Healthcare Ecosystem Stakeholder Cybersecurity Workgroup

SB 691 requires Maryland healthcare entities - including hospitals, health information exchanges, and freestanding medical facilities - to adopt strong cybersecurity standards (including a "zero-trust" approach), undergo third-party audits every two years starting in 2026, and report incidents to the state's Security Operations Center. It mandates the Maryland Health Care Commission to hire a cybersecurity expert and convene two workgroups focused on reviewing threats, responses to disruptions, and making recommendations for improvement. The law applies specifically to defined "healthcare ecosystem entities" but excludes insurance carriers and pharmacy benefits managers. These requirements aim to strengthen cybersecurity practices across critical healthcare infrastructure.