Proposed bill calls for minimum healthcare cyber standards

The bill's provisions

The Health Infrastructure Security and Accountability Act addressed several topics that have been at the forefront of healthcare cybersecurity discussions and government guidance in recent years. Chiefly, the bill would require the HHS secretary to develop and adopt minimum and enhanced security requirements within two years.

The minimum requirements would apply to healthcare entities across the U.S., and the enhanced security requirements would apply to "covered entities that are of systemic importance or important to national security."

The HHS secretary would be required to revisit and update these standards every two years.

In January 2024, HHS released sector-specific cybersecurity performance goals that consisted of essential and enhanced goals, with the intent of helping the sector improve its security. At the time, experts suggested that these would become the basis for future legislation that would set these minimum standards into law.

In addition to establishing minimum and enhanced standards, the bill would require covered entities and business associates to submit annual independent security audits and stress tests to determine their ability to restore service after a cybersecurity incident.

Furthermore, the bill would require HHS to audit the data security practices of at least 20 regulated entities annually and eliminate statutory caps on HHS fines so that larger fines can be issued.

The bill would also heighten corporate accountability by requiring executives to annually certify compliance with these standards. If passed, the bill would also give the HHS secretary the authority to provide advanced and accelerated Medicare payments in case of a disruption to the U.S. healthcare system, as was necessary during the Change Healthcare cyberattack.

Lastly, the bill would allocate $800 million in upfront investment payments to rural and urban safety-net hospitals and an additional $500 million to all hospitals to adopt the enhanced cybersecurity standards.

Lawmakers speak to bill's importance

Both Warner and Wyden have been outspoken about the need for increased healthcare cybersecurity standards. Warner released a policy options paper in November 2022 that aimed to address the current cybersecurity threats facing the sector.

In the aftermath of the Change Healthcare cyberattack, Wyden called on the Federal Trade Commission and the Securities and Exchange Commission to investigate UnitedHealth Group to determine whether federal laws were broken.

"Cyberattacks on our health care institutions threaten patients' most private data and delay essential medical care, directly endangering Americans' lives and long-term health," Warner said. "With hacks already targeting institutions across the country, it's time to go beyond voluntary standards and ensure health care providers and vendors get serious about cybersecurity and patient safety."

Andrea Palm, deputy secretary of HHS, added in the press release that more must be done to prevent healthcare cyberattacks.

"Clear accountability measures and mandatory cybersecurity requirements for all organizations that hold sensitive data are essential."

If passed, the Health Infrastructure Security and Accountability Act would set clearer cybersecurity standards for the healthcare sector while holding large healthcare entities accountable for security failures.

Jill McKeon has covered healthcare cybersecurity and privacy news since 2021.