[Congressional Record (Bound Edition), Volume 161 (2015), Part 12]
[Senate]
[Pages 16670-16671]
[From the U.S. Government Publishing Office, www.gpo.gov]




                           TEXT OF AMENDMENTS

  SA 2749. Mr. BURR (for himself and Mrs. Feinstein) proposed an 
amendment to amendment SA 2716 proposed by Mr. Burr (for himself and 
Mrs. Feinstein) to the bill S. 754, to improve cybersecurity in the 
United States through enhanced sharing of information about 
cybersecurity threats, and for other purposes; as follows:

       On page 11, line 3, strike ``period'' and insert 
     ``periodic''.
       On page 11, line 10, strike ``532'' and insert ``632''.
       On page 20, line 21, strike ``measures'' and insert 
     ``measure''.
       On page 56, line 8, strike ``and'' and all that follows 
     through ``(7)'' on line 9 and insert the following:
       (7) the term ``national security system'' has the meaning 
     given the term in section 11103 of title 40, United States 
     Code; and
       (8)
       On page 57, line 8, strike ``and''.
       On page 57, line 11, strike the period at the end and 
     insert ``; and''.
       On page 57, between lines 11 and 12, insert the following:
       ``(4) the term `national security system' has the meaning 
     given the term in section 11103 of title 40, United States 
     Code.
       On page 64, lines 14 and 15, strike ``Notwithstanding 
     section 202, in this subsection'' and insert ``In this 
     subsection only''.
       On page 69, line 13, strike ``all taken'' and insert 
     ``taken all''.
       On page 76, line 22, insert ``and the Director of the 
     Office of Management and Budget'' after ``Intelligence''.
       On page 77, lines 12 and 13, strike ``, as defined in 
     section 11103 of title 40, United States Code''.
       On page 77, line 14, insert ``and the Director of the 
     Office of Management and Budget'' after ``Intelligence''.
       On page 78, between lines 2 and 3, insert the following:
       (d) Rule of Construction.--Nothing in this section shall be 
     construed to designate an information system as a national 
     security system.
       On page 78, line 18, strike ``owned'' and insert ``used''.
       Beginning on page 80, line 25, strike ``use'' and all that 
     follows through ``other'' on page 81, line 6, and insert 
     ``intrusion detection
     and prevention capabilities under section 230(b)(1) of the 
     Homeland Security Act of 2002 for the purpose of ensuring the 
     security of''.
       On page 84, line 25, strike ``Act'' and insert ``Act of 
     2015''.
       On page 85, between lines 11 and 12, insert the following:
       (D) the Committee on Commerce, Science, and Transportation 
     of the Senate;
       On page 86, line 26, insert ``the Director of the National 
     Institute of Standards and Technology and'' after 
     ``coordination with''.
       On page 88, line 8, strike ``non-civilian'' and insert 
     ``noncivilian''.
       On page 89, line 23, insert ``, the Director of the 
     National Institute of Standards and Technology,'' after 
     ``Director''.
       On page 91, line 11, strike ``203 and 204'' and insert 
     ``303 and 304''.
       On page 91, line 21, insert ``, in consultation with the 
     Director of the National Institute of Standards and 
     Technology,'' after ``Security''.
       On page 92, line 9, insert ``, in consultation with the 
     Director of the National Institute of Standards and 
     Technology,'' after ``Secretary''.
       On page 96, line 19, strike ``likely,'' and insert 
     ``likely''.
       On page 96, line 22, strike ``present'' and insert 
     ``present,''.
       Beginning on page 103, strike line 10 and all that follows 
     through page 105, line 24, and insert the following:
       (1) In general.--Not later than 60 days after the date of 
     enactment of this Act, the Secretary, in consultation with 
     the Director of the National Institute of Standards and 
     Technology and the Secretary of Homeland Security, shall 
     convene health care industry stakeholders, cybersecurity 
     experts, and any Federal agencies or entities the Secretary 
     determines appropriate to establish a task force to--
       (A) analyze how industries, other than the health care 
     industry, have implemented strategies and safeguards for 
     addressing cybersecurity threats within their respective 
     industries;
       (B) analyze challenges and barriers private entities 
     (notwithstanding section 102(15)(B), excluding any State, 
     tribal, or local government) in the health care industry face 
     securing themselves against cyber attacks;
       (C) review challenges that covered entities and business 
     associates face in securing networked medical devices and 
     other software or systems that connect to an electronic 
     health record;
       (D) provide the Secretary with information to disseminate 
     to health care industry stakeholders for purposes of 
     improving their preparedness for, and response to, 
     cybersecurity threats affecting the health care industry;
       (E) establish a plan for creating a single system for the 
     Federal Government to share information on actionable 
     intelligence regarding cybersecurity threats to the health 
     care industry in near real time, requiring no fee to the 
     recipients of such information, including which Federal 
     agency or other entity may be best suited to be the central 
     conduit to facilitate the sharing of such information; and
       (F) report to Congress on the findings and recommendations 
     of the task force regarding carrying out subparagraphs (A) 
     through (E).
       (2) Termination.--The task force established under this 
     subsection shall terminate on the date that is 1 year after 
     the date of enactment of this Act.
       (3) Dissemination.--Not later than 60 days after the 
     termination of the task force established under this 
     subsection, the Secretary shall disseminate the information 
     described

[[Page 16671]]

     in paragraph (1)(D) to health care industry stakeholders in 
     accordance with such paragraph.
       (4) Rule of construction.--Nothing in this subsection shall 
     be construed to limit the antitrust exemption under section 
     104(e) or the protection from liability under section 106.
       (e) Cybersecurity Framework.--
       (1) In general.--The Secretary shall establish, through a 
     collaborative process with the Secretary of Homeland 
     Security, health care industry stakeholders, the National 
     Institute of Standards and Technology, and any Federal agency 
     or entity the Secretary determines appropriate, a single, 
     voluntary, national health-specific cybersecurity framework 
     that--
       (A) establishes a common set of voluntary, consensus-based, 
     and industry-led standards, security practices, guidelines, 
     methodologies, procedures, and processes that serve as a 
     resource for cost-effectively reducing cybersecurity risks 
     for a range of health care organizations;
       (B) supports voluntary adoption and implementation efforts 
     to improve safeguards to address cybersecurity threats;
       (C) is consistent with the security and privacy regulations 
     promulgated under section 264(c) of the Health Insurance 
     Portability and Accountability Act of 1996 (42 U.S.C. 1320d-2 
     note) and with the Health Information Technology for Economic 
     and Clinical Health Act (title XIII of division A, and title 
     IV of division B, of Public Law 111-5), and the amendments 
     made by such Act; and
       (D) is updated on a regular basis and applicable to the 
     range of health care organizations described in subparagraph 
     (A).
       (2) Limitation.--Nothing in this subsection shall be 
     interpreted as granting the Secretary authority to--
       (A) provide for audits to ensure that health care 
     organizations are in compliance with the voluntary framework 
     under this subsection; or
       (B) mandate, direct, or condition the award of any Federal 
     grant, contract, or purchase on compliance with such 
     voluntary framework.
       (3) No liability for nonparticipation.--Nothing in this 
     title shall be construed to subject a health care 
     organization to liability for choosing not to engage in the 
     voluntary activities authorized under this subsection.
       On page 107, line 10, strike ``shall each'' and insert 
     ``shall''.
       On page 107, lines 11 and 12, strike ``each Comptroller 
     General of the United States and''.
       On page 110, strikes lines 6 through 16.
       On page 111, lines 8 and 9, strike ``under subsection (b)'' 
     and insert ``pursuant to section 9(a) of Executive Order 
     13636 of February 12, 2013 (78 Fed. Reg. 11742), relating to 
     identification of critical infrastructure where a 
     cybersecurity incident could reasonably result in 
     catastrophic regional or national effects on public health or 
     safety, economic security, or national security''.
       On page 111, strike lines 22 through 24 and insert the 
     following:

     Resources of the Senate;
       (F) the Committee on Energy and Commerce of the House of 
     Representatives; and
       (G) the Committee on Commerce, Science, and Transportation 
     of the Senate.
       On page 112, line 3, add a period at the end.
       On page 112, strike lines 4 through 10.
       On page 113, line 14, strike ``intrusion''.
       Beginning on page 114, strike line 7 and all that follows 
     through page 115, line 9.
       On page 115, after line 9, add the following:

     SEC. 408. STOPPING THE FRAUDULENT SALE OF FINANCIAL 
                   INFORMATION OF PEOPLE OF THE UNITED STATES.

       Section 1029(h) of title 18, United States Code, is amended 
     by striking ``title if--'' and all that follows through 
     ``therefrom.'' and inserting ``title if the offense involves 
     an access device issued, owned, managed, or controlled by a 
     financial institution, account issuer, credit card system 
     member, or other entity organized under the laws of the 
     United States, or any State, the District of Columbia, or 
     other Territory of the United States.''.

                          ____________________