Displaying 11 results for

State Policy Trends in Cybersecurity and Public Health Preparedness Maggie Nilz Learn how states are including cybersecurity in their emergency preparedness work in this Health Policy Update. Cybersecurity is an increasingly important component of public health preparedness as state cybersecurity policy intersects with public health agency responsibilities. Public health agencies rely on interconnected digital systems and critical infrastructure for disease surveillance, laboratory reporting, emergency communications, and health data management, making cybersecurity critical to maintaining these functions. Beyond compromising sensitive data and potentially harming patients, cyber incidents can disrupt essential public health services, including emergency response operations. Health care data breaches have steadily increased over the last 15 years, highlighting growing risks for government and health systems. A recent report showed that more than 7,000 health care data breaches were reported to the Department of Health and Human Services since 2009, and reported HIPAA data breaches in 2023 were nearly double the number recorded in 2018. Meanwhile, preparedness capacity has lagged: as of 2022, only 13% of local health departments reported being prepared for cyber-related disruptions, and recent scans show cybersecurity is rarely included in emergency preparedness planning. In response at the federal level, HHS recently announced it is undoing a 2024 reorganization by returning department-wide technology responsibilities to the Office of the Chief Information Officer while refocusing the Office of the National Coordinator for Health Information Technology on improving nationwide health IT interoperability and data sharing. In recent years, state and territorial legislatures have begun to address these gaps by incorporating cybersecurity into preparedness, health care oversight, and statewide governance structures. These legislative trends signal a need to integrate cybersecurity into emergency operations plans, strengthen cross-sector coordination, and safeguard the continuity of public health services. Some of the most recent policies considered and enacted by legislatures treat cyber incidents as emergencies, expand reporting requirements, and strengthen cyber governance. Cyber Incidents Are Being Built into Emergency Preparedness Frameworks In response to these growing threats, jurisdictions have begun incorporating cyber response into emergency plans and strategies, reinforcing cybersecurity as essential to preparedness. These developments highlight growing awareness that cyber incidents can disrupt critical services, much like natural disasters. In 2025, New York enacted S 7672, which requires municipal entities and public authorities report cybersecurity incidents and demands for ransom to the state Division of Homeland Security and Emergency Services. In addition, it directs the Director of the Office of Information Services to establish cybersecurity training and protection standards for state systems as well as require cybersecurity training for state and local government employees. Virginia is currently considering HB 83, which would establish a volunteer Cyber Civilian Corps within the state IT agency to provide rapid assistance during cybersecurity incidents affecting municipalities, nonprofits, education, and critical infrastructure. Preparedness efforts also extend beyond legislation to executive action. In February 2026, Minnesota Governor Tim Walz authorized $1.2 million in state disaster assistance to support response efforts and restore critical systems in response to a cyber incident that disrupted digital services in Saint Paul on July 29, 2025. Additionally, the National Governors Association has included cybersecurity as a primary consideration for planning and preparedness in their latest edition of the Public Health Emergency Playbook. Health care and Public Health Critical Sectors Are Facing New Cyber Requirements Beyond emergency response frameworks, jurisdictions are also adopting cybersecurity reporting and planning requirements for health care and public health organizations. Companion bills in Tennessee (HB 511/SB 555) would require health care providers and facilities to notify their contracted health insurers of cybersecurity incidents. In Maine, LD 2103 would require hospitals to adopt cybersecurity plans to protect patient data and maintain operations, and must include cybersecurity training for employees and board members. New Jersey is looking to adopt and implement a more comprehensive cybersecurity plan across all sectors. This session, legislators have introduced at least two cyber security bills: A 3231 would require “sensitive businesses” (defined as those engaged in financial, essential infrastructure, or health care industries) to report cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) when they are aware of their occurrence and would require NJCCIC to conduct a cybersecurity audit within 30 days of notification. A 3283 would require the same “sensitive businesses” to implement cybersecurity programs in accordance with standards adopted by NJCCIC and certify compliance annually. As states expand reporting and cybersecurity requirements, these obligations may intersect with public health reporting and continuity planning. States Are Strengthening Government Cyber Governance and Coordination In addition to sector-specific requirements, jurisdictions are also strengthening the governance structures responsible for coordinating cybersecurity, improving their ability to respond to large-scale incidents affecting public systems. Legislation enacted recently in Texas and California aim to improve coordination among state government by establishing a state agency centralizing cybersecurity incident prevention and response (Texas HB 150) and mandating the development of a cybersecurity playbook to strengthen information sharing (California AB 979). A 2024 bill enacted in Puerto Rico (PC 1530) requires commonwealth agencies to develop and implement a cybersecurity program, which must include a yearly risk assessment as well as vulnerability assessment. At least three jurisdictions are currently considering bills strengthening established cybersecurity programs, with two states recently passing legislation. Utah recently enacted a bill authorizing the Utah Cyber Center to conduct voluntary cybersecurity risk assessments for critical infrastructure and coordinate with government entities on infrastructure safety (HB 165). Utah also enacted legislation creating a specific funding stream for the Center to use for various activities, including implementing a statewide cybersecurity plan and conducting assessments for governmental entities (SB 123). Kansas enacted HB 2574, which would require chief information security officers for the executive, legislative, and judicial branches to adopt cybersecurity programs based on a nationally recognized standard for governmental entities. Finally, Florida recently passed SB 7024, which would expand the state’s public record exemption to include risk assessments, information related to cybersecurity breaches, and information related to data protection, ensuring the confidentiality of sensitive cybersecurity information held by state agencies; the bill is with the governor for final consideration. Key Takeaways for Preparedness Leaders Cybersecurity is critical for preparedness across multiple policy areas, and requires new planning, coordination, and oversight responsibilities. By including cyber incidents into disaster frameworks, standards for health care organizations, and governance, preparedness leaders may find themselves more directly engaged in integrating cybersecurity into emergency operations, exercises, and cross-sector partnerships. For state and territorial health agencies beginning to incorporate cybersecurity into their preparedness plans, agencies such as the Cybersecurity and Infrastructure Security Agency provide jurisdictional support and resources to guide this work. article yes

States Reassessing Vaccine Policy and Public Health Powers Shalini Nair, Andy Baker-White Review of state policies to weaken vaccine requirements and reduce public health powers. Immunization is a key pillar of public health, crucial for protecting communities and preventing infectious diseases from spreading. State and territorial health officials and their departments play critical roles in setting and implementing immunization requirements, managing disease surveillance and outbreak response, and ensuring access to vaccines. In recent years, however, the immunization landscape has evolved as legislative changes alter public health authority and access to vaccines. As these challenges persist, public health officials must be informed and prepared to navigate the dynamic policy environment to ensure immunization programs’ continued effectiveness at protecting public health. The True Cost of Vaccine Skepticism and Misinformation In the years since the pandemic, rates of routine vaccinations among U.S. children have steadily declined; there has simultaneously been an increase in non-medical exemptions. While reasoning behind personal decisions about vaccination are not always clear, increasing prominence of vaccine-related myths is a significant contributor to this phenomenon. Perhaps the most glaring consequence of this decrease is best illustrated by the 2025 measles outbreak and the first measles-associated deaths in more than a decade. Previously considered to have been eliminated, measles is now under threat of resurgence as vaccine rates fall below the thresholds to uphold herd immunity. Health officials are also seeing declines in coverage for several other vaccine preventable diseases like pertussis, mumps, hepatitis, and even polio. Legislation Restricts Innovation and Sows Doubt About Vaccine Components The use of mRNA technology expanded in 2020 following its breakthrough success in COVID-19 vaccines. These mRNA vaccines prevented more than 120 million additional COVID-19 infections and 3.2 million additional deaths. Researchers are currently assessing mRNA technology to address pandemic influenza, HIV, Zika, and even cancer. During 2025 sessions, at least seven states introduced legislation to ban or limit using mRNA vaccines. Iowa’s SF 360 sought to prohibit any “gene-based vaccines” (i.e., those developed using mRNA or DNA technology); the bill was based on a widely debunked myth that mRNA vaccines can interact with and alter human DNA (they can’t). New York’s A 4798 would prevent administering COVID-19 mRNA vaccines until the department of health conducts a risk-benefit analysis. Several states have introduced legislation to prohibit selling — or require labeling foods that contain — vaccine or vaccine material. This bill is based on another common internet rumor that mRNA vaccines are being introduced into the food supply via livestock and produce (they aren’t). Nonetheless, Utah enacted a bill (HB 84) requiring that food intended for human consumption that contains a vaccine or vaccine material be designated as a drug. Similar bills were introduced in Florida (HB 525), Alabama (HB 316), and Tennessee (SB 616, HB 1100). Vaccine Authority’s Shifting Landscape While the federal government plays an important role in putting forth policy recommendations, the ultimate power to impose or revoke vaccine requirements and determine exemptions outside of health emergencies rests with states. In many jurisdictions, state health agency expertise determines the vaccines required for school enrollment. These decisions, while ultimately at the feet of state health officials, rely heavily on input from experienced, knowledgeable, and skilled agency staff. Recent legislative actions in several states seek to shift authority for determining school-based immunization requirements solely to the legislature. Idaho’s new law (H 290) removes the state board of health’s authority to determine which immunizations are required for daycare and school enrollment, as well as the manner and frequency of their administration. The bill also repeals a former law establishing the Idaho Childhood Immunization Policy Commission, created in 2010 to issue recommendations to the legislature and board of health. A similar effort in Maine (LD 727) would remove health department authority to determine school vaccine requirements as part of a larger repeal effort responding to the 2019 law disallowing vaccine exemptions based on religious or philosophical grounds. In New Hampshire, existing statutes define required immunizations for school attendance and allow the state health official to add to this list via the rulemaking process. Recently, lawmakers introduced a bill (HB 357) that would remove this add-on ability. If passed, existing commissioner-led requirements for vaccines such as varicella, hepatitis B, and Hib would expire in June 2026 and no future amendments could occur under this authority. Several other bills introduced in Texas (HB 468, HB 3304, SB 94, SB 117, HB 3852), West Virginia (SB 108, HB 2203), and North Carolina (HB 89) target shifting authority and/or modifying vaccine requirements for certain school types. Evidence-Based Policy as the Path Forward State and territorial health agencies are foundational to preventing the spread of infectious diseases through vaccine education and administration. ASTHO has identified public health expertise in developing vaccination policy as one of three recommended strategies that prioritize evidence-based public health authority and support agencies to protect and improve health. As this landscape further evolves, ASTHO will continue tracking legislative and executive action on this important public health issue. article yes

The 2020 holiday season is coinciding with a nationwide surge of COVID-19 cases. With great concern that holiday travel to see loved ones may exacerbate community spread of the virus, many states are increasing public health measures before the winter holiday season. As of November 16, 2020, 13 states and D.C. had a quarantine requirement for out-of-state travelers. The U.S. territories also have instituted travel restrictions to limit the spread of COVID-19.

As the number of COVID-19 vaccinations grows, some states are looking at their vaccination rates to determine when to loosen measures that mitigate the spread of COVID-19, such as venue capacity limits, business closure times, and masking requirements. As vaccinations allow businesses to reopen and customers to return, questions have arisen about whether venues or services—especially those that bring people in close contact for long periods of times—such as retail stores, concert venues, entertainment venues, air travel, cruise ships, etc., can require patrons or customers to verify that they received a COVID-19 vaccine. So far, state policy makers have had mixed views on the issue.

A pressing public health issue before the COVID-19 pandemic hit, the need for public health interventions to reduce tobacco use is heightened with a strong association between tobacco use, in all forms, with severe COVID-19 outcomes. Additionally, tobacco use remains the leading cause of preventable death in the U.S., claiming approximately 480,000 deaths each year. Evidence-based policies to reduce tobacco use like raising the age of sale to 21, increasing tobacco pricing, and prohibiting the sale of flavored tobacco products are common public health strategies enacted through state legislation. As anticipated in ASTHO’s 2021 Legislative Prospectus on E-Cigarettes, states are considering many of these evidenced-based tobacco reduction strategies during the 2021 legislative sessions.

Preventing Hypertension Through State Policy Efforts Preventing Hypertension Through State Policy Efforts Beth Giambrone Learn how state legislatures are working to prevent hypertension through avenues like expanded access to care, insurance, and education. Nearly half of all U.S. adults live with hypertension, or high blood pressure. Often called a “silent killer” because it has no noticeable symptoms, hypertension significantly increases the risk of serious health problems, such as heart attack, stroke, and vision loss. It’s also one of the most expensive health conditions, with recent research showing that more than 10% of health care expenditures were associated with hypertension. Managing high blood pressure through a healthy diet, lifestyle changes, and medication (if necessary) are some of the most protective mechanisms against serious health effects. In recent years, state legislatures have started exploring ways to support residents in preventing and managing hypertension through expanded access to care, insurance coverage, and education. Access to Care Heart disease is the leading cause of death for women in the United States, accounting for about 20% of deaths in 2023. Focusing on heart health during key milestones such as pregnancy and menopause can provide a vital safety net in times of significant physical change. Pregnancy can act as a natural "stress test" for the heart, and approximately 10% of all pregnancies are affected by hypertensive disorders of pregnancy (e.g., chronic and gestational hypertension, preeclampsia, and eclampsia). In 2026, at least four states (Maryland, Pennsylvania, Tennessee, and Virginia) are considering bills that would establish pilot programs to improve maternal health for individuals receiving Medicaid, one activity being remote monitoring of blood pressure. Two bills in Florida (HB 1029 and SB 1508) would expand current home visiting programs (i.e., Healthy Start) to include expectant mothers and require the Department of Health to provide them with home blood pressure monitors. Meanwhile, New York companion bills (A 5529 and S 3881) would establish comprehensive care centers in Kings and Bronx Counties. These centers would provide prenatal through postpartum services as well as heart health care, while collaborating with local organizations and universities to research and close gaps in care. Like pregnancy, perimenopause and menopause cause hormonal shifts that make the heart and blood vessels more sensitive to change, increasing the risk for cardiovascular disease. North Carolina (SB 522) is considering a comprehensive bill that aims to improve care for women between the ages of 40 and 65. It would require health insurance to cover services the state deems essential for midlife care, including those that prevent cardiovascular disease. Insurance Coverage In addition, states are exploring how insurance coverage and regulation can support hypertension treatment and prevention, with several aiming to cover blood pressure monitors: Florida’s SB 736 would require the state’s Medicaid program to cover blood pressure monitoring devices for prescribed patients who participate in follow-up care. Minnesota companion bills (HF 2320 and SF 1963) would mandate that health plans cover one monitor every three years for people with uncontrolled blood pressure, and reimburse providers for patient training. Similarly, West Virginia’s SB 252 would provide blood pressure monitors to Medicaid enrollees with uncontrolled hypertension during pregnancy or the first postpartum year. Additionally, New York is considering legislation to reduce health insurance premiums when certain conditions are met. A 7177 would allow health insurers to offer premium reductions if the individual participates in a qualified wellness program (e.g., risk management) or programs that mitigate chronic disease, like hypertension, or promote physical fitness. Public Awareness and Education During this legislative session, several jurisdictions are also exploring public and school-based awareness of heart healthy activities. For example, Georgia’s HB 459 would authorize the Department of Health to implement a comprehensive campaign that includes developing educational materials, partnering with schools and colleges to educate students on cardiovascular disease (i.e., recognizing symptoms), and assisting community health centers with providing free or low-cost screenings. West Virginia is also considering two bills (SB 39 and SB 819) that would mandate 12-week nutrition and aerobic exercise programs for elementary students. Finally, Mississippi introduced a suite of bills (HB 1367, HB 192, and HB 1088) to standardize physical activity, improve nutrition standards, and mandate health curriculums across all grade levels, but the bills recently died in committee. Conclusion Policies aimed at improving heart health can go a long way in reducing hypertension and stopping the silent killer. ASTHO will continue to monitor policies that address hypertension as a core component of public health and provide any necessary updates. OE22-2203 PHIG article yes

Over the past several years, states and jurisdictions have continued to implement important policies to reduce tobacco and nicotine use, including increasing tobacco prices, expanding areas deemed “smoke-free,” limiting the sale of flavored tobacco products, and supporting tobacco cessation programs.

ASTHO staff identified a range of evidence-supported policies considered by state legislatures that could prevent ACEs. This report synthesizes these research and policy proposals and is intended for public health practitioners and policymakers who are considering adopting similar policies.

ASTHO’s 2024 Legislative Session Update: Part One legislative session, state policy, data collection, domestic violence, health information exchange, data privacy, substance misuse, overdose prevention, sexually transmitted infections, reproductive health, contraceptive care, climate change, public health, protect data, user data, personal data, centers for disease control, disease control and prevention, social media, data management, primary care, health organizations, higher risk, family planning, data sources, astho, association of state and territorial health officials Lillian Colasurdo, Maggie Davis, Lana McKinney, JoAnne McClure This past December, ASTHO announced the top 10 public health state policy issues to watch for during the 2024 state and territorial legislative sessions. With at least 30 states concluding their regularly scheduled 2024 sessions, here is a brief update on five of the topics to watch. Data Collection and Exchange As expected, there was an increase in proposed legislation that specifically advances electronic health data access, encourages interoperability, and safeguards identifiable patient health records; this was particularly true for vital records. Hundreds of bills have been introduced this session addressing state vital records systems. The state of Illinois alone has already passed several bills, including HB 2856, which requires veteran status to be designated on death certificates, and HB 2841, which prohibits the assessment of fees to victims of domestic violence who are seeking a certified vital record (birth or death certificate) from the state. Other states such as Arizona (SB 1252) considered legislation that would require the Department of Health to provide vital records information on deceased individuals to the qualifying health information exchange (HIE). Arizona is one of eight jurisdictions (AZ, FL, IA, IL, NH, NJ, OK, and WV) that have proposed legislation addressing HIEs this session. Most of these bills increase requirements to connect to HIEs, but New Hampshire HB 1663 and Oklahoma HB 3556 would allow patients and health care providers to opt out of HIEs. As many states look to address health data privacy concerns, New Hampshire recently passed a constitutional amendment granting the explicit right to privacy and has introduced HB 1663, which would update many of the state’s privacy laws regarding medical records to conform with the constitutional requirements. Just next door, Maine considered legislation (LD 1902) that would strengthen privacy requirements for reproductive and gender-affirming patient health information. Finally, the launch of the new federal Trusted Exchange Framework and Common Agreement (TEFCA) led to the Florida legislature proposing SB 668, which, had it passed, would have required hospitals to make patient records available through a nationally recognized trusted exchange framework. It would also have required the Agency for Health Care Administration to adopt relevant rules. Substance Misuse and Overdose Prevention Measures to prevent substance misuse and reduce overdoses, namely increasing access to opioid antagonists, such as naloxone and regulating substances with the potential for misuse, are priorities this legislative season. ASTHO anticipated that states would consider legislation to reduce fatal overdoses including decriminalizing drug checking equipment, expanding naloxone access and distribution, establishing overdose prevention centers, and establishing state regulatory frameworks for commercial substances with the potential for misuse, including kratom and Delta-8. Current legislative priorities to expand access to naloxone include public spaces, such as libraries, schools, workplaces. Island jurisdictions along with at least four states—Colorado (HB 24-1003), Tennessee (SB 2141), Virginia (HB 732), and Wisconsin (AB 223)—passed legislation to provide greater access to and/or proper storage of naloxone in school settings. Additionally, Virginia passed HB 342 that requires naloxone access in state agency buildings. These legislative actions, along with the approval last year by the FDA of two non-prescription naloxone spray products for over-the-counter use, are collectively powerful policy shifts to expand access to naloxone. In an attempt to regulate substances with the potential for abuse or misuse, specifically kratom, eight states have considered legislation that would restrict the sale to people under the age of 18. Similarly, twelve states have considered legislation that would restrict the sale of kratom to those under the age of 21. At least 22 states have considered legislation that would compel specific labeling requirements for kratom. Of those, California (AB 2365) and New Jersey (A 1188) would require kratom products to be registered with the state health department annually and require lab testing of the product to meet certain qualifications. Preventing Sexually Transmitted Infections ASTHO has spotlighted the growing concerns of rising rates of sexually transmitted infections and state actions reducing congenital syphilis rates and expanding access to HIV prophylaxis (PrEP) and post-exposure prophylaxis (PEP). Rates of both syphilis and congenital syphilis continue to rise at an alarming rate, with more than 10 times as many babies being born with syphilis in 2022 than in 2012. Routine screening and timely and adequate treatment of pregnant people for syphilis, ideally more than 30 days before delivery, can effectively prevent this condition in newborns. Due to increasing cases, the American College of Obstetricians and Gynecologists recently updated their guidance for obstetrician–gynecologists and other obstetric care professionals advising serological screening for all pregnant individuals at the first prenatal visit and universal screening at the third trimester and at birth. During the 2024 legislative session at least two states—Missouri (SB 1260) and Maryland (HB 119)—are considering legislation that would require testing during pregnancy care at the third trimester for syphilis. Maryland’s legislature passed HB 119, which would require screening at the third trimester and at birth, as well as requiring the hospital to determine the syphilis status of the birthing parent before discharging the newborn. In 2023, New York enacted legislation (A 3007) that requires syphilis screening in the third trimester, and in the current legislative session they are considering S 2472, which would allow the state health department to provide education about congenital syphilis and screenings. At least six states have considered and passed legislation during the 2024 legislative session regarding expanded access for HIV prophylaxis (PrEP) and post-exposure prophylaxis (PEP). Of those considered, Georgia enacted HB 1028 to allow PEP to be issued by a standing order; Florida’s legislature passed HB 159 that would allow pharmacists to screen for HIV exposure, order, and dispense prevention drugs PEP and PrEP and sent it to the governor. Similarly, in Delaware the Senate chamber passed SB 194 that would permit pharmacists to provide PrEP and PEP pursuant to an approved protocol. Family and Reproductive Health Policymakers across all levels of government continued taking steps to make it easier for people to access contraceptives. In 2023, at least 14 states enacted laws in 2023 to facilitate expanding access to contraceptive care by either expanding the ability for pharmacists to dispense birth control without an individualized prescription and/or allowing pharmacists to dispense up to 12 months of contraceptives at once. So far in 2024, at least 13 jurisdictions considered legislation allowing pharmacists to dispense contraceptives without a prescription and at least 18 states considered legislation supporting access to 12 month supply of contraceptives. Following FDA’s July 2023 approval of Opill—the first over-the-counter (OTC) birth control pill—the drug is currently available in stores with several major pharmacies and health plans announcing that they will provide the medication at zero cost for many health plan sponsors. To further support access to Opill, at least two states (New Mexico and Wisconsin) issued standing orders for Opill to facilitate Medicaid coverage of the medication. Additionally, Maryland’s legislature passed SB 527 in March 2024, which requires community colleges to develop and implement a plan to provide students access to OTC contraception. In February 2024, New York enacted S 8096 allowing the commissioner of health to issue a standing order allowing a pharmacist to dispense self-administered hormonal contraceptives, effective retroactively to January 1, 2024. Under the new law, New York’s Commissioner of Health issued a standing order to allow pharmacists to dispense up to 12 months of self-administered hormonal contraceptives like birth control pills, vaginal rings, and contraceptive patches. Optimal Health for All ASTHO anticipates policymakers will take steps to improve collection of health disparities data, address inequities rural communities face in accessing care, and to support climate change adaptation planning efforts. So far in the 2024 legislative session, several states are considering bills to improve health care access and outcomes in rural areas. California is considering legislation (SB 945) that would build an integrated data dashboard to provide the public with information on the health impacts caused by wildfires and the effectiveness of forest health and wildfire mitigation on health outcomes. Additionally, California (AB 2342) is looking to ensure critical access hospitals on remote islands receive adequate funding through a dedicated annual supplement. New York is considering at least two bills that would promote rural health care access. First, New York S 8582 would create a pilot program to identify rural health zones and convene a rural health zone board

Recent state laws and governor emergency orders prohibiting universal school mask protocols are complicating the implementation of CDC’s evidence-based guidance for COVID-19 mitigation measures for in-person school. Ten states have enacted laws (Arizona, Arkansas, Iowa, North Dakota, Oklahoma, South Carolina, and Utah) or issued executive orders (Florida, Tennessee, and Texas) to limit or prohibit issuing universal face mask protocols for schools and in eight of these states the law or order now faces a legal challenge

Continuing ASTHO’s Legislative Prospectus series—which highlights the top 10 public health policy issues for 2022—this post focuses on mental and behavioral health, as well as supporting the public health workforce.