2026年医疗保健网络安全与韧性法案

Would make hospitals and insurers encrypt your medical records within three years, with grants for rural clinics.

关于本法案的更多内容

Your medical records would get new federal security rules. Hospitals, insurers, and the vendors they hire would have to encrypt patient data. They would also need two-step login and regular security testing. The rules would take effect three years after the bill becomes law. Breach notices would change too. When your health data is exposed, the notice would have to say how many people were affected. Safety-net providers could get federal grants to pay for this work. Community health centers, rural clinics, Indian Health Service sites, and nonprofit hospitals could apply. Grants would last up to three years. They could fund new staff, training, and system upgrades. No dollar amount is set. The money is approved through 2030. Rural providers would also get federal guidance and hands-on help. A federal plan would aim to grow the health cyber workforce. The Department of Health and Human Services (HHS) would run most of this work. HHS and the Cybersecurity and Infrastructure Security Agency (CISA) would build a joint response plan within one year. HHS would name one official to lead its cyber work. That official would not handle HIPAA enforcement. HHS would report to Congress each year on threats and major attacks. New rules would spell out how strong security steps can lower fines. HHS would also list every case where those steps changed a fine or audit. A federal-state group would study how to cut duplicate breach reports.