Health Infrastructure Security and Accountability Act of 2026
Sets health data security requirements and provides Medicare support for hospitals adopting cybersecurity practices.
In the Senate Finance Committee since Sept. 17, 2026, 18 days after it was introduced. Most bills never leave committee.
- INTRODUCEDINTROSEP 17, 2026
- COMMITTEECOMM.IN COMMITTEE
- SENATESENATE—
- HOUSEHOUSE—
- LAWLAW—
What the bill would do, and why it matters
Health care depends on digital systems to protect patient information and keep services running. The bill would set new security requirements for health care organizations, require recurring risk reviews and audits, and increase penalties for certain failures. It would also offer Medicare support for hospitals adopting cybersecurity practices and allow advances when cyber incidents disrupt Medicare claims processing.
- INTRODUCED ONLY This bill has been introduced and possibly referred to a committee, but it has not passed any vote. Most introduced bills never become law — they die in committee without a hearing.
- DATA NOTE No Congressional Research Service summary was available.
- Set health data security standards
The bill would require the Secretary of Health and Human Services to set minimum security requirements for covered entities and business associates, plus enhanced requirements for entities deemed systemically important or important to national security. The Secretary would review and update the requirements at least every two years.
- Require yearly risk plans and audits
Covered entities and business associates would generally have to conduct and document annual risk analyses, recovery plans, and resilience tests, and publish compliance statements online. They would also have to hire independent auditors for annual security audits; starting four years after enactment, HHS would audit at least 20 entities each year.
- Pay hospitals to adopt cybersecurity practices
The bill would provide proportional Medicare payments for hospitals adopting essential cybersecurity practices in fiscal years 2029 and 2030, and enhanced practices in fiscal years 2031 and 2032. The specified payment amounts are $800,000,000 for fiscal years 2029 and 2030 and $500,000,000 for fiscal years 2031 and 2032.
- Increase penalties and fund enforcement
The bill would set higher minimum civil penalties for security violations and allow penalties of up to $5,000 per day for specified failures to submit records or comply with audits. It would also authorize HHS to collect fees from covered entities and business associates to support oversight and enforcement, subject to annual limits.
- Reduce payments for nonadopting hospitals
Starting in fiscal year 2031, eligible hospitals and critical access hospitals that do not adopt the required practices would face reductions in certain Medicare payments. The reductions would grow over time, and HHS could grant a renewable hardship exception in qualifying cases.
- Allow Medicare advances after cyber incidents
The bill would let HHS provide accelerated or advance Medicare payments to specified providers and suppliers facing significant cash-flow problems, including when a cybersecurity incident substantially disrupts Medicare claims processing. Payments would be subject to safeguards against fraud, waste, and abuse.
The bill’s stated aim is to protect health information and patient safety while keeping health care information systems and transactions available and resilient. It treats cybersecurity as a continuity-of-care issue as well as a data-protection issue, and would add federal oversight and compliance requirements.
It also addresses the possibility that a cybersecurity incident could disrupt Medicare claims processing and leave providers with significant cash-flow problems. The bill would pair hospital assistance with financial incentives and payment reductions tied to cybersecurity practices.
Written from the bill text.
The path it took, step by step
- IntroducedSEP 17, 2026SENATESEP 17, 2026By Sen. Warner with 1 original cosponsorReferred to Finance
- SAME DAYNOWSenate committeeSEP 17, 2026FINANCE NOWSEP 17, 2026In committee for 18 daysNo hearing yet
- 18 DAYS SO FARPassed the Senate—SENATE FLOOR—Not scheduled
- House committee—HOUSE—
- Passed the House—HOUSE FLOOR—Not scheduled
- Resolve differencesONLY IF NEEDEDBOTH CHAMBERSONLY IF NEEDEDSkipped if the other chamber passes the same text
- Signed into law—PRESIDENT—10 days to sign or veto
- SEP 172026SEP 17, 2026REFERREDRead twice and referred to the Committee on Finance.
- SEP 172026SEP 17, 2026INTRODUCEDSENATEIntroduced in Senate
At day 18, this bill is already older than 6% of the laws passed this Congress were when they were signed.
Where your members stand on it
Support from one state
Plus the sponsor, a Democrat. Every cosponsor is from one party.
Plus the sponsor, a Democrat. Every cosponsor is from one party.
Sen. Warner’s record: sponsored 61 bills this Congress. 0 passed the Senate; 0 became law.
- Ron WydenD-ORORIGINAL
What readers think
Discussion
Get an alert when it changes stage, gets a floor vote in the Senate, or is signed into law.