Healthcare Cybersecurity Act of 2025

This bill addresses the increasing threat of malicious cyberattacks targeting the Healthcare and Public Health Sector, which have led to significant data breaches, increased healthcare delivery costs, and potential negative impacts on patient health outcomes. To counter these threats, the legislation mandates enhanced coordination between the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) . A dedicated CISA liaison will be appointed to HHS to serve as a primary contact, facilitate information sharing, support the sector's risk management plan, and coordinate during cybersecurity incidents. The bill requires the Secretary of HHS, in coordination with the CISA Director, to update the Healthcare and Public Health Sector-specific Risk Management Plan within one year. This updated plan must analyze cybersecurity risks, evaluate challenges faced by asset owners in securing systems and medical devices, assess best practices for utilizing CISA resources, and address cybersecurity workforce shortages, particularly in rural and small-to-medium facilities. Furthermore, CISA is directed to provide training to healthcare owners and operators on cybersecurity risks and mitigation strategies, while HHS may establish criteria to identify and notify owners of high-risk covered assets to prioritize resource allocation and bolster cyber resilience. The legislation also mandates reports to Congress on CISA's support to the sector and on federal critical infrastructure resources, clarifying that no additional funds are authorized for its implementation.