Congressional Action on Health Care Cybersecurity: HISAA is Re-Introduced and the Health Care Cybersecurity and Resiliency Act Moves Forward

In response to major breaches and security incidents affecting the industry, the Health Infrastructure Security and Accountability Act (HISAA) has been re-introduced and the U.S. Senate has advanced the Health Care Cybersecurity and Resiliency Act (HCCRA).

Key Provisions The reintroduced HISAA bill retains all of the substantive provisions of the original version, which would substantially overhaul the existing HIPAA Security Rule.

Specifically, $800 million would go to rural and urban safety-net hospitals over two years, with an additional $500 million available to incentivize all hospitals to adopt enhanced cybersecurity practices.

Implications for Health Care Organizations Although both bills must clear additional legislative hurdles before becoming law, the overwhelming bipartisan support for health care cybersecurity reform suggests that significant new cybersecurity obligations are likely coming.

HCCRA represents one of the most substantial legislative efforts to overhaul health care cybersecurity, and HISAA would be the most significant revision to HIPAA since the HITECH Act in 2009.