[Congressional Record Volume 170, Number 115 (Thursday, July 11, 2024)]
[Senate]
[Page S4807]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 2484. Mr. RUBIO submitted an amendment intended to be proposed by 
him to the bill S. 4638, to authorize appropriations for fiscal year 
2025 for military activities of the Department of Defense, for military 
construction, and for defense activities of the Department of Energy, 
to prescribe military personnel strengths for such fiscal year, and for 
other purposes; which was ordered to lie on the table; as follows:

       At the end of subtitle H of title X, add the following:

     SEC. 1095. EVALUATION OF HHS CYBERSECURITY.

       (a) In General.--Not later than 2 years after the date of 
     enactment of this Act, and every 2 years thereafter, the 
     Inspector General of the Department of Health and Human 
     Services shall evaluate the cybersecurity practices and 
     protocols of the Department through the conduct of 
     penetration tests and other testing procedures to determine 
     how systems processing, transmitting, or storing mission 
     critical or sensitive data by, for, or on behalf of the 
     Department is currently, or could be compromised and--
       (1) expose patient data, including Medicare numbers of 
     individuals; or
       (2) impact patient safety.
       (b) Reports.--Not later than 2 years after the date of 
     enactment of this Act, and every 2 years thereafter--
       (1) the Secretary of Health and Human Services shall submit 
     to Congress a report that describes how the Secretary will 
     update the cybersecurity practices and protocols of the 
     Department of Health and Human Services to adapt to the 
     latest cyberattack strategies; and
       (2) the Inspector General of the Department of Health and 
     Human Services shall submit to Congress a report that 
     describes--
       (A) how the Inspector General is currently using Federal 
     funds of the Inspector General to carry out subsection (a); 
     and
       (B) additional funding or legislative changes required for 
     the Inspector General to maintain the evaluation described in 
     subsection (a).
                                 ______