Hospitals and health systems will face substantial new cybersecurity requirements, including much faster notification of breaches and mandatory reporting of any ransom paid following an incident, once regulations implementing provisions contained in the recent bipartisan omnibus spending law take effect.

The massive legislation, which was signed into law March 15 by President Joe Biden, includes a wide range of priorities, such as aid to Ukraine and new domestic and defense spending.^[1] The cybersecurity provisions, titled “Cyber Incident Reporting for Critical Infrastructure Act of 2022,” were lifted from a separate bill sponsored by Sen. Gary Peters, D-Mich.

Under the legislation, organizations that are considered part of “critical infrastructure sectors,” which include hospitals and health systems, will be required to report cyber incidents within 72 hours after the entity “reasonably believes that the covered cyber incident has occurred.” They also must report any ransom payments made within 24 hours. All new reports will go to the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA).

The specific details of which types and sizes of entities will be subject to new reporting requirements will be ironed out in the rule-making process over the next three years.

CISA Chief of Staff Kiersten Todt told reporters at a March 22 media roundtable that fast reporting of cyber incidents—as required in the new cybersecurity law—will enable CISA to use the information to “render assistance and to prevent other organizations from falling victim to a cyberattack.”^[2] It’s important to “bring CISA to the table” by reporting incidents and attacks, Todt said, making a case for collective action against threats as a “force multiplier.”