Review – S 3904 Introduced – Healthcare Cybersecurity

Last week, Sen Rosen (D,NV) introduced S 3904,
the Healthcare Cybersecurity Act of 2022. The bill would task the Cybersecurity
and Infrastructure Security Agency (CISA) with specific responsibilities for
supporting the Department of Health and Human Services (HHS) efforts to improve
cybersecurity practices within the Healthcare and Public Health Sector. No funding
is authorized in this bill.

Moving Forward

Rosen and one of her two cosponsors {Sen Hassan (D,NH)} are
members of the Senate Homeland Security and Governmental Affairs Committee to
which this bill was assigned for consideration. This means that there should be
sufficient influence to see this bill considered in Committee. I see nothing in
this bill that would engender any organized opposition. I suspect that this
bill would receive bipartisan support in Committee.

The bill is unlikely to make it to the floor of the Senate
under regular order. There is a remote possibility that the bill could be taken
up by the Senate under the unanimous consent process. The most likely way the
bill would move forward would be for it to be included as part of a larger
piece of legislation, perhaps as an amendment.

Commentary

In many ways this is just another feel good cybersecurity
bill that would make it look like Congress was taking action on a very real problem.
The study required in the bill would be the most helpful component of the
legislation, but CISA is not required to present it to Congress who would be
required to take legislative action to approve additional funding or program authorizations
to allow HHS to take significant actions to improve healthcare cybersecurity.
And the bill only
‘allows’ HHS to consider the provisions in the report when updating the
Healthcare and Public Health Sector Specific Plan. It does not require an
update or mandate that the recommendations made be considered when an update is
completed. There is not even a requirement for a follow-up GAO report.

The biggest ‘feel good without doing anything of
significance’ actions in the bill have to do with the two requirements dealing
with Cyber Security Advisors; training
and incident
response. CSAs are a very limited resource within CISA, with only four or
five available per region. At most they are only going to be able to provide
corporate level cybersecurity-overview training or ‘report back to CISA’
incident response reviews. And even that will be limited as they are also
required to support all of the other critical infrastructure sectors as well.

For more details about the requirements of the bill, see my
article at CFSN Detailed Analysis – https://patrickcoyle.substack.com/p/s-3904-introduced
– subscription required.