This bill requires the Department of Health and Human Services to strengthen its cybersecurity defenses by having its Inspector General conduct regular security evaluations every two years. The evaluations will include penetration testing and other procedures to identify vulnerabilities in systems that handle patient data, Medicare information, and other sensitive health information. Within two years of the law's enactment and every two years after that, the Secretary of HHS must report to Congress on planned cybersecurity improvements, while the Inspector General must report on current spending and any additional funding or legislative changes needed to continue these evaluations. The bill affects patients whose health information is stored in HHS systems and the department's cybersecurity operations, though it does not specify upfront funding amounts. This legislation aims to protect patient privacy and safety by ensuring HHS systems are regularly tested against current cyberattack methods.