Health Infrastructure Security and Accountability Act of 2026
- Sponsor
- Sen. Warner, Mark R. [D-VA]
- Committees
- Finance Committee (primary)
- Last action
- Sep 17, 2026
Bottom line
This bill aims to fortify the cybersecurity posture of the U.S. healthcare system through new mandates, financial incentives, and penalties, while providing financial relief during cyber disruptions.
What it actually does
This bill significantly strengthens cybersecurity requirements for healthcare entities and business associates by mandating new minimum and enhanced security standards, annual risk management, reporting, and independent audits. It introduces increased civil and criminal penalties for non-compliance and establishes a user fee to fund federal oversight. Additionally, it creates a Medicare incentive program for hospitals to adopt cybersecurity practices and authorizes accelerated/advance Medicare payments to providers experiencing cash flow disruptions due to cybersecurity incidents.
Proponents argue
Supporters argue that the bill is a critical step to protect patient data, ensure continuity of care, and safeguard national security by strengthening the resilience of the healthcare infrastructure against increasingly sophisticated cyber threats. They contend that current standards are insufficient and that financial incentives and penalties are necessary to drive compliance and investment in security.
Opponents contend
Critics may argue that the new mandates, particularly for smaller entities, could impose significant financial and administrative burdens, potentially leading to reduced services or increased costs for patients. They might also raise concerns about the scope of the Secretary's authority in determining "systemic importance" or "national security" relevance for enhanced requirements.
The bill is moderately complex, requiring a dedicated reading to understand its full implications, especially the detailed amendments to existing law.
Sec. 101, Title I
Minimum and Enhanced Health Information Security Requirements
This section mandates the Secretary of Health and Human Services (HHS) to adopt new minimum security requirements for all covered entities and business associates, and enhanced security requirements for those deemed of "systemic importance" or "important to national security." These requirements aim to prevent cyber incidents, protect patient safety, and ensure system availability. The Secretary must review and update these requirements every two years and promulgate regulations within 18 months of enactment, with an effective date two years after enactment.
Supporters argue
Supporters argue these new, tiered security requirements are essential to address the evolving threat landscape and protect the healthcare sector, which is a critical infrastructure. They contend that the distinction between minimum and enhanced requirements appropriately targets resources based on risk.
Critics contend
Critics might argue that the broad scope and potential for "enhanced" requirements based on subjective criteria like "systemic importance" could lead to excessive compliance costs, particularly for smaller healthcare providers or specialized business associates, potentially stifling innovation or access to care.
Tradeoffs
Balancing comprehensive security against the administrative and financial burden on healthcare providers and their partners.
Sec. 102, Title I
Annual Security Risk Management, Reporting, and Independent Audits
This section requires covered entities and business associates to annually conduct security risk analyses, document rapid resolution plans for cyber incidents, perform stress tests to evaluate recovery capabilities, and provide a compliance statement signed by their CEO and CISO. Entities subject to enhanced security requirements must report this documentation annually to the Secretary. Additionally, all covered entities and business associates must contract with independent auditors annually to assess compliance with cybersecurity performance goals or the new security requirements, and certify resolution of non-compliance. The Secretary will also conduct annual audits of at least 20 entities, with potential civil money penalties for non-compliance.
Sec. 103, Title I
Enhanced Civil and New Criminal Penalties for Security Violations
This section significantly increases civil monetary penalties for violations of health information security standards, particularly after the new requirements under Sec. 101 take effect. For example, minimum penalties are raised from $500 to $5,000 for certain violations, and maximum penalties for willful neglect can reach $250,000. It also introduces new civil penalties of up to $5,000 per day for failure to submit required documentation, comply with audits, or meet responsibilities. Furthermore, it establishes criminal penalties (felony, up to $1,000,000 fine, or 10 years imprisonment) for knowingly submitting false information or willfully failing to submit required documentation. Collected civil penalties will be transferred to the HHS Office for Civil Rights, with a methodology to distribute a percentage to harmed individuals.
Sec. 104, Title I
Annual User Fee for Data Security Oversight
This section authorizes the Secretary of HHS to charge an annual user fee to each covered entity and business associate. The fee amount will be a pro rata share of the entity's revenue compared to national health expenditures, up to a cap. The collected fees, capped at $40 million in FY2028, $50 million in FY2029, and increasing with inflation thereafter, will be available without further appropriation to fund the Secretary's oversight and enforcement activities under this subsection.
Sec. 201, Title II
Medicare Incentives and Penalties for Cybersecurity Adoption
This section establishes a Medicare program providing incentive payments to eligible hospitals and critical access hospitals for adopting essential and enhanced cybersecurity practices. $800 million is allocated for FY2029-2030 for essential practices, and $500 million for FY2031-2032 for enhanced practices. Conversely, beginning in FY2031, hospitals failing to adopt essential practices will face reductions in their annual percentage increase and base operating DRG payment amounts. From FY2033 onwards, failure to adopt enhanced practices will result in even steeper reductions. The Secretary will define these practices through rulemaking and may grant hardship exceptions.
Sec. 202, Title II
Medicare Accelerated/Advance Payments for Cyber Incident Disruptions
This section amends Medicare Part A and Part B to allow the Secretary of HHS to make accelerated or advance payments to eligible providers and suppliers experiencing significant cash flow problems due to "significant disruption to Medicare claims processing due to a cybersecurity incident." This provides a mechanism for financial relief to healthcare entities during severe cyberattacks that impact their ability to bill and receive payments.
Limits administrative or judicial review of the methodology the Secretary uses to determine whether a covered entity or business associate is subject to enhanced security requirements.
Sec. 101(a)(5)(B)(ii)(II)
Why it matters:This is a common legislative practice to limit judicial review of administrative decisions, often to prevent delays or challenges to agency expertise. However, it can also limit accountability.
Case for: Proponents would argue this ensures the Secretary can swiftly implement and adapt security requirements without being bogged down by litigation over methodology, which is critical for national security and patient safety.
Case against: Opponents might contend that removing administrative and judicial review limits due process for entities potentially subjected to more stringent and costly "enhanced" requirements, raising concerns about arbitrary or unfair designations.
Estimated impact: Could significantly impact the ability of designated entities to challenge their classification, potentially leading to higher compliance costs without recourse.
Grants the Secretary waiver authority for certain risk management, reporting, and stress test requirements if the burden on an entity significantly outweighs the benefits, considering factors like revenue and volume of protected health information.
Sec. 102(a)(3)(C)
Why it matters:This is a common legislative mechanism to provide flexibility for administrative agencies to tailor regulations, but it could also be seen as a way to mitigate potential opposition from smaller entities by offering a potential escape clause.
Case for: Proponents would argue this flexibility is crucial to avoid disproportionately burdening small or rural healthcare providers, ensuring the requirements are practical and do not inadvertently harm access to care.
Case against: Critics might argue that broad waiver authority could undermine the overall effectiveness of the security mandates if too many entities are exempted, creating loopholes that compromise the collective security posture of the healthcare system.
Estimated impact: Could significantly reduce the compliance burden for a subset of covered entities and business associates, but also potentially reduce the overall security coverage.
Mandates the Secretary to establish a methodology to distribute a percentage of collected civil monetary penalties or settlements for security violations to individuals harmed by such violations.
Sec. 103(a)(2)(B)
Why it matters:While a significant policy, the focus of the section is on the penalties themselves. This detail might be overlooked as a secondary application of funds.
Case for: Proponents would argue this provides a direct form of restitution to victims of data breaches, enhancing accountability and offering a tangible benefit to those most affected by security failures.
Case against: Critics might argue that determining harm and distributing funds could be administratively complex and potentially lead to disputes, diverting resources from direct enforcement activities.
Estimated impact: Could provide financial relief to individuals affected by data breaches, potentially increasing the incentive for individuals to report violations.