# Summary
The Health Infrastructure Security and Accountability Act of 2024 strengthens cybersecurity protections for healthcare organizations and patient health information. The bill requires healthcare providers and their business partners to meet new minimum and enhanced security standards developed by the Department of Health and Human Services, with those enhanced standards applying to large or nationally important healthcare organizations. Healthcare providers must conduct annual security risk assessments, stress tests, and independent security audits, and publish their compliance status publicly. Organizations that fail to meet these requirements face civil penalties of up to $5,000 per day and potential criminal penalties up to 10 years imprisonment for knowingly submitting false information.
The bill substantially increases financial penalties for security breaches, with minimum fines ranging from $500 to $250,000 depending on violation severity. A new user fee on healthcare providers and business associates, starting at $40 million in 2026, will fund oversight and enforcement activities. Separately, the bill provides $800 million in Medicare incentive payments to hospitals and critical access hospitals during 2027-2028 to adopt essential cybersecurity practices, followed by $500 million in 2029-2030 for enhanced practices. Hospitals that fail to adopt required practices face Medicare payment reductions of 0.25 to 1.0 percent starting in 2029. The bill also allows Medicare accelerated and advance payments to providers experiencing cash flow problems from cybersecurity incidents.
Take Action
Your position
Add a comment
to comment on this bill.
Annotate the text
Highlight any passage on the Summary or Full Text tab to attach a note. Annotations appear on the Annotations tab.