Senate HSGA Committee Amends and Approves 2 Cybersecurity Bills

Yesterday, the Senate Homeland Security and Governmental Affairs Committee held a business meeting looking at eight nominations, eleven postal naming bills, and eleven other bills. Two of those ‘other bills’ dealt with cybersecurity issues:

S 3511, Satellite Cybersecurity Act, and

S 3904, Healthcare Cybersecurity Act of 2022.

Sen Peters (D,MI) offered substitute language for the S 3511. That substitute language was subsequently modified and Sen Ossoff offered another amendment that was also adopted.

Similar actions were taken with respect to S 3904. The substitute language, subsequent modification, and new amendment were all proposed by Sen Rosen (D,NV).

All of the above actions were approved by an en bloc voice vote. Unfortunately, the Committee does not provide copies of substitute language or amendments, so we have no way of knowing what changes were actually made. We will have to wait for the Committee Report.

Review - S 3904 Introduced – Healthcare Cybersecurity

Last week, Sen Rosen (D,NV) introduced S 3904, the Healthcare Cybersecurity Act of 2022. The bill would task the Cybersecurity and Infrastructure Security Agency (CISA) with specific responsibilities for supporting the Department of Health and Human Services (HHS) efforts to improve cybersecurity practices within the Healthcare and Public Health Sector. No funding is authorized in this bill.

Moving Forward

Rosen and one of her two cosponsors {Sen Hassan (D,NH)} are members of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned for consideration. This means that there should be sufficient influence to see this bill considered in Committee. I see nothing in this bill that would engender any organized opposition. I suspect that this bill would receive bipartisan support in Committee.

The bill is unlikely to make it to the floor of the Senate under regular order. There is a remote possibility that the bill could be taken up by the Senate under the unanimous consent process. The most likely way the bill would move forward would be for it to be included as part of a larger piece of legislation, perhaps as an amendment.

Commentary

In many ways this is just another feel good cybersecurity bill that would make it look like Congress was taking action on a very real problem. The study required in the bill would be the most helpful component of the legislation, but CISA is not required to present it to Congress who would be required to take legislative action to approve additional funding or program authorizations to allow HHS to take significant actions to improve healthcare cybersecurity. And the bill only ‘allows’ HHS to consider the provisions in the report when updating the Healthcare and Public Health Sector Specific Plan. It does not require an update or mandate that the recommendations made be considered when an update is completed. There is not even a requirement for a follow-up GAO report.

The biggest ‘feel good without doing anything of significance’ actions in the bill have to do with the two requirements dealing with Cyber Security Advisors; training and incident response. CSAs are a very limited resource within CISA, with only four or five available per region. At most they are only going to be able to provide corporate level cybersecurity-overview training or ‘report back to CISA’ incident response reviews. And even that will be limited as they are also required to support all of the other critical infrastructure sectors as well.

For more details about the requirements of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3904-introduced - subscription required.

Bills Introduced – 3-23-22

Yesterday, with just the Senate in session, there were seven bills introduced. One of those bills may receive additional coverage in this blog:

S 3904 A bill to enhance the cybersecurity of the Healthcare and Public Health Sector. Sen. Rosen, Jacky [D-NV]

I will be watching this bill for language and definitions that would include the cybersecurity of medical devices within the scope of the bill.