Health Infrastructure Security and Accountability Act of 2026

This bill would require the Department of Health and Human Services to set minimum cybersecurity requirements for health care organizations that handle patient information, and stricter requirements for those considered systemically important or important to national security. Covered organizations would have to do yearly risk analyses, stress tests, and independent audits, have their top executives sign compliance statements, and post compliance information online. The bill would raise civil penalties for security violations, create criminal penalties for false or willfully late reports, and charge organizations a fee based on revenue to fund oversight. It would also pay certain hospitals to adopt cybersecurity practices, reduce Medicare payments to hospitals that do not adopt them starting in fiscal year 2031, and allow Medicare to make early payments to providers disrupted by cyberattacks.

Full text and official record on Congress.gov

Sponsors

• Mark R. Warner Democrat sponsor
• 1 cosponsors