Sec. 9. Required cybersecurity standards
151 words·~1 min read·
/bill/119/s/3315/is/section-9A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
The Secretary shall update the privacy, security, and breach notification regulations under parts 160 and 164 of title 45, Code of Federal Regulations (or any successor regulation) to require covered entities and business associates to adopt the following cybersecurity practices: Multifactor authentication, or a successor technology, for access to any information systems that may include protected health information. Safeguards to encrypt protected health information. Requirements to conduct audits, including penetration testing, to maintain the protections of information systems.
Other minimum cybersecurity standards, as determined by the Secretary, in consultation with private sector entities, based on landscape analysis of emerging and existing cybersecurity vulnerabilities and consensus-based best practices. The Secretary shall specify in the regulations the effective date for each of the new requirements under the regulations updated in accordance with subsection (a). Each such effective date shall provide reasonable time for the entities subject to the requirement to come into compliance.