the requirements of these bills have been attempted to be introduced, as similar legislation was introduced in the 117th and 118th Congresses in 2022 and 2024; however, they failed to be passed. Given the impact of last year’s cyberattack on Change Healthcare, which disrupted operations and patient care at providers across the country, there may be a greater chance of the legislation being passed by the current Congress.
The legislation was introduced in the House of Representatives by Brian Fitzpatrick (R-PA) and Jason Crow (D-CO), with a companion bill introduced in the Senate by Senators Jacky Rosen (D-NV) and Todd Young (R-IN).
One of the requirements of the legislation is for the HHS and CISA to collaborate on improving cybersecurity in healthcare, which would see a liaison appointed to work with the HHS and CISA to coordinate the response to cyberattacks, including real-time threat sharing. In addition to improving the response to cyber threats, both agencies will work on building the infrastructure to prevent cyber actors from gaining access to healthcare networks to better protect patient privacy.
The bills call for the HHS and CISA to conduct a joint study to identify cybersecurity vulnerabilities in the healthcare and public health sector, which will allow work to continue mitigating those vulnerabilities. The legislation calls for expanded cybersecurity training for healthcare owners and operators on cybersecurity risks and how they can be mitigated to harden security.
2024 was an especially bad year for healthcare cyberattacks, with ransomware actors aggressively targeting U.S. healthcare organizations. Last year was the worst-ever year in terms of breached healthcare records, with more than 231 million individuals having their healthcare data exposed or stolen. Cyberattacks have continued to be reported in high numbers in 2025, with several cyberattacks announced that have caused major disruption to healthcare services.
“In recent years, hospitals and other health care facilities in Indiana and across America have experienced a dramatic increase in cyberattacks,” explained Sen. Young. “Our bipartisan bill will take critical steps to strengthen cybersecurity infrastructure and better protect patients’ personal data.”
