Healthcare Cybersecurity Act of 2025

The Healthcare Cybersecurity Act of 2025 requires the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Health and Human Services (HHS) to improve coordination on cybersecurity for healthcare facilities and systems. It mandates a new agency liaison to the HHS, updates a sector-specific risk management plan within one year (focusing on rural and small providers), and establishes a process to identify "high-risk" healthcare assets for prioritized support. The bill also requires CISA to provide cybersecurity training for healthcare owners/operators and report on support efforts to Congress. This directly affects hospitals, clinics, and health systems - especially smaller or rural facilities - by creating new coordination mechanisms and risk assessment requirements to address rising cyber threats.