Welcome to the Committee on Energy and Commerce.

The Energy and Commerce Committee is at the forefront of all issues and policies powering America’s economy, including our global competitive edge in energy, technology, and health care.


The Latest

From the Committee

Apr 16, 2024
Health
Chair Rodgers Opening Remarks on Health Care Cybersecurity

Washington D.C. — House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) delivered the following opening remarks at today’s Health Subcommittee hearing titled "Examining Health Sector Cybersecurity In The Wake Of The Change Healthcare Attack."

 4.16.24 CMR Health Cyber Opener.png

“Thank you to everyone for being here today as we discuss cybersecurity in health care and the recent Change Healthcare cyberattack.  

“While I am disappointed that UnitedHealth Group chose not to make anyone available to testify today, so the Committee and the American people could hear directly from them about how that specific cyberattack occurred, I will note UnitedHealth briefed E&C members recently on the matter and have committed to testifying at a future hearing. 

“Health care cybersecurity was already a concern before the Change attack, and I look forward to today’s discussion about what the federal government, doctors, hospitals, and others have done right and where there is opportunity to improve the resiliency of the health care sector.” 

CHANGE CYBERATTACK 

“The Change Healthcare cyberattack is just the most recent case of ransomware targeting our health care system, and, due to Change’s integration with so many of the health care providers and payers, it is still impacting providers and health care organizations across the country.  

“I have heard concerns from providers, rural hospitals, and many others, all worried about what this cyberattack means for them.  

“And just this morning, the Change Health hackers were posting stolen data from the ransomware attack. 

“There are still many unanswered questions and lessons to be learned from this attack.  

“How did this attack gain entry to the Change system?  

“How can hospitals, doctors, and others best protect themselves?  

“What other third parties do our nation’s health care providers rely upon that, if taken offline, could have a similarly negative impact on the U.S. health care system?” 

HEALTH SYSTEM CONTEXT FOR CHANGE 

“Health care infrastructure is crucial for patients receiving the care they need, and, sadly, this will likely not be the last breach or ransomware attack that will happen.  

“Patient data is valuable, and it is housed online.  

“That is why we must continue to examine health care cybersecurity and make sure that patient data remains protected.  

“HHS has overall responsibility for ensuring cybersecurity within health care across the U.S. federal government, and the Administration for Strategic Preparedness and Response, or ASPR, has been designated as the ‘one-stop shop’ responsible for leading and coordinating the cybersecurity efforts—both within HHS and with external partners. 

“However, there seems to be multiple offices and agencies that have some role in our cyber response. 

“The Office of Civil Rights, the HHS Chief Information Officer, the Office of the National Coordinator, and, in this most recent response, CMS, all played a role. 

“As our health care system becomes more consolidated, the impacts of cyberattacks—if successful—may be more widespread, pulling in even more agencies and offices within HHS.” 

E&C CYBER WORK 

“This Committee has led at examining cybersecurity across all sectors.  

“In 2019, Congress made explicit that part of the responsibilities of ASPR is preparedness and response to cyber threats.  

“In 2020, a bill led by Dr. Burgess, which passed through this Committee, encouraged health care organizations to adopt strong cybersecurity best-practices.  

“Last Congress, this committee worked to give FDA more authority over cyber security of medical devices. 

“And more recently, in the reauthorization of the Pandemic and All-Hazards Preparedness Act reported by this committee, we made it explicit that cybersecurity should be considered and prioritized as part of ASPR’s National Health Security Strategy, and the Energy and Commerce Committee will continue leading the way in examining this issue.  

“I hope we can use this hearing today to learn more about the Change Healthcare cyberattack and the response.  

“Is this a unique situation?  

“What do providers and patients need to know and look out for?  

“I don’t want this committee to be back here in five or 10 years, after more patients’ health care is disrupted by known criminal actors finding vulnerabilities in the cyber security of our health system. 

“To prevent that, I look forward to hearing from our witnesses about:  

“What can health care learn from other sectors?  

“Are there more federal authorities HHS needs?  

“What is the best balance to get better adoption of existing cybersecurity practices? 

“I look forward to the discussion today and yield back.”


More News & Announcements


Apr 16, 2024

Witness Spotlight: Ava Smithing

Tune in to the Innovation, Data, and Commerce Subcommittee Legislative Hearing on Proposals to Protect People Online Meet Ava Smithing.   A Nashville, Tennessee-native, she grew up playing volleyball, including at the Stevens Institute of Technology where she earned her Bachelor’s in Business Administration in 2023.  She’s now among those leading the charge to ensure that Americans—especially young people—can use social media platforms without being targeted or manipulated.   In her role as Director of Advocacy at the Young People’s Alliance, Ava is stepping up to confront a challenge that she and so many other young people face today: social media companies exploiting Americans’ mental health.  Big Tech platforms collected and then weaponized Ava’s data—like her age, location, and gender—against her. According to Ava, “they used my data to infer what other types of ads and content I might ‘like,’ leading me down a pipeline from bikini ads, to exercise videos, to dieting tips, and finally to eating disorder content.”  By monitoring her post engagements and what she spent time viewing, social media companies could track Ava’s vulnerabilities. These platforms were able to drive her into a downward spiral that resulted in a threat to her well-being. In her case, watching one video for just a little too long encouraged the algorithm to funnel harmful content into Ava’s feed.  Ava says, “How was I—a 14-year-old child—supposed to understand that social media platforms would use my age, location, and gender to target me with advertisements designed to instill insecurity in me?”  Today, Ava is flipping the script. As an advocate, she is leading to promote kids’ safety online through a national data privacy standard so people can control their data and be protected from manipulative algorithms.  Last week, House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) and Senate Commerce Committee Chair Maria Cantwell (D-WA) announced a comprehensive data privacy bill, the American Privacy Rights Act.    Support for establishing privacy rights has more momentum than ever, in no small part because people like Ava are speaking up about the consequences of companies’ unchecked power.  Among its protections, the American Privacy Rights Act will establish the ability for users opt-out of targeted advertising. Ava said that if such an option existed when she first joined social media, she may never have been put in harm’s way.  The bill also requires companies to review their algorithms to ensure they do not endanger children through malicious content suggestions. This will stop the downward spiral that exploits so many children online.  The Energy and Commerce Committee is holding a legislative hearing at 10:00 AM today to consider proposals to protect kids online and advance strong comprehensive data privacy protections. Ava Smithing will highlight why these proposals are critical for Americans who want to use the internet without being targeted and manipulated by the sites they visit. Be sure to tune in! 



Apr 16, 2024
Hearings

Chair Rodgers and Ranking Member Pallone Announce Plans for Bipartisan Legislative Hearing on AM Radio

Washington, D.C. — House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) and Ranking Member Frank Pallone, Jr., (D-NJ) today announced plans to hold a legislative hearing on April 30 titled “Draft Legislation to Preserve Americans’ Access to AM Radio.”  “Communities across the country, especially rural communities, rely on AM radio service for critical information. It plays an essential role during public emergencies when other alert systems that rely on the electric grid and cellphone networks don’t work, which is why it's so alarming that some auto manufacturers are considering not installing AM radios in new cars," said Chair Rodgers and Ranking Member Pallone. "We look forward to working together to preserve Americans’ access to this vital source of information.”  Subcommittee on Innovation, Data, and Commerce legislative hearing titled “Draft Legislation to Preserve Americans’ Access to AM Radio.”   WHAT: Subcommittee on Innovation, Data, and Commerce legislative hearing on draft legislation to preserve Americans' access to AM radio in new cars.  DATE: Tuesday, April 30, 2024  Legislative proposals to be considered include:   H.R. __ , the AM Radio for Every Vehicle Act of 2024  This notice is at the direction of the Chair. The hearing will be open to the public and press and will be live streamed online at https://energycommerce.house.gov/ . If you have any questions concerning the hearing, please contact Jessica Herron at Jessica.Herron@mail.house.gov . If you have any press-related questions, please contact Sean Kelly at Sean.Kelly@mail.house.gov .  



Apr 16, 2024
Health

Subcommittee Chair Guthrie Opening Remarks on Health Care Cyber Security

Washington D.C. — House Energy and Commerce Health Subcommittee Chair Brett Guthrie (R-KY) delivered the following opening remarks at today’s subcommittee hearing titled "Examining Health Sector Cybersecurity in the Wake of the Change Healthcare Attack." “Today we will hear from industry experts and health care providers, large and small, about our health care cybersecurity. This is especially important considering recent events.”  CHANGE HEALTHCARE RANSOMWARE ATACK CAUSED SIGNIFICANT DISRUPTION FOR PATIENTS AND PROVIDERS   “On February 21, our health care system experienced one of the largest cyberattacks known to date.    “Change Healthcare, a subsidiary of UnitedHealth, experienced a ransomware attack that resulted in substantial disruption to the health care industry.   “UnitedHealth Group took three key systems offline, impacting claims processing, payment and billing, and eligibility verifications.   “The disruption that ensued caused patients to go without access to medications or experiencing higher than expected out of pocket costs for these daily medications.   “Providers—large and small—went unpaid, and in some cases still haven’t been made whole—and patients experienced delays accessing care they otherwise would be eligible to receive.    “To put this in greater context, Change Healthcare alone processed 15 billion health care claims annually, that are linked to providers and hospitals across the country.   “My office and I have personally heard from constituents impacted. In one such instance, an independent provider in my hometown of Bowling Green is still grappling with the fallout from the attack.   “His practice is losing staff because they can’t make payroll while systems are still getting back online. I am concerned that we still don’t know how much sensitive information may have been compromised.  “I am committed to continuing our work alongside the Department of Health and Human Services and our private sector partners, including United Health, to assess the damage caused by the ransomware attack.”   CYBER ATTACKS HAVE BEEN ON THE RISE IN RECENT YEARS   “I am equally committed to working to ensure health care providers are doing all they can to stop these ransomware attacks in their tracks.   “These attacks are nothing new to the health care system. According to HHS data, large data breaches increased by more than 93 percent between 2018-2022, with a 278 percent increase in large breaches reported to HHS’ Office of Civil Rights involving ransomware from 2018 to 2022.   “One of the primary drivers of the alarming increase in ransomware attacks is the payout the perpetrators demand in exchange for retrieving the stolen information, which in the case of the Change attack, allegedly resulted in a $22 million pay day for the sophisticated dark web group AlphV.   “The average health care data breach now costs an average of $10 million, which has increased by 53 percent in the past three years according to a 2023 report by IBM.   “The federal government’s response to protect against cyberthreats targeting our health care system has been lagging relative to the serious threat posed by such threats, especially by adversarial nations.   “A July 2022 alert issued by key national security agencies underscored this reality, uncovering that a North Korean state-sponsored ransomware attack targeted assets responsible for housing electronic health records, diagnostic services, and imaging services.   “Another attack against an Ohio-based health system led to the cancelation of surgeries and diverted care for patients seeking emergency services.”  THE FEDERAL GOVERNMENT MUST BE PROACTIVE AND PARTNER WITH INDUSTRY STAKEHOLDERS TO PREVENT FUTURE ATTACKS   “The Biden administration published a National Strategy document last year outlining steps the federal government will take to bolster our cyber readiness.   “That culminated in HHS issuing a four-step plan to strengthen our health care cyber defenses in December of last year, including establishing voluntary sector cybersecurity performance goals, providing resources to incentivize and implement best practices, and increasing enforcement and accountability efforts within the agency.   “I think we need to be very deliberate when thinking through the balance of incentives and penalties and accountability.    “To be clear, I appreciate the administration’s continued work in this critical space.   “However, I can’t help but wonder if we could have avoided the most recent event if these steps were taken much sooner.     “While I don’t ever believe it is ever too little, too late, we have our work cut out for us to ensure our health care system is a global leader in cybersecurity and patient safety and Americans’ privacy remains front and center.”


Trending Subcommittees

Innovation, Data, and Commerce


9 Updates

Interstate and foreign commerce, including all trade matters within the jurisdiction of the full committee; consumer protection, including privacy matters generally; data security; motor vehicle safety; regulation of commercial practices (the Federal Trade Commission), including sports-related matters; consumer product safety (the Consumer Product Safety Commission); product liability; and regulation of travel, tourism, and time. The Subcommittee’s jurisdiction can be directly traced to Congress’ constitutional authority “to regulate Commerce with foreign nations, and among the several States, and with the Indian Tribes.”


Communications & Technology


8 Updates

Electronic communications, both Interstate and foreign, including voice, video, audio and data, whether transmitted by wire or wirelessly, and whether transmitted by telecommunications, commercial or private mobile service, broadcast, cable, satellite, microwave, or other mode; technology generally; emergency and public safety communications; cybersecurity, privacy, and data security; the Federal Communications Commission, the National Telecommunications and Information Administration, the Office of Emergency Communications in the Department of Homeland Security; and all aspects of the above-referenced jurisdiction related to the Department of Homeland Security.


Energy, Climate, & Grid Security


18 Updates

National Energy Policy, energy infrastructure and security, energy related Agencies and Commissions, all laws, programs, and government activities affecting energy matters. National Energy Policy focuses on fossil energy; renewable energy; nuclear energy; energy conservation, utility issues, including but not limited to interstate energy compacts; energy generation, marketing, reliability, transmission, siting, exploration, production, efficiency, cybersecurity, and ratemaking for all generated power. Energy infrastructure and security focuses on pipelines, the strategic petroleum reserve, nuclear facilities, and cybersecurity for our nation’s grid. Our jurisdiction also includes all aspects of the above-referenced jurisdiction related to the Department of Homeland Security. Agencies and Commissions in our jurisdiction include: The US Department of Energy, the Nuclear Regulatory Commission; and the Federal Energy Regulatory Commission.


Recent Letters


Apr 15, 2024
Press Release

Bipartisan E&C Committee Leaders Seek Answers from UnitedHealth Group on Change Healthcare Cyberattack

Washington D.C. — House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) and Ranking Member Frank Pallone, Jr., (D-NJ), Subcommittee on Health Chair Brett Guthrie (R-KY) and Ranking Member Anna G. Eshoo (D-CA), and Subcommittee on Oversight and Investigations Chair Morgan Griffith (R-VA) and Ranking Member Kathy Castor (D-FL) wrote to UnitedHealth Group, Inc., CEO Andrew Witty today seeking information about the cyberattack on Change Healthcare. Change Healthcare, which was acquired by UnitedHealth Group’s Optum subsidiary in 2022, is one of the nation’s largest providers of health care payment management systems. On February 21, UnitedHealth Group reported it had experienced a cyberattack on its platforms, and it had taken all Change Healthcare systems offline to contain the incident. As a result of the outage, critical services affecting patient care—including billing services, claims transmittals, and eligibility verifications—became inoperable. Though UnitedHealth first notified users that it expected the disruption to “last at least through the day,” several of the company’s products have now been inoperable for more than a month. “Change Healthcare is a central player in the country’s health care system, which has been upended by the recent breach,” t he bipartisan Committee leaders wrote to Mr. Witty. “We are interested in your efforts to secure Change Healthcare’s systems since it was acquired by your company and the efforts you are taking to restore system functionality and support patients and providers affected by the attack.” Change Healthcare’s platforms touch an estimated one in three U.S. patient records. Its systems process roughly 15 billion transactions annually, and are linked to approximately 900,000 physicians, 118,000 dentists, 33,000 pharmacies, and 5,500 hospitals nationwide. The breadth of Change Healthcare’s infrastructure all but ensures that the scope of the current disruption, and any disruption in Change Healthcare services, will be extensive. “The health care system is rapidly consolidating at virtually every level, creating fewer redundancies and more vulnerability to the entire system if an entity with significant market share at any level of the system is compromised,” the Committee leaders wrote. “In order to understand better the steps UnitedHealth has taken to address this situation, we request information about the impact of the cyberattack, the actions the company is taking to secure its systems, and the outreach to the health care community in the aftermath.” As a result of the system outage, providers reportedly struggled to make payroll while some patients have been forced to pay out of pocket for crucial medications including cancer therapy drugs and insulin because pharmacies are unable to verify coverage. The Committee leaders requested answers to a series of detailed questions by April 29, 2024. CLICK HERE to read the full letter. 



Apr 9, 2024
Press Release

Rodgers, Capito, and Wicker Lead Amicus Brief Challenging EPA’s Overreaching So-Called ‘Good Neighbor’ Rule

Washington, D.C. — House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA), Senate Environment and Public Works Committee Ranking Member Shelley Moore Capito (R-WV), and Senator Roger Wicker (R-MS) led 26 of their colleagues in filing a bicameral amicus curiae brief in the U.S. Court of Appeals, D.C. Circuit in support of state and industry challengers to the Environmental Protection Agency’s (EPA) so-called “Good Neighbor” air rule that targets American power production and burdens states with misguided air regulations. “Acting well beyond its delegated powers under the [Clean Air Act], EPA’s Rule proposes to remake the energy sector in the affected states toward the Agency’s preferred ends. The Rule is part of the broader joint EPA-White House Strategy that oversteps the Agency’s authority by concurrently developing regulations under three separate environmental statutes. It does so not to meet any of the statutes’ individual ends but to transform the power sector. "The group of regulations—including the Rule—are designed to hurriedly rid the U.S. power sector of fossil fuels by sharply increasing the operating costs for fossil fuel-fired power plant operators, forcing the plants’ premature retirement,” the brief reads in part. BACKGROUND: The so-called “Good Neighbor” rule imposes overreaching emissions requirements on power plants, natural gas pipeline assets, and industrial plants, like steel, cement, and paper production facilities in 23 states. Other federal courts have already frozen implementation of the rule in 12 states. Despite active Supreme Court proceedings that may halt implementation of the rule nationwide, the EPA has remained committed to the illegal rule and recently proposed to add five more states to the program.  In June 2023 , Capito joined Wicker in introducing a formal challenge to the rule through a Congressional Review Act (CRA) joint resolution of disapproval.  In June 2023, Rep. Michael Burgess (R-TX) also introduced H.J.Res. 69, a formal challenge to the rule through a Congressional Review Act (CRA) joint resolution of disapproval.  In June 2022 , Ranking Member Capito sent a letter to EPA Administrator Michael Regan outlining serious concerns with the proposed “Good Neighbor Plan.”  Ranking Member Capito has criticized the EPA’s proposed “Good Neighbor Plan” during EPW hearings in March 2023 , July 2022 , and May 2022 , and in an op-ed .  In November 2023 , Chairs Rodgers, Duncan, and Johnson sent a letter to the Federal Energy Regulatory Commission expressing concerns with the impact of EPA’s suite of rules, including the “Good Neighbor” Rule (or Interstate Transport Rule), on the reliability of the nation’s electric grid. In addition to Capito and Wicker, senators who signed on to brief include, John Barrasso, (R-WY), Marsha Blackburn (R-TN), John Boozman (R-AR), Mike Braun (R-IN), John Cornyn (R-TX), Ted Cruz (R-TX), Steve Daines (R-MT), Deb Fischer (R-NE), John Hoeven (R-ND), Ron Johnson (R-WI), Cynthia M. Lummis (R-WY), Markwayne Mullin (R-OK), Pete Ricketts (R-NE), Jim Risch (R-ID), Dan Sullivan (R-AK), and John Thune (R-SD). In addition to Rodgers, House members who signed on to the brief include, Rick Allen (R-GA), Kelly Armstrong (R-ND), Troy Balderson (R-OH), Gus Bilirakis (R-FL), Larry Bucshon (R-IN), Michael Burgess (R-TX), Kat Cammack (R-FL), Earl “Buddy” Carter (R-GA), Dan Crenshaw (R-TX), John Curtis (R-UT), Jeff Duncan (R-SC), Neal Dunn (R-FL), Russ Fulcher (R-ID), Morgan Griffith (R-VA), Brett Guthrie (R-KY), Diana Harshbarger (R-TN), Richard Hudson (R-NC), John James (R-MI), John Joyce (R-PA), Bob Latta (R-OH), Debbie Lesko (R-AZ), Mariannette Miller-Meeks (R-IA), Jay Obernolte (R-CA), Gary Palmer (R-AL), Greg Pence (R-IN), August Pfluger (R-TX), Tim Walberg (R-MI), and Randy Weber (R-TX).  Full text of the brief is available here .



Apr 5, 2024
Press Release

E&C Republicans Press EPA for Information on Clean School Bus Program that Picks Winners and Losers

Washington, D.C. — House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA), Subcommittee on Oversight and Investigations Chair Morgan Griffith (R-VA), and Subcommittee on Environment, Manufacturing, & Critical Materials Chair Buddy Carter (R-GA) wrote to Environmental Protection Agency (EPA) Administrator Michael Regan regarding the agency’s Clean School Bus Program. KEY EXCERPT:   “Alarming information about this program continues to emerge. In particular, the EPA’s Office of the Inspector General (OIG) has flagged serious shortcomings in the program that create significant vulnerabilities to waste, fraud, and abuse. The EPA’s own reporting on the program reveals that numerous award recipients encountered difficulty utilizing the funding they were awarded. Additionally, the EPA continues to administer the program in a manner that favors the use of electric school buses over other types of buses that are eligible for funding under the program.”  CHALLENGES TO IMPLEMENT:   Of almost 400 selectees under the 2022 Clean School Bus Rebate program 46 selectees withdrew from the program.  The most common reasons provided for withdrawal were school boards voting against the projects for reasons including difficulties coordinating with electric utilities, potentially lengthy and costly electric infrastructure upgrades required to install electric vehicle supply equipment, and hesitancy about maintenance and range issues associated with electric buses.  The OIG concluded in a December 2023 audit that “the agency may be unable to effectively manage and achieve the program mission unless local utility companies can meet increasing power and supply demands for electric buses.”  The OIG noted that establishing charging stations and connecting them to power lines could take approximately twelve to twenty-four months.   Stakeholders reported that infrastructure to support 25 buses or more demands a more complex electrical setup, which can take a year to construct.  POTENTIAL FOR WASTE, FRAUD, AND ABUSE:   In December 2023, the OIG issued a Management Implication Report that highlighted serious problems with the Clean School Bus Program.   The OIG “identified concerns regarding the EPA’s lack of robust verification mechanisms within the Clean School Bus rebate and grant application process, which led to third parties submitting applications on behalf of unwitting school districts, applicants not being forthright or transparent, entities self-certifying applications without having corroborating supporting documentation, and entities being awarded funds and violating program requirements.”  The OIG further stated, “Our initial investigation of its protocols found that the Clean School Bus Program is rife with potentially inaccurate information” and that “the EPA uses few mechanisms to verify the accuracy of application contents and relies on the applicant’s self-certification of all aspects of the application,” including the applicant’s eligibility for the program, satisfaction of vehicle-use requirements, and the identity of the school district the replacement buses funded by the program will serve.  The OIG also found that an administrative entity with zero students was selected to receive a rebate, despite it seeking funding for buses that were ineligible for the program.   Some recipients selected to receive rebates under the 2022 Clean School Bus Rebate program later declined the funding.   These withdrawals accounted for $38 million of awards, which the OIG stated lengthened program timetables and created confusion.  EPA PICKING WINNERS AND LOSERS:   The Infrastructure Investment and Jobs Act (IIJA) directed the EPA to award grants, rebates, and contracts to replace existing school buses with both zero-emission buses and clean school buses.  The IIJA defines clean school buses as school buses that reduce emissions and operate partly or entirely using an alternative fuel, or zero-emission buses.   The Committee has previously voiced concerns about the EPA's bias towards electric buses while ignoring the benefits of other clean school buses, concerns that persist today.   According to information provided by the agency, “As of January 2024, the EPA has awarded approximately $1.84 billion to fund 5,103 clean school buses—96 percent of which are electric—and related charging infrastructure at 642 school districts in most states and territories, and at schools operated by federally recognized Tribes.”   Under the 2023 Clean School Bus Rebates program, the EPA continues to offer maximum awards for fully electric school buses that are several times larger than the maximum award amount for other types of clean school buses.  Additionally, under the Clean School Bus program, the EPA continues to fund charging infrastructure for electric vehicles but not propane or compressed natural gas fueling infrastructure.  Under the 2022 Clean School Bus Rebate program, the maximum bus funding amount for a class 7+ zero-emission bus was $375,000, and the maximum amount for a propane class 7+ propane bus was $30,000.  The EPA reported, “The majority of awarded electric school buses cost at or near $375,000, while many awarded propane buses cost around $150,000.”  In other words, the maximum rebate amount seemingly covered the entire cost of an electric bus but covered only a fraction of a propane bus.  CLICK HERE to read the letter.