Full bill text rendering is coming soon.
In the meantime, read the full text on Congress.gov ↗.
Implementation & Enforcement Top 3
Higher civil penalties for health data security violations
Significantly increases minimum fines for breaking health data security laws, ranging from $500 to $250,000 depending on severity. Collected fines fund the HHS Office for Civil Rights (OCR), and a portion must be distributed to individuals harmed by violations. Requires all health care covered entities and business associates to meet baseline cybersecurity standards set by HHS, designed to protect patient data and national security. Also expands the legal duty to protect health data availability, not just confidentiality and integrity. Imposes stricter cybersecurity requirements on health care organizations deemed systemically important or critical to national security. Affected entities are notified but cannot challenge the designation methodology through administrative or court review. Requires health care covered entities and business associates to conduct yearly cybersecurity risk analyses, stress tests simulating disasters or attacks, and continuity planning — and to publish compliance results publicly on their websites. Smaller entities may receive waivers. Requires health care covered entities and business associates to hire independent auditors each year to assess their cybersecurity compliance and certify that any violations have been corrected. Smaller entities may receive waivers from this requirement.
- Population Scope High Applies mandatory cybersecurity standards, annual audits, stress tests, and compliance disclosures to all HIPAA covered entities and business associates — a broad class spanning virtually every hospital, clinic, insurer, and health care vendor in the country.
- Budgetary Magnitude Medium Raises minimum civil penalties to as high as $250,000 per violation and redirects collected proceeds to the Department of Health and Human Services (HHS) Office for Civil Rights (HHS Office for Civil Rights (OCR)), but total revenue depends on enforcement volume rather than a fixed appropriation.
- Legal / Regulatory Depth High Creates new substantive statutory mandates — minimum cybersecurity standards with two-tier enforcement, enforceable victim-distribution entitlements, mandatory independent audits, and public disclosure duties — fundamentally restructuring the legal obligations of the HIPAA-regulated population.
- Degree of Discretion Granted High Grants HHS Secretary broad rulemaking authority to set minimum and enhanced security standards, determine which entities qualify as high-risk, establish penalty methodologies, set audit standards, and issue waivers for smaller entities.
- Implementation & Enforcement Burden High Requires standing up new recurring compliance infrastructure across all covered entities — annual risk analyses, stress tests, independent audits, signed CEO/CISO attestations, and public disclosures — while increasing OCR's adjudicative workload through higher penalties and a new victim-distribution process.
- Temporal Commitment High Mandatory standards, audit requirements, and penalty regimes contain no sunset or reauthorization trigger, so they bind covered entities indefinitely unless Congress acts to repeal them.
No signal yet
Funding / Appropriations Top 3
Annual user fee on health care entities for cybersecurity enforcement
Creates a mandatory annual fee paid by all HIPAA covered entities and business associates to fund HHS oversight and enforcement of health data security. The fee is capped at $40 million in 2028 and $50 million in 2029, with inflation adjustments after that.
- Population Scope Medium Applies to all HIPAA covered entities and business associates — a broad sector of health care organizations — but does not directly reach individual patients or the general public, warranting M rather than H.
- Budgetary Magnitude High Establishes a mandatory, recurring, self-executing revenue stream capped at $40 million in FY2028 and $50 million in FY2029 with indefinite CPI-adjusted collections thereafter, available without further appropriation; the Medicare incentive component adds up to $1.3 billion across FY2029–2032 from the Federal Hospital Insurance Trust Fund.
- Legal / Regulatory Depth High Creates a new statutory fee obligation on a broad regulated class without appropriations action, and establishes a Medicare incentive-and-penalty program — both new substantive legal duties with binding financial consequences.
- Degree of Discretion Granted Medium Fee amounts are capped by statute and the pro-rata formula is prescribed, but the Secretary of Health and Human Services (HHS) retains authority to administer collection and set implementing details; Medicare incentive payment methodologies are similarly subject to rulemaking with review barred.
- Implementation & Enforcement Burden Medium Requires HHS to administer annual fee collection across the entire HIPAA-regulated population and Centers for Medicare & Medicaid Services (CMS) to run a new hospital attestation and payment-reduction program, but does not create criminal penalties or novel adjudicative infrastructure.
- Temporal Commitment High Both the user fee and the Medicare incentive/penalty program are permanent with no sunset — the fee recurs annually with CPI adjustment, and the payment-reduction regime continues indefinitely unless Congress repeals it.
No signal yet
Core Policy Mechanism Top 3
Medicare emergency payments for cybersecurity-disrupted providers
Expands Medicare's emergency payment programs to cover providers and suppliers whose cash flow is disrupted by cyberattacks. Hospitals, clinics, and other Medicare providers can receive advance funds quickly during a cybersecurity incident, with Trust Fund protections built in.
- Population Scope Low Directly affects only Medicare Part A providers and Part B suppliers that experience a cybersecurity-incident-related cash flow disruption — a narrow, event-triggered subset of an already-limited provider population.
- Budgetary Magnitude Medium Authorizes payments from the Medicare Part A and Part B Trust Funds with General Fund transfer backstops, but payment volume is contingent on the occurrence and scale of qualifying cybersecurity incidents, so total outlays are uncertain and not fixed by statute.
- Legal / Regulatory Depth High Amends multiple Social Security Act provisions to create new express statutory authority for cybersecurity-triggered emergency Medicare payments and new mandatory Trust Fund transfer mechanisms — substantive new legal authority that did not previously exist.
- Degree of Discretion Granted Medium The Secretary of Department of Health and Human Services (HHS) retains discretion over when to make payments and must design anti-fraud safeguards, but the authority is explicitly triggered by cybersecurity incidents and repayment is required, bounding the Secretary of Health and Human Services's latitude.
- Implementation & Enforcement Burden Medium Requires HHS to administer case-by-case payment determinations, anti-fraud reviews, and repayment or offset tracking for an unpredictable number of incidents, but does not create new penalty regimes or compliance mandates on providers.
- Temporal Commitment High Statutory amendments to the Social Security Act carry no sunset or reauthorization requirement, so the emergency payment authority persists indefinitely until Congress acts to repeal it.
No signal yet
No possible riders have been surfaced for this bill.
Summary
This bill sets new cybersecurity rules for health care organizations and their vendors, enforced through the Department of Health and Human Services (HHS). It applies to covered entities and business associates as defined under the Health Insurance Portability and Accountability Act (HIPAA). Among other elements, the bill * requires all health care covered entities and business associates to meet minimum cybersecurity standards, with stricter rules for entities deemed critical to national security; * mandates annual risk assessments, stress tests, independent audits, and public disclosure of compliance status; * raises civil penalties for health data security violations and creates a process to share penalty money with harmed individuals; * establishes a new annual user fee on covered entities to fund HHS oversight and enforcement; * offers Medicare incentive payments to hospitals that adopt cybersecurity practices and imposes payment reductions on those that do not; * and expands Medicare's emergency payment programs so providers can receive funds quickly when cyberattacks disrupt their cash flow.
AI-generated summary, pending human review.
| Version | Event | Date | User support | Your vote | Roll calls |
|---|---|---|---|---|---|
| Original |
Initial publication
Sep 17, 2026
|
Sep 17, 2026 | No votes yet | — | — |
Log in or create an account to record your vote on this legislation. Results are visible to all visitors.
Implementation & Enforcement Top 3
Higher civil penalties for health data security violations
Significantly increases minimum fines for breaking health data security laws, ranging from $500 to $250,000 depending on severity. Collected fines fund the HHS Office for Civil Rights (OCR), and a portion must be distributed to individuals harmed by violations. Requires all health care covered entities and business associates to meet baseline cybersecurity standards set by HHS, designed to protect patient data and national security. Also expands the legal duty to protect health data availability, not just confidentiality and integrity. Imposes stricter cybersecurity requirements on health care organizations deemed systemically important or critical to national security. Affected entities are notified but cannot challenge the designation methodology through administrative or court review. Requires health care covered entities and business associates to conduct yearly cybersecurity risk analyses, stress tests simulating disasters or attacks, and continuity planning — and to publish compliance results publicly on their websites. Smaller entities may receive waivers. Requires health care covered entities and business associates to hire independent auditors each year to assess their cybersecurity compliance and certify that any violations have been corrected. Smaller entities may receive waivers from this requirement.
- Population Scope High Applies mandatory cybersecurity standards, annual audits, stress tests, and compliance disclosures to all HIPAA covered entities and business associates — a broad class spanning virtually every hospital, clinic, insurer, and health care vendor in the country.
- Budgetary Magnitude Medium Raises minimum civil penalties to as high as $250,000 per violation and redirects collected proceeds to the Department of Health and Human Services (HHS) Office for Civil Rights (HHS Office for Civil Rights (OCR)), but total revenue depends on enforcement volume rather than a fixed appropriation.
- Legal / Regulatory Depth High Creates new substantive statutory mandates — minimum cybersecurity standards with two-tier enforcement, enforceable victim-distribution entitlements, mandatory independent audits, and public disclosure duties — fundamentally restructuring the legal obligations of the HIPAA-regulated population.
- Degree of Discretion Granted High Grants HHS Secretary broad rulemaking authority to set minimum and enhanced security standards, determine which entities qualify as high-risk, establish penalty methodologies, set audit standards, and issue waivers for smaller entities.
- Implementation & Enforcement Burden High Requires standing up new recurring compliance infrastructure across all covered entities — annual risk analyses, stress tests, independent audits, signed CEO/CISO attestations, and public disclosures — while increasing OCR's adjudicative workload through higher penalties and a new victim-distribution process.
- Temporal Commitment High Mandatory standards, audit requirements, and penalty regimes contain no sunset or reauthorization trigger, so they bind covered entities indefinitely unless Congress acts to repeal them.
No signal yet
Implementation & Enforcement
Higher civil penalties for health data security violations
Funding / Appropriations Top 3
Annual user fee on health care entities for cybersecurity enforcement
Creates a mandatory annual fee paid by all HIPAA covered entities and business associates to fund HHS oversight and enforcement of health data security. The fee is capped at $40 million in 2028 and $50 million in 2029, with inflation adjustments after that.
- Population Scope Medium Applies to all HIPAA covered entities and business associates — a broad sector of health care organizations — but does not directly reach individual patients or the general public, warranting M rather than H.
- Budgetary Magnitude High Establishes a mandatory, recurring, self-executing revenue stream capped at $40 million in FY2028 and $50 million in FY2029 with indefinite CPI-adjusted collections thereafter, available without further appropriation; the Medicare incentive component adds up to $1.3 billion across FY2029–2032 from the Federal Hospital Insurance Trust Fund.
- Legal / Regulatory Depth High Creates a new statutory fee obligation on a broad regulated class without appropriations action, and establishes a Medicare incentive-and-penalty program — both new substantive legal duties with binding financial consequences.
- Degree of Discretion Granted Medium Fee amounts are capped by statute and the pro-rata formula is prescribed, but the Secretary of Health and Human Services (HHS) retains authority to administer collection and set implementing details; Medicare incentive payment methodologies are similarly subject to rulemaking with review barred.
- Implementation & Enforcement Burden Medium Requires HHS to administer annual fee collection across the entire HIPAA-regulated population and Centers for Medicare & Medicaid Services (CMS) to run a new hospital attestation and payment-reduction program, but does not create criminal penalties or novel adjudicative infrastructure.
- Temporal Commitment High Both the user fee and the Medicare incentive/penalty program are permanent with no sunset — the fee recurs annually with CPI adjustment, and the payment-reduction regime continues indefinitely unless Congress repeals it.
No signal yet
Funding / Appropriations
Annual user fee on health care entities for cybersecurity enforcement
Core Policy Mechanism Top 3
Medicare emergency payments for cybersecurity-disrupted providers
Expands Medicare's emergency payment programs to cover providers and suppliers whose cash flow is disrupted by cyberattacks. Hospitals, clinics, and other Medicare providers can receive advance funds quickly during a cybersecurity incident, with Trust Fund protections built in.
- Population Scope Low Directly affects only Medicare Part A providers and Part B suppliers that experience a cybersecurity-incident-related cash flow disruption — a narrow, event-triggered subset of an already-limited provider population.
- Budgetary Magnitude Medium Authorizes payments from the Medicare Part A and Part B Trust Funds with General Fund transfer backstops, but payment volume is contingent on the occurrence and scale of qualifying cybersecurity incidents, so total outlays are uncertain and not fixed by statute.
- Legal / Regulatory Depth High Amends multiple Social Security Act provisions to create new express statutory authority for cybersecurity-triggered emergency Medicare payments and new mandatory Trust Fund transfer mechanisms — substantive new legal authority that did not previously exist.
- Degree of Discretion Granted Medium The Secretary of Department of Health and Human Services (HHS) retains discretion over when to make payments and must design anti-fraud safeguards, but the authority is explicitly triggered by cybersecurity incidents and repayment is required, bounding the Secretary of Health and Human Services's latitude.
- Implementation & Enforcement Burden Medium Requires HHS to administer case-by-case payment determinations, anti-fraud reviews, and repayment or offset tracking for an unpredictable number of incidents, but does not create new penalty regimes or compliance mandates on providers.
- Temporal Commitment High Statutory amendments to the Social Security Act carry no sunset or reauthorization requirement, so the emergency payment authority persists indefinitely until Congress acts to repeal it.
No signal yet
Core Policy Mechanism
Medicare emergency payments for cybersecurity-disrupted providers
Incomplete vote
You have not made a selection on all required items:
Choose Neutral if you prefer not to commit. Leaving without completing will remove all your votes for this bill from the totals.
Maximum recommendations reached
You have already recommended the maximum number of components allowed on this bill. To recommend [new component], choose one of your current recommendations to unselect: