Rural Hospital Cybersecurity Enhancement Act

II Calendar No. 381 118TH CONGRESS 2D SESSION S. 1560 [Report No. 118–170] To require the development of a comprehensive rural hospital cybersecurity workforce development strategy, and for other purposes. IN THE SENATE OF THE UNITED STATES MAY 11, 2023 Mr. HAWLEY (for himself, Mr. PETERS, Mr. OSSOFF, Mr. WARNOCK, and Ms. ROSEN) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs MAY 9, 2024 Reported by Mr. PETERS, with an amendment [Strike out all after the enacting clause and insert the part printed in italic] A BILL To require the development of a comprehensive rural hospital cybersecurity workforce development strategy, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Rural Hospital Cyber- 4 security Enhancement Act’’. 5 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6401 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 2 •S 1560 RS SEC. 2. DEFINITIONS. 1 In this Act: 2 (1) APPROPRIATE COMMITTEES OF CON- 3 GRESS.—The term ‘‘appropriate committees of Con- 4 gress’’ means— 5 (A) the Committee on Homeland Security 6 and Governmental Affairs of the Senate; and 7 (B) the Committee on Homeland Security 8 of the House of Representatives. 9 (2) DIRECTOR.—The term ‘‘Director’’ means 10 the Director of the Cybersecurity and Infrastructure 11 Security Agency. 12 (3) RURAL HOSPITAL.—The term ‘‘rural hos- 13 pital’’ means a healthcare facility that— 14 (A) is located in a non-urbanized area, as 15 determined by the Bureau of the Census; and 16 (B) provides inpatient and outpatient 17 healthcare services, including primary care, 18 emergency care, and diagnostic services. 19 (4) SECRETARY.—The term ‘‘Secretary’’ means 20 the Secretary of Homeland Security. 21 SEC. 3. RURAL HOSPITAL CYBERSECURITY WORKFORCE 22 DEVELOPMENT STRATEGY. 23 (a) IN GENERAL.—Not later than 1 year after the 24 date of enactment of this Act, the Secretary, acting 25 through the Director, shall develop and transmit to the 26 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 3 •S 1560 RS appropriate committees of Congress a comprehensive rural 1 hospital cybersecurity workforce development strategy to 2 address the growing need for skilled cybersecurity profes- 3 sionals in rural hospitals. 4 (b) CONSULTATION.— 5 (1) AGENCIES.—In carrying out subsection (a), 6 the Secretary and Director may consult with the 7 Secretary of Health and Human Services, the Sec- 8 retary of Education, and the Secretary of Labor. 9 (2) PROVIDERS.—In carrying out subsection 10 (a), the Secretary shall consult with rural healthcare 11 providers from each geographic region in the United 12 States. 13 (c) CONSIDERATIONS.—The rural hospital cybersecu- 14 rity workforce development strategy developed under sub- 15 section (a) shall, at a minimum, consider the following 16 components: 17 (1) Partnerships between rural hospitals, edu- 18 cational institutions, private sector entities, and non- 19 profit organizations to develop, promote, and expand 20 cybersecurity education and training programs tai- 21 lored to the needs of rural hospitals. 22 (2) The development of a cybersecurity cur- 23 riculum and teaching resources that focus on teach- 24 ing technical skills and abilities related to cybersecu- 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 4 •S 1560 RS rity in rural hospitals for use in community colleges, 1 vocational schools, and other educational institutions 2 located in rural areas. 3 (3) Recommendations for legislation, rule- 4 making, or guidance to implement the components 5 of the rural hospital cybersecurity workforce develop- 6 ment strategy. 7 (d) ANNUAL REVIEW.—Not later than 60 days after 8 the date on which the first full fiscal year ends following 9 the date on which the Secretary transmits the rural hos- 10 pital cybersecurity workforce development strategy devel- 11 oped under subsection (a), and not later than 60 days 12 after the date on which each fiscal year thereafter ends, 13 the Secretary shall submit to the appropriate committees 14 of Congress a report that includes, at a minimum, infor- 15 mation relating to— 16 (1) updates to the rural hospital cybersecurity 17 workforce development strategy, as appropriate; 18 (2) any programs or initiatives established pur- 19 suant to the rural hospital cybersecurity workforce 20 development strategy, as well as the number of indi- 21 viduals trained or educated through such programs 22 or initiatives; 23 (3) additional recommendations for legislation, 24 rulemaking, or guidance to implement the compo- 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6401 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 5 •S 1560 RS nents of the rural hospital cybersecurity workforce 1 development strategy; and 2 (4) the effectiveness of the rural hospital cyber- 3 security workforce development strategy in address- 4 ing the need for skilled cybersecurity professionals in 5 rural hospitals. 6 SEC. 4. INSTRUCTIONAL MATERIALS FOR RURAL HOS- 7 PITALS. 8 (a) IN GENERAL.—Not later than 1 year after the 9 date of enactment of this Act, the Director shall make 10 available instructional materials for rural hospitals that 11 can be used to train staff on fundamental cybersecurity 12 efforts. 13 (b) DUTIES.—In carrying out subsection (a), the Di- 14 rector shall— 15 (1) consult with experts in cybersecurity edu- 16 cation and rural healthcare experts; 17 (2) identify existing cybersecurity instructional 18 materials that can be adapted for use in rural hos- 19 pitals and create new materials as needed; and 20 (3) conduct an awareness campaign to promote 21 the materials available to rural hospitals developed 22 under subsection (a). 23 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6401 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 6 •S 1560 RS SEC. 5. IMPLEMENTATION. 1 Any action undertaken pursuant to this Act shall not 2 be subject to chapter 10 of title 5, United States Code. 3 SECTION 1. SHORT TITLE. 4 This Act may be cited as the ‘‘Rural Hospital Cyberse- 5 curity Enhancement Act’’. 6 SEC. 2. DEFINITIONS. 7 In this Act: 8 (1) AGENCY.—The term ‘‘agency’’ has the mean- 9 ing given the term in section 551 of title 5, United 10 States Code. 11 (2) APPROPRIATE COMMITTEES OF CONGRESS.— 12 The term ‘‘appropriate committees of Congress’’ 13 means— 14 (A) the Committee on Homeland Security 15 and Governmental Affairs of the Senate; and 16 (B) the Committee on Homeland Security of 17 the House of Representatives. 18 (3) DIRECTOR.—The term ‘‘Director’’ means the 19 Director of the Cybersecurity and Infrastructure Se- 20 curity Agency. 21 (4) GEOGRAPHIC DIVISION.—The term ‘‘geo- 22 graphic division’’ means a geographic division that is 23 among the 9 geographic divisions determined by the 24 Bureau of the Census. 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6203 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 7 •S 1560 RS (5) RURAL HOSPITAL.—The term ‘‘rural hos- 1 pital’’ means a healthcare facility that— 2 (A) is located in a non-urbanized area, as 3 determined by the Bureau of the Census; and 4 (B) provides inpatient and outpatient 5 healthcare services, including primary care, 6 emergency care, and diagnostic services. 7 (6) SECRETARY.—The term ‘‘Secretary’’ means 8 the Secretary of Homeland Security. 9 SEC. 3. RURAL HOSPITAL CYBERSECURITY WORKFORCE DE- 10 VELOPMENT STRATEGY. 11 (a) IN GENERAL.—Not later than 1 year after the date 12 of enactment of this Act, the Secretary, acting through the 13 Director, shall develop and transmit to the appropriate 14 committees of Congress a comprehensive rural hospital cy- 15 bersecurity workforce development strategy to address the 16 growing need for skilled cybersecurity professionals in rural 17 hospitals. 18 (b) CONSULTATION.— 19 (1) AGENCIES.—In carrying out subsection (a), 20 the Secretary and Director may consult with the Sec- 21 retary of Health and Human Services, the Secretary 22 of Education, the Secretary of Labor, and any other 23 appropriate head of an agency. 24 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 8 •S 1560 RS (2) PROVIDERS.—In carrying out subsection (a), 1 the Secretary shall consult with not less than 2 rep- 2 resentatives of rural healthcare providers from each 3 geographic division in the United States. 4 (c) CONSIDERATIONS.—The rural hospital cybersecu- 5 rity workforce development strategy developed under sub- 6 section (a) shall, at a minimum, consider the following com- 7 ponents: 8 (1) Partnerships between rural hospitals, non- 9 rural healthcare systems, educational institutions, 10 private sector entities, and nonprofit organizations to 11 develop, promote, and expand the rural hospital cy- 12 bersecurity workforce, including through education 13 and training programs tailored to the needs of rural 14 hospitals. 15 (2) The development of a cybersecurity cur- 16 riculum and teaching resources that focus on teaching 17 technical skills and abilities related to cybersecurity 18 in rural hospitals for use in community colleges, vo- 19 cational schools, and other educational institutions lo- 20 cated in rural areas. 21 (3) Identification of— 22 (A) cybersecurity workforce challenges that 23 are specific to rural hospitals, as well as chal- 24 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 9 •S 1560 RS lenges that are relative to hospitals generally; 1 and 2 (B) common practices to mitigate both sets 3 of challenges described in subparagraph (A). 4 (4) Recommendations for legislation, rule- 5 making, or guidance to implement the components of 6 the rural hospital cybersecurity workforce develop- 7 ment strategy. 8 (d) ANNUAL BRIEFING.—Not later than 60 days after 9 the date on which the first full fiscal year ends following 10 the date on which the Secretary transmits the rural hospital 11 cybersecurity workforce development strategy developed 12 under subsection (a), and not later than 60 days after the 13 date on which each fiscal year thereafter ends, the Secretary 14 shall provide a briefing to the appropriate committees of 15 Congress that includes, at a minimum, information relat- 16 ing to— 17 (1) updates to the rural hospital cybersecurity 18 workforce development strategy, as appropriate; 19 (2) any programs or initiatives established pur- 20 suant to the rural hospital cybersecurity workforce de- 21 velopment strategy, as well as the number of individ- 22 uals trained or educated through such programs or 23 initiatives; 24 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6203 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 10 •S 1560 RS (3) additional recommendations for legislation, 1 rulemaking, or guidance to implement the components 2 of the rural hospital cybersecurity workforce develop- 3 ment strategy; and 4 (4) the effectiveness of the rural hospital cyberse- 5 curity workforce development strategy in addressing 6 the need for skilled cybersecurity professionals in 7 rural hospitals. 8 SEC. 4. INSTRUCTIONAL MATERIALS FOR RURAL HOS- 9 PITALS. 10 (a) IN GENERAL.—Not later than 1 year after the date 11 of enactment of this Act, the Director shall make available 12 instructional materials for rural hospitals that can be used 13 to train staff on fundamental cybersecurity efforts. 14 (b) DUTIES.—In carrying out subsection (a), the Di- 15 rector shall— 16 (1) consult with appropriate heads of agencies, 17 experts in cybersecurity education, and rural 18 healthcare experts; 19 (2) identify existing cybersecurity instructional 20 materials that can be adapted for use in rural hos- 21 pitals and create new materials as needed; and 22 (3) conduct an awareness campaign to promote 23 the materials available to rural hospitals developed 24 under subsection (a). 25 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6203 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB 11 •S 1560 RS SEC. 5. NO ADDITIONAL FUNDS. 1 No additional funds are authorized to be appropriated 2 for the purpose of carrying out this Act. 3 VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6203 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB Calendar No. 381 118TH CONGRESS 2D SESSION S. 1560 [Report No. 118–170] A BILL To require the development of a comprehensive rural hospital cybersecurity workforce develop- ment strategy, and for other purposes. MAY 9, 2024 Reported with an amendment VerDate Sep 11 2014 01:47 May 10, 2024 Jkt 049200 PO 00000 Frm 00012 Fmt 6651 Sfmt 6651 E:\BILLS\S1560.RS S1560 kjohnson on DSK7ZCZBW3PROD with $$_JOB