S. 5443, the Health Infrastructure Security and Accountability Act of 2026, establishes comprehensive cybersecurity requirements for healthcare providers and entities handling patient information, with strict enforcement mechanisms and financial incentives to improve data security. The bill requires all covered healthcare entities to conduct annual security assessments and audits, comply with tiered security standards developed by the Secretary of Health and Human Services within 18 months, and face civil penalties up to $5,000 per day plus criminal penalties for non-compliance. To encourage adoption of stronger cybersecurity practices, the bill provides $800 million for hospital incentive payments in 2029-2030 and creates Medicare payment reductions starting in 2031 for hospitals that fail to implement essential cybersecurity standards, with reductions escalating up to 1.5 percent by 2035 and hardship exemptions available for significant disruptions. The bill funds these oversight and enforcement activities through user fees capped at $40-50 million annually on covered entities and includes provisions allowing Medicare providers experiencing cybersecurity-related cash flow problems to request advance payments from the federal government.