S. 5443 — Health Infrastructure Security and Accountability Act of 2026

This section requires the Secretary of Health and Human Services to adopt minimum security requirements for all covered entities and business associates, and enhanced requirements for those of systemic importance or national security importance, with updates at least every two years. It directs notification of entities subject to enhanced requirements, bars administrative or judicial review of such determinations, mandates consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of National Intelligence on factors including cyber incident prevention, sets an effective date two years after enactment with rulemaking required within 18 months, and adds availability to the existing integrity and confidentiality standards for health information.

This section requires covered entities and business associates to annually conduct and document a security risk analysis, maintain a disaster recovery plan, perform a stress test of recovery capabilities after a cyber incident or natural disaster, and publish signed compliance statements and status on a public website. It also mandates annual independent audits of compliance with Healthcare and Public Health Sector Cybersecurity Performance Goals, effective three years after enactment, subject to waiver by the Secretary of Health and Human Services.

This section increases minimum civil penalties for violations of health information security standards under section 1173(d) to $500 (from $100) for unknowing violations, $5,000 (from $1,000) for reasonable cause violations, $50,000 (from $10,000) for corrected willful neglect violations, and $250,000 for uncorrected willful neglect violations. It requires the Secretary to consider the size of the covered entity or business associate, compliance history, and good faith efforts when setting penalties; directs collected penalties to the HHS Office for Civil Rights for enforcement; and mandates a methodology, established within 18 months, to distribute a percentage of penalties or settlements to harmed individuals. It also repeals section 13412 of the Health Information Technology for Economic and Clinical Health Act.

This section establishes a user fee on each covered entity and business associate to fund the Secretary’s data security oversight and enforcement activities. The fee equals the entity’s or associate’s pro rata share of national health expenditures based on its prior-year revenue. Amounts collected are available without further appropriation and may not exceed the lesser of estimated costs or $40 million in fiscal year 2028, $50 million in fiscal year 2029, or the prior-year amount adjusted by the consumer price index for all urban consumers thereafter.

This section establishes a Medicare incentive program providing $800 million in FY2029 and FY2030 for critical access hospitals and eligible high-needs hospitals, and $500 million in FY2031 and FY2032 for critical access hospitals and eligible hospitals, to adopt essential and enhanced cybersecurity practices. Payments are drawn from the Federal Hospital Insurance Trust Fund and conditioned on annual attestation of implementation. The Secretary identifies required practices through notice-and-comment rulemaking beginning in FY2029 and FY2030, respectively, and posts state-level adoption data on the CMS website. No administrative or judicial review applies to payment methodologies or adoption determinations. Eligible high-needs hospitals include Puerto Rico subsection (d) hospitals, Indian Health Service facilities, those with at least 75 percent dual-eligible or subsidy-eligible Medicare beneficiaries, and rural, sole community, low-volume, and Medicare-dependent hospitals.

This section authorizes the Secretary to make accelerated payments under Medicare Part A to eligible providers—including subsection (d) hospitals, critical access hospitals, skilled nursing facilities, home health agencies, hospices, rural health clinics, and federally qualified health centers—experiencing cash flow problems from cybersecurity incidents. It also authorizes advance payments under Part B to participating suppliers facing similar disruptions. The section requires transfers from the General Fund to the Hospital Insurance and Supplementary Medical Insurance Trust Funds equal to the payments made, with equivalent amounts transferred back upon claim offsets or repayment.