AHA Comments on Reauthorization of the Pandemic and All-Hazards Preparedness Act (PAHPA)

March 29, 2023

The Honorable Bernie Sanders Chairman
Committee on Health, Education, Labor and Pensions U.S. Senate Washington, DC 20510
The Honorable Bill Cassidy, M.D
Ranking Member
Committee on Health, Education, Labor and Pensions
U.S. Senate
Washington, DC 20510

The Honorable Robert P. Casey, Jr. Committee on Health, Education, Labor and Pensions
U.S. Senate
Washington, DC 20510

The Honorable Mitt Romney
Committee on Health, Education, Labor and Pensions
U.S. Senate
Washington, DC 20510

Dear Chairman Sanders, Ranking Member Cassidy, Senator Casey and Senator Romney:

On behalf of our nearly 5,000 member hospitals, health systems and other health care organizations, and our clinician partners — including more than 270,000 affiliated physicians, 2 million nurses and other caregivers — and the 43,000 health care leaders who belong to our professional membership groups, the American Hospital Association (AHA) appreciates the opportunity to comment on the Request for Information (RFI) on the reauthorization of the Pandemic and All-Hazards Preparedness Act (PAHPA).

Reauthorizing PAHPA is an opportunity to improve our nation’s preparedness and response capabilities and capacities, as well as to ensure that the nation’s preparedness programs are properly funded, sustained and improved. Although the nation’s hospitals and health systems have always played a critical role in responding to all types of disasters and public health emergencies (PHEs), the COVID-19 pandemic tested our nation more than any crisis in the past 75 years, in part because it happened at a scale that involved the entire country and in ways no one currently employed in health care had ever experienced before. The health care system, with America’s hospitals and health systems at the center, met the challenges posed by the pandemic and saved countless lives with skill, compassion and often great personal sacrifice on the part of the health care workforce.

The recent decision to sunset the COVID-19 PHE declaration is a testament to the progress we have made. However, during this transition, it is critical that we commit to building on the lessons learned and the advancements in care delivery and access made during the PHE. While we recognize that this RFI is only the first step in a longer process to reauthorize PAHPA, the AHA is pleased to share our initial recommendations for creating a more effective and stable health care system.

Specifically, we urge Congress to, among other actions:

  • Improve the federal organizational structure for all types of emergencies, including making critical updates to the Department of Health and Human Services’ (HHS’) emergency preparedness playbook;
  • Strengthen the national medical supply chain by increasing manufacturing redundancy, diversifying raw material and manufacturing production locations and building capacity within the overall supply chain;
  • Ensure availability of a wide variety of essential goods for medical care and provide sufficient support for the Strategic National Stockpile (SNS);
  • Provide additional authorities to the Food and Drug Administration (FDA) to mitigate and prevent drug and device shortages, such as by expanding the agency’s authority to establish medical device manufacturer notifications requirements and quality and resilience incentives;
  • Modernize the data infrastructure in collaboration with a wide range of stakeholders, including hospitals and health systems;
  • Reauthorize PAHPA’s Hospital Preparedness Program (HPP) at a significantly increased level, including additional dedicated, direct-to-hospital funding and allow hospitals, health systems and hospital associations to compete to be the HPP recipient for their jurisdictions;
  • Strengthen health care cybersecurity by requiring HHS and the Department of Homeland Security to dedicate human, technical and financial resources to assist hospitals and health systems to prepare, respond and recover from high impact cyberattacks such as ransomware attacks; and
  • Strengthen the National Advisory Committee on Children and Disasters (NACCD) by expanding its membership and scope of authority to address additional important issues.

More details on our recommendations for these and other issues follow.


While some aspects of federal coordination and policy during the COVID-19 PHE worked well, some areas are in need of improvement.

The Centers for Medicare & Medicaid Services’ (CMS’) rapid action to effectuate Section 1135 waivers of certain Medicare, Medicaid and Children’s Health Insurance Program policies allowed the health care delivery system to expand rapidly and make necessary changes to serve more patients and create new access points. This was one of the response components that worked well. Similarly, the FDA’s rapid issuance of many emergency use authorizations for new forms of personal protective equipment, new therapeutics and new vaccines was lifesaving and integral to protecting patients’, health care workers’ and the general public’s health. The federal government’s ability to rapidly convene supply chain experts — including hospital material managers, drug and device manufacturers and distributors and group purchasing entities, among others — to provide valuable and real time insight to policymakers about critical product supply was another success story. Further, engaging military logistics experts to assist with the processes, resources and systems involved in generating, transporting, sustaining and redeploying or reallocating large amounts of materiel and personnel to where it was most needed was essential and certainly life-saving.

There were also many components of the federal response that did not work as well and these should be addressed moving forward. For instance, communication related to COVID-19 was a constant challenge for public health authorities and the government. The rapidly evolving situations, emerging variants, and changing response actions and public health measures resulted in confusion for the general public and overall uncertainty about which actions were necessary. Further, the approach to collecting COVID-19 data exposed myriad challenges, including extremely burdensome requests during a time when all available personnel were responding to an evolving situation at the local level, as well as excessively punitive consequences for failure to report.

Among the other components of the COVID-19 PHE response that need to be reviewed and addressed are:

  • The plan for distribution of medical countermeasures from the point of manufacturing through the administration to patients in health care facilities;
  • The need for an improved federal plan for unwinding of the PHE;
  • SNS and state stockpiles to support an extended duration and nationwide emergency;
  • The lack of a plan to sustain and support the workforce in an extended duration emergency; and
  • The ineffectiveness of the HPP to prepare hospitals, health systems and other health care providers for large surges of patients and severe medical supply shortages, and its inability to support distribution of large COVID-19 supplemental appropriations to hospitals and health systems, which urgently needed the funding.

An Updated Federal Organizational Structure Is Needed for Emergencies

A well-defined federal organizational structure for all types of emergencies is needed. Throughout the COVID-19 PHE there has been a lack of clarity about which federal agency is responsible for each aspect of the response. The AHA strongly urges that the PAHPA legislation require the development of a more deliberate plan that better defines which federal entity is responsible for each aspect of the response and recovery. For example, there should be a plan to rapidly establish a command center, identify the critical sector leaders who need to engage and bring them promptly together for information sharing and coordinated action. This should be an emergency response plan that can be scaled up or down as needed and have a designated White House team responsible for emergency preparedness and response.

An Update to HHS’ Emergency Preparedness, Response and Recovery Playbook Is Needed

Currently, CMS emergency preparedness conditions of participation exist for hospitals and health systems, but COVID-19 demonstrated that the emergency preparedness framework for our national health care delivery infrastructure is insufficient for effectively responding to a national PHE of this scale.

In general, the national emergency preparedness plan anticipates emergencies of limited size and duration in a community, such as a hurricane, earthquake or mass casualty event. Similarly, many hospital plans and drills were built around responding to such scenarios. While such emergencies are far more common than all-encompassing nationwide emergencies, the challenges of a broader, longer-lasting emergency such as a pandemic necessitate planning for and practicing responses to such events. Most importantly, broad-scale emergencies and long-duration emergencies require connections and collaborations that far exceed those used in more localized, time-limited emergencies. That collaboration creates and fosters the opportunity to use the strengths of health care systems and the experiences of practitioners on the front line to inform other clinicians across the country in ways that would not be needed in a more localized emergency.

HHS’ plans for responding to a national emergency should be rethought and better coordinated with state-level partners, as well as with organizations key to an effective national response, including hospitals. For example, this coordination could help ensure the SNS is redesigned to provide sufficient backup during an event like the COVID-19 PHE. It also could be used to help ensure that the Centers for Disease Control and Prevention’s (CDC) plans for managing the distribution of information and critical supplies, like vaccines and therapeutics, extend beyond the focus on distributing the vital resources to the state, and ensure follow through to the point of ensuring safe administration to intended recipients. These issues and others require serious thought and attention, and we encourage Congress to require the Administration to consider and address them in an updated HHS emergency preparedness playbook. We describe recommended planning updates below.

Plan for the Unwinding of any Enduring PHE. For hospitals and other health care organizations across the country, the pandemic created many opportunities to learn how to treat patients in innovative ways, deepen caregiving relationships with patients with chronic conditions and learn to use new drugs and devices. Regulators waived some of the usual requirements to allow hospitals and other health care organizations to care for as many people as possible. Clinicians used this flexibility and their own ingenuity to accommodate COVID-19 protocols, address the overwhelming need for beds and breathing assistance and continue to manage patient care regardless of supply chain shortages. As a result, regulators and clinicians have found some of this innovation to be so helpful to patients and effective in providing needed care that they believe it should be made permanent. Yet, statutory and regulatory barriers do not enable us to effectively and thoughtfully wind down the pandemic changes over time or move to establish the changes permanently where appropriate without engaging in lengthy processes to change laws and regulations.

Through PAHPA, a structure should be set in place by which Congress and the relevant federal agencies, acting on the advice of clinicians, health care organization leaders, patients, patients’ families and other interested stakeholders, can identify which changes should be kept and which should be brought to a swift end when the situation allows. Just as we need a plan for responding to a large-scale emergency, the AHA recommends that Congress should require in PAHPA the development of a playbook for the unwinding of the emergency.

Using Simulations to Prepare for Unfamiliar Tasks. In many types of emergencies, but especially a pandemic, it is likely that new medications, vaccines or other medical countermeasures will be developed and distributed to impacted populations; yet, the process for doing so may be difficult to manage. For example, the distribution of the first COVID-19 vaccine included some unique and very specific requirements, such as rules for ultra-cold storage.

CDC developed a playbook and conducted simulations for the distribution of these vaccines with the state public health authorities and its distributor, AmeriSource Bergen, but the agency did not include the hospitals and clinics that would be receiving and administering the vaccines. As a result, there was confusion that either limited the effectiveness of the vaccine or required that doses be discarded at a time when vaccines were in short supply. In fact, hospitals report that during the COVID-19 PHE, they sometimes received pallets of federally purchased and state distributed countermeasures and other supplies in their loading docks without notice.

These situations might have been avoided had the plans and simulations been developed and carried out to include the hospitals and clinics. Such simulations are effective for identifying vulnerabilities in any process, but particularly in hard to manage and difficult to execute operations. The AHA recommends that PAHPA require the playbooks and simulations for such complex processes explicitly include this type of a comprehensive approach.

Plan to Take Advantage of Multistate Care Delivery Organizations. The current emergency preparedness plans and playbooks call for health care delivery interactions to run from the federal agencies to the states, and from the states to the hospitals within those states. However, for large health systems that stretch across multiple states, this means that there are differences in policy and protocol based on the state in which an individual hospital is located. This causes problems for the health systems that are then forced to follow different rules for operations from state to state. Further, it hinders their ability to have a uniform and efficient approach to care delivery across their enterprise and diminishes their ability to be part of a more systemic response to a danger such as COVID-19. The AHA recommends that PAHPA allow the federal agencies to work directly with large health care delivery organizations, as it did with CVS and Walgreens during the COVID-19 PHE, to administer vaccines and therapeutics.


The COVID-19 pandemic has exacerbated many long-standing access and quality issues that threaten the resilience of our nation’s health care supply chain. In particular, the PHE has magnified the dangers inherent in failing to address gaps and deficiencies in the drug, medical device and other supply chains. Supply chain issues can adversely impact patient care by delaying treatment, worsening patients’ health outcomes or requiring patients to switch to non-optimal treatment regimens.

Increase Federal Investment s to Strengthen the National Supply Chain

America’s hospitals and health systems rely on the efficient and timely delivery of life saving supplies and drugs in order to provide safe and effective care, especially in times of emergency. Without substantial steps to strengthen the current framework, future PHEs will again put us at risk for the same shortfalls the U.S. experienced in the COVID 19 pandemic. Therefore, we support in creased investments to maintain consistent access to medical supplies for hospitals and the entire health care system. This would include increasing manufacturing redundancy, diversifying where raw materials are produced and where products are manufactured and building capacity within the overall supply chain.

Specifically, the AHA urges Congress to include provisions in PAPHA that will strengthen the nation’s medical supply chain, including:

  • Diversifying manufacturing sites and raw material sources to ensure supply chain sustainability;
  •  Supporting advancements in reuse and reprocessing technologies to mitigate supply challenges while decreasing waste and environmental impact;
  •  Investing in new product development;
  •  Developing and adapting certain data standards to aid in early detection and mitigation of supply shortages; and
  • Increasing end-user inventories and incentivizing them to keep additional supplies stocked.

For additional context and details, we refer you to our Fact Sheet on this critical issue.

Invest in an Improved Strategic National Stockpile

Throughout the COVID-19 pandemic, but especially in its first months, hospitals, health systems and other health care providers experienced severe shortages of essential personal protective equipment, critical care drugs, ventilators and other vital products and supplies, resulting in desperate efforts to acquire products necessary to provide care to a surging number of critically ill patients and to protect the hospital workforce and visitors. Many providers turned to stockpiles in their state as well as to the federal SNS, to little avail. Unfortunately, state and federal stockpiles were not designed to provide sufficient resources to support an extended duration and nationwide emergency, like the COVID-19 PHE. Health care providers, distributors and manufacturers, reliant on just-in-time inventory management systems, were not able to respond to the demand, particularly in the face of a global pandemic resulting in world-wide disruptions in the supply chain. Moreover, over-reliance on foreign producers of essential drugs, devices and other supplies, and inadequate domestic production of these supplies, left the U.S. unable to quickly increase production.

The AHA recommends that Congress take a number of steps to strengthen the SNS, including:

  •  Ensure the reliable availability of a wide variety of essential goods for medical care and providing sufficient support for the critical role of the SNS in that system;
  • Require that the Administration for Strategic Preparedness and Response (ASPR) develop an easy-to-understand and real-time system health care providers can use to learn what products are available in the SNS and in what amount, as well as how to request and receive SNS supplies;
  • Require ASPR to employ a vendor-managed inventory system that rotates supplies into the commercial market before they expire, while at the same time purchasing replacement supplies. This is needed in order to protect against expiration and loss of use of SNS supplies, which may be stored for long periods of time; and
  • Require increased clinician and health care operations input into SNS planning, which would facilitate more efficient stockpiling and enhance preparedness for dispensing the stockpile’s products to patients and/or the public during future emergencies. It would also enable ASPR to stay informed of the development of new devices and products that replace older approaches to care delivery.

Mitigate and Prevent Drug and Device Shortages

America’s hospitals and health systems have long been critically concerned about shortages of a wide range of drugs and medical devices to treat patients. The COVID-19 pandemic, with its record surge in demand due to large numbers of critically ill patients, has exacerbated such shortages and called attention to increasing concerns about the stability and security of the U.S. and global medical supplies. The AHA’s recommendations to address such shortages follow.

Expand Medical Device Manufacturer Notifications. Health care supply disruptions and shortages of critical medical devices impact the ability of hospitals and health systems to provide timely and high quality care. The Coronavirus Aid, Relief, and Economic Security Act (CARES Act), provided the FDA with the authority, during or in advance of a declared PHE, to require device companies to notify the Secretary of HHS of a permanent discontinuance in the manufacture of certain devices or an interruption in the manufacture of certain devices that is likely to lead to a meaningful disruption in supply of the device.

While the new authority has been helpful, the tie to PHEs limits the FDA’s ability to respond to any early signs of supply constraints or a potential shortage situation. Interruptions in supply and shortages can occur unpredictably outside of a PHE and have serious implications for public health and patient and health care personnel safety. The AHA urges Congress to amend the current device shortage notification requirements to apply more generally and not only during a PHE.

Incentivize Quality and Resilience to Prevent Drug and Device Shortages. While we appreciate the efforts of the FDA and ASPR to help alleviate recent shortages, more needs to be done because acute and chronic shortages negatively impact patient care and hamper hospital operations and the ability to continue to provide the highest quality of care possible. As such, the AHA believes a number of additional changes should be made to help prevent, mitigate and resolve shortages.

The AHA recommends that Congress:

  • Require the FDA to develop ratings of the quality management processes of drugs and device manufacturers which are predictive of supply chain and manufacturing vulnerabilities and make these quality ratings publicly available;
  • Require drug manufacturers to disclose to the FDA the locations where their products are manufactured, including contract manufacturer locations, as well as the locations from which they source key starting materials (KSM), active pharmaceutical ingredients (API) and excipients used in their finished products, in order illuminate the extent of vulnerability for a product and to allow the development of targeted supply strengthening measures;
  • Require drug manufacturers to notify the FDA of unusual spikes in demand of essential drugs in order to allow the agency to take steps to mitigate or prevent any impacts on availability and prevent potential shortages; and
  • Require the FDA to identify those essential drugs and devices, including their KSM, API and excipients and component parts, that should have increased domestic manufacturing capacity in order to improve the resilience of the U.S. drug and device supply chain and make recommendations to incentivize their production.


Hospitals and health systems support the collection and reporting of data that meaningfully informs decisions related to the nation’s health and well-being. However, the approach to collecting COVID-19 data exposed myriad challenges, including extremely burdensome requests during a time when all available personnel were responding to an evolving situation at the local level, as well as excessively punitive consequences for failure to report. Some of these data reporting requirements persist; however, the end of the PHE marks an appropriate time to rethink the data collection strategy for the future, with a focus on automation as the goal to reduce the previously mentioned burdens.

The AHA recommends that the PAHPA legislation include support for activities to build the national infrastructure for sharing important public health information among hospitals and health systems, state and local public health agencies, EHR vendors and others. Such activities could include identifying potentially relevant technical standards, articulating a process that could be activated in future emergencies and providing technical support to all stakeholders in preparing for and executing on the approach.

In future emergencies and providing technical support to all stakeholders in preparing for and executing on the approach. In future emergencies, we also urge that the federal government engage and seek input from hospitals and others in the health care field on the meaningfulness of specific data elements and articulate transparently how any collected data are being used to inform a federal response. We are committed to working with Congress and the Administration on continuing to invest in real-time data available to the federal, state and local governments to ensure we are equal partners in providing insight into where patients will have the most efficient access to care.


Authorize HPP at a Significantly Increased Level

When a disaster strikes, people turn to hospitals for help. Congress recognized this role by creating the HPP in PAHPA. However, the HPP is the only federal funding mechanism for health care system emergency preparedness and response. Since 2002, it has provided critical funding and other resources to aid the health care system response to a wide range of emergencies via cooperative agreements with 62 health departments in all states, U.S. territories and in four cities. The HPP supported enhanced planning and response; facilitated the integration of public and private-sector emergency planning to increase the preparedness, response and surge capacity of hospitals; and improved state and local infrastructure to help health systems and hospitals prepare for PHEs and other disasters. These investments contributed to saving lives and reducing the impact of emergencies and disasters, particularly for localized events.

However, the HPP’s funding has not kept pace with the ever-changing and growing threats faced by hospitals, health care systems and communities. Indeed, authorized funding levels and annual appropriations for the HPP have significantly declined since the program began. The HPP’s highest level of appropriation was $515 million in fiscal year (FY) 2003, yet the program funding has fallen to only $305 million in FY 2023. This is a vastly insufficient level given the expected responsibilities of preparing the health care system for a surge of patients, continuity of operations and recovery during an emergency. The HPP’s authorized funding limits also have declined over time, from a high of $520 million in FY 2003, to $385 million in the most recent reauthorization in FY 2018. Additional and sustained funding will be necessary to not only restore HPP to its original capacity, but also to strengthen the program to address increasing threats to public health. One needs to look only at the tremendous strain that the COVID-19 pandemic placed on the nation’s health care system to understand why additional support for health care preparedness and response is needed.

The HPP should be authorized at a significantly increased level. As such, we urge that the program’s authorization be at least doubled for FYs 2024 through 2029. This investment will help prepare and equip our nationwide health care system in advance of the growing number and scope of future disasters and PHEs.

Authorize Additional Dedicated HPP Funds for Hospitals and Health Systems

Over time HPP has broadened its focus and its funding beyond hospitals to other response partners. In particular, the vast majority of HPP funds (nearly 80% in 2023) supports the sub-state Health Care Coalitions (HCCs) – regional collaborations between health care organizations, emergency management, public health agencies and other private partners. While HCC funding supports regional partner coordination and collaboration in advance of and during local emergencies, the result is that only a fraction of the HPP funds is directly provided to hospitals and health systems to support their preparedness and response activities. Currently, the primary HPP investments directed to hospitals to support health care readiness are funding for the Regional Emerging Special Pathogen Treatment Centers (RESPTCs), Special Pathogen Treatment Centers and the Regional Disaster Health Response System (RDHRS). These programs have demonstrated the substantial opportunity that direct funding of hospital and health system partners can provide in improving regional disaster response.

The AHA recommends that PAHPA include in the HPP additional dedicated, direct-to-hospital-funding that will supplement (and not supplant) current investments. Such dedicated funding will help rebuild the program after years of underfunding and provide additional resources to hospitals and health systems to improve their preparedness, taking into consideration the lessons learned from the COVID-19 pandemic and other recent emergencies and disasters.

Broaden the Definition of Eligible Awardees for the HPP Cooperative Agreements

The AHA has long supported introducing competition in determining which entities become the HPP’s cooperative agreement recipients. Specifically, we recommend that hospitals and hospital associations, such as academic medical centers, health systems and state and metro hospital associations, also be permitted to compete to be the HPP recipient for their jurisdiction, in addition to the current state, territorial and city health department recipients.

This competition would provide ASPR with the opportunity to fund those entities that present the most innovative approaches to health care delivery system readiness. As evidence that the entities we cite can be prepared for and capable of administering HPP funds, we note that ASPR successfully distributed $175 million in emergency supplemental funds1 to hospital associations in all 50 states, the District of Columbia, New York city and Puerto Rico in order to support the preparedness and response activities and needs of hospitals, health systems and health care providers on the front lines of the COVID-19 pandemic.

A second benefit of introducing competition is the potential to address the misalignment between HPP’s health care mission and its current recipients’ public health mission. While most of the HPP’s public health department recipients work well with their private-sector health care delivery system counterparts to enhance preparedness and response, others struggle to work collaboratively with the private health care system that they also regulate. Through this recommendation, certain private health care entities and hospital associations that have the organizational capacity and initiative to lead sector-wide preparedness and response activities also would be able to compete for HPP funds for their state or jurisdiction.

Permit HPP Funding to Cross State Lines

Patients are routinely transferred across state lines to receive higher levels of care (e.g. trauma, stroke, cardiac). However, the current HPP authorities have created state-wide programs that often do not reflect these existing health care operations and referral patterns. The AHA recommends PAHPA allow HPP funding to cross state lines in order to strengthen health care emergency preparedness and response planning across multi-state regions. This will improve emergency response by allowing planning to occur in a manner that reflects day-to-day care referral patterns and takes full advantage of these existing relationships.


As recorded by the HHS Office of Civil Rights,2 hacking incidents against health care entities have increased over 60% during the past three years, in correlation with the onset of the pandemic. In March of 2023, the Federal Bureau of Investigation’s Internet Crime Complaint Center reported that the health care sector had the largest number of reported ransomware attacks of any sector in 2022.3 Frequent government cyber alerts warn of foreign-based ransomware gangs actively targeting health care4,5 which disrupt and delay the delivery of health care services and pose a risk to patient safety.6,7

High impact ransomware attacks against hospitals and health systems over the past three years have often rendered mission critical medical technology and health data unavailable, resulting in the loss of diagnostic technology, diversion of ambulances, increased ED wait times and delayed elective surgeries and cancer treatments. These attacks not only effect the targeted organization, but also impact surrounding hospitals and health systems as ambulances and patients are diverted to other organizations to receive needed care.8

The AHA recommends that the PAHPA legislation:

  • Designate as an “all hazards” incident high impact cyber and ransomware attacks, which result in the disruption and delay of health care delivery at one or more hospitals;
  • Fund and provide support for the appropriate federal agencies to help hospitals and health systems enhance their emergency preparedness, response, resiliency and recovery capabilities related to cyberattacks; and
  • Fund the appropriate federal agencies to provide emergency response for high impact cyberattacks targeting hospitals and health systems and provide human, technical and financial support to the victim organizations to minimize harm to public health and safety.


The NACCD is instrumental for ensuring that the national pandemic and emergency response infrastructure meets the unique needs of children, in a developmentally and socially appropriate manner, across their entire spectrum of their physical, mental, emotional and behavioral well-being. The AHA supports strengthening the NACCD by expanding its membership and scope of authority to address important issues, such as addressing pediatric workforce issues, supply shortages and products for the SNS. In order to do so, we also recommend that via PAHPA, ASPR be provided with appropriate funding, resources and authority to implement NACCD recommendations.

We thank you for the opportunity to submit comments on the PAHPA reauthorization RFI and look forward to continuing to working with you on this important legislation. Please contact me if you have questions or feel free to have a member of your team contact Megan Cundari, AHA’s director for federal relations, at mcundari@aha.org.



Lisa Kidder Hrobsky
Senior Vice President of Advocacy & Political Affairs


1 Via the Coronavirus Preparedness and Response Supplemental Appropriations Act and the Coronavirus Aid, Relief, and Economic Security Act (CARES Act).
2 https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.
3 https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf (page 14).
4 https://www.cisa.gov/stopransomware/newsroom.
5 https://www.aha.org/cybersecurity.
6 https://jamanetwork.com/journals/jama-health-forum/fullarticle/2799961.
7 https://www.cisa.gov/sites/default/files/publications/CISA_Insight_Provide_Medical_Care_Sep2021.pdf.
8 https://www.fiercehealthcare.com/tech/uhs-hit-massive-cyber-attack-as-hospitals-divert-surgeries-ambulances.