Committee approves amended bill requiring hospital cyber‑security and continuity plans

The Health and Human Services Committee advanced LD2103, an act that would require hospitals to develop and maintain cyber‑security plans emphasizing continuity of patient care when electronic systems are unavailable.

Analyst Sam Sen summarized extensive testimony about cyber incidents that disrupted hospital operations at several Maine systems last year and cited national trends showing increased attacks and larger exposures of patient records. The committee adopted a substantial amendment that centers plans on recognized federal best practices and adds operational continuity requirements.

Under the adopted amendment, hospitals must develop plans informed by the Cybersecurity and Infrastructure Security Agency (CISA), the National Institute of Standards and Technology (NIST), HIPAA security requirements, and health‑sector guidance; review plans at least annually; conduct downtime drills and tabletop exercises; perform vulnerability scans and annual penetration testing (with high‑level summaries provided, not raw test results); and maintain arrangements with a sufficient number of regional partners to support core services (imaging, oncology, pharmacy, maternal care) if systems are disrupted. Plans must include processes for triage, diversion and timely integration of manually charted records into electronic health records after an event. The amendment also includes a confidentiality provision for plan and audit results; the committee was advised that a public‑records exception would need judiciary committee review.

Director Bill Monteo (Division of Licensing) said the amendment aims to centralize planning and move cyber‑preparedness "to the next level," because recent incidents produced multi‑day downtimes that impaired diagnostic equipment and timely treatments. "When the system goes down ... how do we then ensure that we triage the patients and get access to the information that people need," Monteo said, describing scenarios where cancer therapy or imaging might be delayed.

Sponsor Representative Julie McCabe said the language grew from conversations with hospital administrators, frontline staff and regulators; she proposed edits accepted by the committee, including removing an infeasible same‑day paper‑access requirement, clarifying that transportation language refers to case‑management for continuity rather than obligating hospitals to provide transport, and adding an effective date of Jan. 1, 2027 to allow hospitals time to implement new requirements.

Representative Sam Zagger moved to pass LD2103 as amended; Representative Dan Shagori seconded. The motion passed on a voice vote. Committee staff noted additional language review was needed and that the public records exception will require judiciary referral.

Next steps: committee staff will finalize amendment language, refer the public‑records provision to the Judiciary Committee, and return a final draft for reporting and fiscal review.