Health Care Cybersecurity and Resiliency Act of 2024

The Health Care Cybersecurity and Resiliency Act of 2024 requires the Department of Health and Human Services (HHS) to develop a cybersecurity incident response plan within one year of enactment, including strategies for risk assessment, prevention, detection, and recovery from cyber incidents affecting healthcare systems. The bill establishes new mandatory cybersecurity standards for healthcare entities, requiring multifactor authentication, encryption of protected health information, and regular security audits. It updates breach reporting requirements to include more detailed information about breaches and corrective actions taken, and creates a new grant program to help rural healthcare facilities adopt cybersecurity best practices. The legislation also mandates training programs to strengthen the healthcare cybersecurity workforce and improves coordination between HHS and the Cybersecurity and Infrastructure Security Agency (CISA). These provisions apply to hospitals, health centers, clinics, and other healthcare entities that handle protected health information.