Democratic senators are doubling down on healthcare cybersecurity. Sens. Mark Warner (D-VA) and Ron Wyden (D-OR) have reintroduced the Health Infrastructure Security and Accountability Act, arguing that voluntary standards have proven insufficient as cyberattacks on hospitals and health systems grow more frequent and sophisticated since the bill's original 2024 introduction.

The legislation would require the Department of Health and Human Services to establish minimum cybersecurity standards for healthcare entities within two years, with stricter requirements for organizations deemed of "systemic" or national security importance. Covered entities would also need to conduct documented security risk analyses and attest to compliance within three years, with civil penalties for those who fall short.

To ease the financial burden, the bill earmarks $1.3 billion in federal support — $800 million in upfront payments to 2,000 rural and urban safety-net hospitals, plus $500 million available to all compliant Medicare hospitals thereafter. Passage, however, faces an uphill battle in a Republican-controlled Congress focused on reducing federal healthcare spending.

By the Numbers:

• $800M in upfront payments to 2,000 rural and urban safety-net hospitals over two years
• $500M available to all Medicare hospitals meeting enhanced cybersecurity standards
• 2-year timeline for HHS to adopt new minimum cybersecurity standards
• 3-year timeline for covered entities to complete and document security risk analyses

Why it matters: Cyberattacks on healthcare systems can delay care, expose sensitive patient data, and threaten lives. Mandatory standards backed by federal funding could meaningfully raise the industry's security floor — particularly for under-resourced hospitals most vulnerable to attacks.