Displaying 5 results for

State Policy Trends in Cybersecurity and Public Health Preparedness Maggie Nilz Learn how states are including cybersecurity in their emergency preparedness work in this Health Policy Update. Cybersecurity is an increasingly important component of public health preparedness as state cybersecurity policy intersects with public health agency responsibilities. Public health agencies rely on interconnected digital systems and critical infrastructure for disease surveillance, laboratory reporting, emergency communications, and health data management, making cybersecurity critical to maintaining these functions. Beyond compromising sensitive data and potentially harming patients, cyber incidents can disrupt essential public health services, including emergency response operations. Health care data breaches have steadily increased over the last 15 years, highlighting growing risks for government and health systems. A recent report showed that more than 7,000 health care data breaches were reported to the Department of Health and Human Services since 2009, and reported HIPAA data breaches in 2023 were nearly double the number recorded in 2018. Meanwhile, preparedness capacity has lagged: as of 2022, only 13% of local health departments reported being prepared for cyber-related disruptions, and recent scans show cybersecurity is rarely included in emergency preparedness planning. In response at the federal level, HHS recently announced it is undoing a 2024 reorganization by returning department-wide technology responsibilities to the Office of the Chief Information Officer while refocusing the Office of the National Coordinator for Health Information Technology on improving nationwide health IT interoperability and data sharing. In recent years, state and territorial legislatures have begun to address these gaps by incorporating cybersecurity into preparedness, health care oversight, and statewide governance structures. These legislative trends signal a need to integrate cybersecurity into emergency operations plans, strengthen cross-sector coordination, and safeguard the continuity of public health services. Some of the most recent policies considered and enacted by legislatures treat cyber incidents as emergencies, expand reporting requirements, and strengthen cyber governance. Cyber Incidents Are Being Built into Emergency Preparedness Frameworks In response to these growing threats, jurisdictions have begun incorporating cyber response into emergency plans and strategies, reinforcing cybersecurity as essential to preparedness. These developments highlight growing awareness that cyber incidents can disrupt critical services, much like natural disasters. In 2025, New York enacted S 7672, which requires municipal entities and public authorities report cybersecurity incidents and demands for ransom to the state Division of Homeland Security and Emergency Services. In addition, it directs the Director of the Office of Information Services to establish cybersecurity training and protection standards for state systems as well as require cybersecurity training for state and local government employees. Virginia is currently considering HB 83, which would establish a volunteer Cyber Civilian Corps within the state IT agency to provide rapid assistance during cybersecurity incidents affecting municipalities, nonprofits, education, and critical infrastructure. Preparedness efforts also extend beyond legislation to executive action. In February 2026, Minnesota Governor Tim Walz authorized $1.2 million in state disaster assistance to support response efforts and restore critical systems in response to a cyber incident that disrupted digital services in Saint Paul on July 29, 2025. Additionally, the National Governors Association has included cybersecurity as a primary consideration for planning and preparedness in their latest edition of the Public Health Emergency Playbook. Health care and Public Health Critical Sectors Are Facing New Cyber Requirements Beyond emergency response frameworks, jurisdictions are also adopting cybersecurity reporting and planning requirements for health care and public health organizations. Companion bills in Tennessee (HB 511/SB 555) would require health care providers and facilities to notify their contracted health insurers of cybersecurity incidents. In Maine, LD 2103 would require hospitals to adopt cybersecurity plans to protect patient data and maintain operations, and must include cybersecurity training for employees and board members. New Jersey is looking to adopt and implement a more comprehensive cybersecurity plan across all sectors. This session, legislators have introduced at least two cyber security bills: A 3231 would require “sensitive businesses” (defined as those engaged in financial, essential infrastructure, or health care industries) to report cybersecurity incidents to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC) when they are aware of their occurrence and would require NJCCIC to conduct a cybersecurity audit within 30 days of notification. A 3283 would require the same “sensitive businesses” to implement cybersecurity programs in accordance with standards adopted by NJCCIC and certify compliance annually. As states expand reporting and cybersecurity requirements, these obligations may intersect with public health reporting and continuity planning. States Are Strengthening Government Cyber Governance and Coordination In addition to sector-specific requirements, jurisdictions are also strengthening the governance structures responsible for coordinating cybersecurity, improving their ability to respond to large-scale incidents affecting public systems. Legislation enacted recently in Texas and California aim to improve coordination among state government by establishing a state agency centralizing cybersecurity incident prevention and response (Texas HB 150) and mandating the development of a cybersecurity playbook to strengthen information sharing (California AB 979). A 2024 bill enacted in Puerto Rico (PC 1530) requires commonwealth agencies to develop and implement a cybersecurity program, which must include a yearly risk assessment as well as vulnerability assessment. At least three jurisdictions are currently considering bills strengthening established cybersecurity programs, with two states recently passing legislation. Utah recently enacted a bill authorizing the Utah Cyber Center to conduct voluntary cybersecurity risk assessments for critical infrastructure and coordinate with government entities on infrastructure safety (HB 165). Utah also enacted legislation creating a specific funding stream for the Center to use for various activities, including implementing a statewide cybersecurity plan and conducting assessments for governmental entities (SB 123). Kansas enacted HB 2574, which would require chief information security officers for the executive, legislative, and judicial branches to adopt cybersecurity programs based on a nationally recognized standard for governmental entities. Finally, Florida recently passed SB 7024, which would expand the state’s public record exemption to include risk assessments, information related to cybersecurity breaches, and information related to data protection, ensuring the confidentiality of sensitive cybersecurity information held by state agencies; the bill is with the governor for final consideration. Key Takeaways for Preparedness Leaders Cybersecurity is critical for preparedness across multiple policy areas, and requires new planning, coordination, and oversight responsibilities. By including cyber incidents into disaster frameworks, standards for health care organizations, and governance, preparedness leaders may find themselves more directly engaged in integrating cybersecurity into emergency operations, exercises, and cross-sector partnerships. For state and territorial health agencies beginning to incorporate cybersecurity into their preparedness plans, agencies such as the Cybersecurity and Infrastructure Security Agency provide jurisdictional support and resources to guide this work. article yes

The 2020 holiday season is coinciding with a nationwide surge of COVID-19 cases. With great concern that holiday travel to see loved ones may exacerbate community spread of the virus, many states are increasing public health measures before the winter holiday season. As of November 16, 2020, 13 states and D.C. had a quarantine requirement for out-of-state travelers. The U.S. territories also have instituted travel restrictions to limit the spread of COVID-19.

ASTHO Legislative Prospectus | Previewing 2025 state legislative actions on maternal and child health.

Policy Trends Shaping Access to Care in 2026 Policy Trends Shaping Access to Care in 2026 Learn about policy trends shaping access to care in 2026, including supporting community health workers and improving rural health care. Public health agencies have a role in supporting access to care, which means assuring timely access to covered health care services provided by a qualified workforce. However, many communities experience challenges in accessing health care services, providers, facilities, or affordable care. Gaps in access to services that prevent chronic disease, address maternal health and behavioral health challenges, and other health goals undermine public health’s ability to improve community health. Strategies to improve access to care can include focused attention on underserved or at-risk communities or populations, including rural populations. To support access to comprehensive health care services, state legislatures continue to explore laws that strengthen clinical and community-based health workforces, support rural health care facilities, and promote access to care across the lifespan, including for women. Access to Supportive and Community-Based Health Services Community health workers (CHWs) are frontline public health workers who serve as a link between health and social services and the community, and can help address the social and behavioral health drivers of health outcomes. Many jurisdictions pursued policies to support CHWs by defining the workforce, establishing training or certification programs, and pursuing financial sustainability including through Medicaid programs. In 2025, more than a dozen states considered legislation related to CHWs, with several states enacting laws that recognize CHWs as providers and/or authorize Medicaid coverage and reimbursement. This includes Arkansas HB 1258, which establishes a state certification for CHWs, defines their role, and requires compensation for certified CHW services from both Medicaid and certain regulated health plans in the state. Montana (HB 850) and Oklahoma (SB 424) enacted bills to regulate CHWs but both bills were vetoed by their respective governors. In Oklahoma, the legislature overrode the veto. Rhode Island (S 0705) considered legislation that would require regulated health plans to cover CHW services, and Virginia enacted SB 981 which requires the health department to report on the status of the CHW workforce and future needs. Doulas are non-medical professionals who support individuals during pregnancy, birth, and the postpartum period. Doula care has been shown to reduce the rate of both cesarean sections and postpartum anxiety or depression, and may be cost effective, particularly for Medicaid programs. A majority of states are either pursuing or already offering doula coverage in their Medicaid programs. At least fourteen jurisdictions considered legislation in 2025 to recognize or provide coverage of doula services by Medicaid programs or private insurance. At least six states enacted laws regarding Medicaid coverage of doulas, including Louisiana (HB 454), Montana (SB 319), Utah (SB 284), and Vermont (S 53). In Maine, LD 1523 directs the health department to begin the rate development process for future coverage of doula services, establish a doula council to support that process and provide other advice to the department, and issue a report on the overall progress by February 2027. Arkansas (HB 1252) established a scope of practice for certified community-based doulas and requires compensation by both the Medicaid program and other health benefit plans in the state. Stabilizing and Growing Rural Health Care Access Rural communities face a number of health care challenges, including limited health care providers and financial strain on hospitals and other rural health care facilities. Several states explored strategic initiatives to support rural health care access, both broadly and for specific populations. California enacted SB 338 which establishes a virtual health hub to expand access to health services for farmworkers in rural communities. Iowa enacted HF 972, directing the health department to seek CMS approval for a hub-and-spoke model to support the state’s rural health providers. Finally, Texas enacted HB 18 which creates a rural hospital officers academy to support the education and development of these leaders, includes additional financial support for rural hospitals with obstetrics and gynecology services, and codifies current state programs and offices supporting rural hospitals. More than a third of U.S. counties are considered maternal care deserts, which are places where there are no obstetric providers or facilities. Several states enacted legislation to expand access to pregnancy and maternal health care in rural and underserved areas, including California which enacted SB 669 to create a pilot program for five rural hospitals to provide perinatal services on a standby basis. Arizona (HB 2332) will establish an advisory committee to make recommendations that will ensure the availability of “obstetrics, gynecology and maternal mental health services in low-volume, high-risk rural communities.” And in Connecticut, the governor signed several bills aimed at increasing access to maternal health care, including HB 7102 which requires the development of a strategic plan to increase the number of obstetric facilities in underserved areas of the state. Leg Prospectus-2026 - Access - Rural Health Expanding Support for Mid-Life Women's Health Care Women may experience a number of disruptive symptoms during perimenopause — the transition period before menopause — including difficulty sleeping, memory lapses, hot flashes, and general pain and discomfort. Following menopause, low hormone levels can increase the risk of chronic diseases like osteoporosis, heart disease, and stroke. Lack of knowledge about menopause and its wide range of symptoms, along with stigma, can prevent women from seeking treatment or other supports. Recognizing a growing need to address women's health across the entire lifespan, not just the reproductive years, state legislatures are exploring laws that address the menopause transition and its impacts through education and tailored health care access. In 2025, several jurisdictions — including Texas (HB 3961), Arizona (HB 2734), and Connecticut (AB 6593) — considered legislation directing the development, coordination, or distribution of educational programs and resources on menopause or perimenopause for women or providers, with Maine (LD 1079) enacting a measure requiring the health department to work to create and disseminate informational materials on perimenopause and menopause. Several other states have explored insurance coverage requirements, including New Jersey (A 5278/S 4148) and New York (A 5444) that would require certain health insurers and plans to cover menopausal and perimenopausal care and treatment. California (AB 432) would have required prescription coverage of drugs relevant to perimenopause and menopause care and treatment, and incentivize menopause-specific education for physicians, but the governor vetoed the bill and called for the state health and human services agency to propose policy changes for next year’s budget that address concerns about cost. Looking Ahead ASTHO expects states and territories to continue considering policies related to access to care, including legislation that: Increases coverage of and access to community-based health professionals like doulas, CHWs, and peer support specialists. Improves access to over-the-counter contraception. Recognizes telehealth's role in the health care system to ensure continued access to remote health care, particularly in rural communities. Supports access to reproductive care and women’s health services across the lifespan, including additional funding or other flexibilities to address anticipated changes in the federal funding landscape (e.g., Title X). OE22-2203 PHIG article yes

States Stay Prepared by Supporting the Public Health Workforce Margaret Nilz, Christina Severin Learn how states use policy to support emergency preparedness and bolster the public health workforce. Public health — particularly public health preparedness — continues to experience workforce shortages, driven by longstanding systemic challenges such as chronic underfunding, high turnover, limited recruitment, and an aging workforce. While some jurisdictions report increased capacity to hire and train public health staff in recent years, they often rely on short-term or temporary funding streams, which limit long-term sustainability. State, local, tribal, and territorial health agencies have varying capacities to respond to public health emergencies, particularly in rural and underserved communities. Because a limited workforce can inhibit emergency preparedness efforts, jurisdictions recognize the importance of cultivating a resilient public health preparedness workforce to respond to future emergencies. In recent years, jurisdictions have pursued several policy interventions to bolster the public health preparedness workforce such as legislation supporting front-line clinical staff and first responders, and rulemaking and other executive powers to provide structural and financial support to critical personnel. Legislative Efforts Legislative efforts to increase benefits and support for health care and public health workers can help address the root causes of workforce challenges and lay the groundwork for sustainable, long-term investment in public health preparedness. Laws that establish standards and expectations for the preparedness workforce, including expansions of benefits or additional training, support workforce growth and retention. Since 2024, several jurisdictions expanded mental health benefits and related support for first responders and other preparedness personnel. Both Alaska (SB 103) and California (AB 2859) enacted legislation that allows peer support programs for emergency service personnel. In Alaska, the bill creates programs for entities such as law enforcement agencies, firefighters, and emergency dispatchers, while California’s bill creates programs to serve a variety of health care providers involved in emergency medical care, including physicians, nurses, paramedics, and emergency medical technicians (EMTs). Utah enacted HB 378, which requires the Department of Public Safety to annually distribute information about its critical incident stress management program to first responder agencies. The bill also requires first responder agencies to annually notify employees about the availability of mental health resources, including periodic screenings for employees and continued support for retired or separated first responders and their spouses. On a broader scale, Hawaii SB 3279 recently established a well-being project tasked with mental health trainings and support for several community organizations, including first responders, hospitals, and medical staff. In Washington, HB 2311 directs the state’s Criminal Justice Training Commission to develop resources for first responder wellness, including a peer support network for active and retired first responders and their families. States have also enacted legislation expanding traditional employment-related benefits, including Colorado (HB 24-1219), which expanded certain health benefits for firefighters to include part-time and volunteer firefighters, and Idaho HB 55, which allows retired public employees to volunteer with public employers without it being considered reemployment. In addition, Georgia HB 451 requires state and local entities to provide disability benefits for first responders who experience occupational or volunteer-related post-traumatic stress disorder. Finally, several jurisdictions enacted legislation to support education and training for their public health and health care workforce. For example, Kentucky HB 484 established an emergency medical service education grant program that provides tuition support for students pursuing paramedic certification, wage reimbursement to ambulance providers whose employees pursue certification, and funding for institutions planning to offer EMT, advanced EMT, and paramedic programs. Oklahoma HB 1696 expands eligibility for the Oklahoma Medical Loan Repayment program to include certified nurse practitioners. Two new laws in Puerto Rico require police officers with the Puerto Rico Police Bureau to be certified in first aid or immediate rescue (PC 0859) and adds seminars on sign language, suicide prevention, and conflict mediation to the Bureau’s continuing education training (PC 0543). Other Policy Levers: Beyond the Legislature Jurisdictions can also use non-legislative policy tools to enhance workforce capacity in public health preparedness. This includes rulemaking, where executive agencies use existing legal authority to adopt or amend regulations. Regulations have the force of law and can help support the public health workforce by establishing licensure standards, training requirements, and operational protocols. Wisconsin, following the enactment of AB 576 in 2024, is developing rules to establish a program for peer support and critical stress management teams in the state. And Utah recently adopted rules for its first responder mental health services grant, which helps these professionals pursue a degree or certification as a mental health provider. Government agencies can also leverage grants and contracts to fund and otherwise direct workforce development initiatives, support training programs, and expand capacity in targeted areas. Jurisdictions can strategically direct funds to address skill gaps and assist local, state, tribal, and territorial agencies build a more resilient workforce. One example of this is in Michigan, where in 2024 the state health agency issued a request for grant proposals to award up to $9 million in EMS workforce grants, building on similar awards to address EMS shortages in 2023. Executive orders are another policy option for jurisdictions to consider as they explore different pathways to workforce sustainability. Executive orders are issued by a jurisdiction’s chief executive (often the governor) and direct certain policy actions or activities. Generally, the power to issue an executive order comes from existing law or a jurisdiction’s constitution and, in most cases, does not require legislative approval or review. Several states have leveraged executive orders to advance the public health workforce and support preparedness activities more specifically. For example, Vermont and New Jersey have recently used executive orders to create or extend advisory councils on issues pertinent to public health preparedness. In 2024, Virginia’s governor issued an executive order formalizing the Office of First Responder Wellness, which provides training, counseling, and other resources to first responders in Virginia. In 2023, the governor of Maryland issued an executive order establishing a State of Preparedness directive if there is a risk of public emergency, and the actions state agencies must undertake to promote improved coordination and hazard planning. Key Takeaways Addressing public health emergency preparedness workforce challenges demands strategic, long-term policy solutions, but several implementation options are available. Health agencies can pursue a variety of policy interventions to support and prepare their public health workforce for future emergencies. ASTHO will continue to monitor this important issue and provide updates as appropriate. article yes