Health Infrastructure Security and Accountability Act of 2024

This bill strengthens security standards for health information and creates a Medicare program to help hospitals adopt cybersecurity practices and receive accelerated payments after cyber incidents. It amends the Social Security Act to impose new security requirements, risk management duties, higher penalties, and user fees on covered entities and business associates, and it establishes incentive payments and emergency payment authority for healthcare providers affected by cybersecurity incidents.

Sec. 101, Security requirements: The Secretary of Health and Human Services must adopt minimum security requirements for all covered entities and business associates, and enhanced security requirements for those deemed systemically important or important to national security. The requirements must be reviewed and updated at least every two years, and take effect two years after enactment.

Sec. 102, Security risk management, reporting requirements, and audits: Each covered entity and business associate must annually conduct a security risk analysis, document a recovery plan, perform a stress test, and publish compliance statements on a public website. They must report this documentation to the Secretary, with those subject to enhanced requirements reporting annually.

Sec. 103, Increased civil penalties for failure to comply with security standards: For violations of security standards, minimum penalties start at $500 per violation, with higher tiers up to at least $250,000. Penalty amounts consider the entity's size, compliance history, and good faith efforts. Collected penalties may be used for enforcement and, under a future regulation, distributed to harmed individuals.

Sec. 104, User fee to support data security oversight and enforcement: Each covered entity and business associate must pay a fee based on its revenue relative to national health expenditures. Fees are capped at $40 million in fiscal year 2026, $50 million in 2027, and adjusted for inflation thereafter, and are used for oversight and enforcement.

Sec. 201, Medicare safe cybersecurity practices adoption program: For fiscal years 2027 and 2028, $800 million is available for critical access and eligible high-needs hospitals to adopt essential cybersecurity practices. For 2029 and 2030, $500 million is available for all eligible hospitals and critical access hospitals to adopt enhanced practices. Hospitals must attest to implementing practices identified by the Secretary through rulemaking.

Sec. 202, Medicare accelerated and advance payments in response to cybersecurity incidents: The Secretary may provide accelerated or advance payments to eligible providers and suppliers with significant cash flow problems due to a cybersecurity incident that disrupts Medicare claims processing. Payments are subject to safeguards, and the General Fund will reimburse the Medicare trust funds for accelerated payments made.