,,ii  #aaith ,,congress  #b;d ,session  
,s4 #eddc  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,september #ag1
 #bjbf,mr4 ,warner 7for himself and ,mr4
 ,wyden7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,finance  ,a ,,bill  ,to 
amend titles ,,xi and ,,xviii of the    
,social ,security ,act to strengthen1   
increase oversight of1 and compliance   
with1 security standards for health     
information1 and for other purposes4    
#a4 ,short title2 table of contents  7a7
 ,short title ,this ,act may be cited as
 the ,health ,infrastructure ,security  
and ,accountability ,act of #bjbf4  7b7 
,table of contents ,the table of        
contents for this ,act is as follows3   
,sec4 #a4 ,short title2 table of        
contents4,title ,i--,strengthening and  
increasing oversight of1 and compliance 
with1 security standards for health     
information,sec4 #aja4 ,security        
requirements4,sec4 #ajb4 ,security risk 
management1 reporting requirements1 and 

audits for covered entities and business
 associates4,sec4 #ajc4 ,increased civil
 penalties for failure to comply with   
security standards and requirements for 
health information4,sec4 #ajd4 ,user fee
 to support data security oversight and 
enforcement activities4,title           
,,ii--,medicare assistance to address   
cybersecurity incidents#bja4 ,medicare  
safe cybersecurity practices adoption   
program for eligible hospitals and      
critical access hospitals4#bjb4         
,medicare accelerated and advanced      
payments in response to cybersecurity   
incidents4  ,i ,strengthening and       
increasing oversight of1 and compliance 
with1 security standards for health     
information  #aja4 ,security            
requirements  7a7 ,in general ,section  
#aagc7;d77#a7 of the ,social ,security  
,act 7#db ,u4,s4,c4 #acbj;d-#b7;d77#a77 
is amended-- 7#a7 in subparagraph 7,a71 
by redesignating clauses 7i7 through 7v7
 as subclauses 7,i7 through 7,v7        
respectively and indenting              

appropriately2  7#b7 by redesignating   
subparagraphs 7,a7 and 7,b7 as clauses  
7i7 and 7ii7 respectively and indenting 
appropriately2  7#c7 by striking        
,security ,standards4--,the ,secretary  
and inserting the following3 ,minimum   
,security ,standards4-- 7,a7 ,in general
 ,the ,secretary  2  7#d7 in            
subparagraph 7,a71 as added by paragraph
 7#c7-- 7,a7 in clause 7i77,v71 by      
striking and at the end2  7,b7 in clause
 7ii71 by striking the period at the end
 and inserting 2 and2 and  7,c7 by      
adding at the end the following new     
clause3  7iii7 include minimum and      
enhanced security requirements adopted  
under subparagraph 7,b7  2 and  7#e7 by 
adding at the end the following new     
subparagraph3  7,b7 ,minimum and        
enhanced security requirements  7i7     
,adoption ,subject to clauses 7iii7 and 
7iv71 in order to protect health        
information1 protect patient safety1 and
 ensure the availability and resiliency 
of health care information systems and  

health care transactions1 the ,secretary
 shall adopt-- 7,i7 minimum security    
requirements for covered entities and   
business associates2 and  7,,ii7        
enhanced security requirements for      
covered entities and business associates
 that-- 7aa7 are of systemic importance1
 as determined by the ,secretary2 or    
7bb7 are important to national security1
 as determined by the ,secretary1 in    
consultation with the ,director of the  
,cybersecurity and ,infrastructure      
,security ,agency and the ,director of  
,national ,intelligence4  7ii7          
,application of enhanced security       
requirements  7,i7 ,notification ,the   
,secretary shall1 at a time and in a    
manner determined appropriate by the    
,secretary1 notify each covered entity  
and business associate that is subject  
to the enhanced security requirements   
under clause 7i77,,ii74  7,,ii7         
,limitation on review ,there shall be no
 administrative or judicial review under
 section #ahfi1 #ahgh1 or otherwise of  

the methodology the ,secretary uses to  
determine whether a covered entity or   
business associate is subject to the    
enhanced security requirements under    
clause 7i77,,ii74  7iii7 ,factors ,in   
addition to the factors described in    
subparagraph 7,a77i71 in developing--   
7,i7 the minimum security requirements  
under clause 7i77,i71 the ,secretary    
shall1 in consultation with the         
,director of ,cybersecurity and         
,infrastructure ,security ,agency and   
the ,director of ,national              
,intelligence1 design the requirements  
to prevent-- 7aa7 cyber incidents       
utilizing the tools and strategies used 
to target covered entities or business  
associates2  7bb7 the potential harms1  
as defined by the ,secretary1 to        
national security that could result from
 a cyber incident involving a covered   
entity or business associate2  7cc7 the 
potential harms1 as defined by the      
,secretary1 to patients that could      
result from a cyber incident involving a

 covered entity or business associate2  
and  7dd7 other potential harms from    
cyber incidents1 as determined          
appropriate by the ,secretary2 and      
7,,ii7 the enhanced security            
requirements under clause 7i77,,ii71 the
 ,secretary shall1 in consultation with 
the ,director of the ,cybersecurity and 
,infrastructure ,security ,agency and   
the ,director of ,national              
,intelligence1 design the requirements  
to prevent the potential harms described
 in subclause 7,i7 and protect against  
the specific threats the covered        
entities and business associates        
described in such clause face4  7iv7    
,review and update of requirements ,the 
,secretary shall review and update the  
minimum and enhanced security           
requirements adopted under clause 7i7   
not less frequently than every #b years4
  7v7 ,effective date and rulemaking    
7,i7 ,effective date ,the requirements  
under this subparagraph shall take      
effect on the date that is #b years     

after the date of enactment of this     
subparagraph4  7,,ii7 ,rulemaking ,not  
later than #ah months after the date of 
enactment of this subparagraph1 the     
,secretary shall promulgate regulations 
to carry out this subparagraph4  7vi7   
,definitions ,for purposes of this      
subsection3 7,i7 ,business associate    
,the term business associate has the    
meaning given such term in section      
#afj4ajc of title #de1 ,code of ,federal
 ,regulations 7or a successor           
regulation74  7,,ii7 ,covered entity    
,the term covered entity has the meaning
 given that term in section #afj4ajc of 
title #de1 ,code of ,federal            
,regulations 7or a successor            
regulation74  7,,iii7 ,systemic         
importance ,the term systemic importance
 means1 with respect to a covered entity
 or business associate1 that the failure
 of1 or a disruption to1 such entity or 
associate would have a debilitating     
impact on access to health care or the  
stability of the health care system of  

the ,united ,states 7as determined by   
the ,secretary74  4  7b7 ,availability  
of health information ,section          
#aagc7;d77#b77;,a7 of the ,social       
,security ,act 7#db ,u4,s4,c4           
#acbj;d-#b7;d77#b77;,a77 is amended by  
striking the integrity and              
confidentiality and inserting 8the      
availability1 integrity1 and            
confidentiality4  #ajb4 ,security risk  
management1 reporting requirements1 and 
audits for covered entities and business
 associates  7a7 ,security risk         
management and reporting ,section       
#aagc7;d7 of the ,social ,security ,act 
7#db ,u4,s4,c4 #acbj;d-#b7;d77 is       
amended by adding at the end the        
following new paragraph3  7#c7 ,security
 risk management and reporting  7,a7 ,in
 general ,each covered entity and       
business associate shall at a minimum1  
on an annual basis-- 7i7 conduct and    
document a security risk analysis1      
including information regarding the     
manner and extent to which such entity  

or associate is exposed to risk through 
its business associates2  7ii7 document 
a plan for a rapid and orderly          
resolution in the event of a natural    
disaster1 disruptive cyber incident1 or 
other technological failure to its      
information systems or those of its     
business associates2  7iii7 conduct a   
stress test to evaluate whether such    
entity or associate has the capabilities
 and planning necessary to recover      
essential functions1 such as patient    
care operations and transactions        
described in subsection 7a77#b71        
following a cyber incident1 a natural   
disaster1 or other substantial threat to
 health care operations1 as determined  
by the ,secretary2  7iv7 document       
whether1 based upon the results of the  
stress test described in clause 7iii71  
the covered entity or business associate
 revised the most recent plan described 
in clause 7ii72  7v7 provide a written  
statement signed by the chief executive 
officer and chief information security  

officer 7or equivalent thereof7 stating 
that the covered entity or business     
associate is in compliance with security
 requirements adopted under part #afj of
 title #de1 ,code of ,federal           
,regulations1 and subparts ,a and ,c of 
part #afd of title #de1 ,code of        
,federal ,regulations 7or a successor   
regulation71 including the applicable   
security requirements adopted under     
paragraph 7#a77;,b72 and  7vi7 publish  
on a publicly accessible website-- 7,i7 
whether the covered entity or business  
associate has received a notification   
from the ,secretary pursuant to         
paragraph 7#a77;,b77ii77,i72  7,,ii7    
whether the covered entity or business  
associate meets the minimum security    
requirements and1 if applicable1 the    
enhanced security requirements under    
paragraph 7#a77;,b72 and  7,,iii7 a copy
 of each statement provided under clause
 7v7 with respect to each year in a     
machine-readable format4  7,b7 ,stress  
test methodology ,the ,secretary shall  

provide for not less than #b different  
sets of conditions under which the test 
described in subparagraph 7,a77iii7 is  
to be conducted4  7,c7 ,waiver authority
 ,the ,secretary may waive the          
requirements of this paragraph with     
respect to a covered entity or business 
associate if the burden on the entity or
 associate significantly outweighs the  
benefits1 taking into account the       
revenue of the entity or associate1 the 
volume of protected health information  
or health care transactions processed by
 the entity or associate1 and such other
 factors as the ,secretary determines   
appropriate4  7,d7 ,reporting  7i7 ,in  
general ,subject to clause 7ii71 each   
covered entity and business associate   
shall submit the documentation required 
under subparagraph 7,a7 at such time1 in
 such form1 and containing such         
information as the ,secretary may       
require4  7ii7 ,annual reporting for    
covered entities and business associates
 subject to enhanced security           

requirements ,each covered entity and   
business associate that is subject to   
enhanced security requirements shall    
submit the documentation required under 
subparagraph 7,a7 to the ,secretary not 
less frequently than on an annual basis4
  7,e7 ,definitions ,for purposes of    
this subsection3 7i7 ,cyber incident    
,the term cyber incident has the meaning
 given the term incident in section     
#bbjj7ab7 of the ,homeland ,security    
,act of #bjjb 7#f ,u4,s4,c4 #fej7ab774  
7ii7 ,machine-readable ,the term        
machine-readable has the meaning given  
such term in section #cejb of title #dd1
 ,united ,states ,code4  7iii7 ,stress  
test ,the term stress test means an     
extensive real-world simulation intended
 to test the operational resilience of  
the health care operations of a covered 
entity or business associate in response
 to a substantial interruption in       
information systems1 including the      
ability to-- 7,i7 continue to provide   
essential care and services during and  

in the recovery period from such        
substantial interruption2 and  7,,ii7   
timely rebuild the information systems  
7as defined in section #bbjj7ad7 of the 
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #fej7ad777 of such covered    
entity or business associate4  7,f7     
,effective date ,the requirements under 
this paragraph shall take effect on the 
date that is #c years after the date of 
enactment of this paragraph4  4  7b7    
,independent security compliance audits 
,section #aagc7;d7 of the ,social       
,security ,act 7#db ,u4,s4,c4           
#acbj;d-#b7;d771 as amended by          
subsection 7a71 is amended by adding at 
the end the following new paragraph3    
7#d7 ,independent security compliance   
audits  7,a7 ,in general ,each covered  
entity and business associate shall--   
7i7 contract with an independent auditor
 that meets such requirements for       
independence and technical expertise as 
the ,inspector ,general of the          
,department of ,health and ,human       

,services may establish to conduct an   
annual audit in accordance with         
subparagraph 7,b72 and  7ii7 document   
the findings of each audit conducted    
under clause 7i74  7,b7 ,audit          
requirements ,an audit conducted under  
subparagraph 7,a77i7 shall-- 7i7 assess 
compliance of the covered entity or     
business associate with-- 7,i7 during   
the period prior to the effective date  
of the requirements under paragraph     
7#a77;,b71 the ,healthcare and ,public  
,health ,sector ,cybersecurity          
,performance ,goals as described in the 
report published by the ,department of  
,health and ,human ,services as of the  
date of enactment of this paragraph1 and
 titled ,healthcare and ,public ,health 
,sector-,specific ,cybersecurity        
,performance ,goals3 ,strengthening the 
,cybersecurity of the ,healthcare       
,sector and ,keeping ,patients ,safe and
 ,secure2 and  7,,ii7 on or after the   
effective date of the requirements under
 paragraph 7#a77;,b71 the minimum and   

enhanced security requirements adopted  
under such paragraph1 as applicable2    
7ii7 identify any areas in which the    
covered entity or business associate did
 not meet such goals or requirements1 as
 applicable2 and  7iii7 certify that the
 covered entity or business associate-- 
7,i7 has resolved any areas of          
noncompliance2 or  7,,ii7 is            
implementing an appropriate plan to     
resolve such areas of noncompliance in a
 timely manner4  7,c7 ,waiver authority 
,the ,secretary may waive the           
requirements of this paragraph with     
respect to a covered entity or business 
associate if the burden on the entity or
 associate significantly outweighs the  
benefits1 taking into account the       
revenue of the entity or associate1 the 
volume of protected health information  
or health care transactions processed by
 the entity or associate1 and such as   
other factors as the ,secretary         
determines appropriate4  7,d7 ,reporting
  7i7 ,in general ,subject to clause    

7ii71 each covered entity and business  
associate shall submit the documentation
 required under subparagraph 7,a77ii7 at
 such time1 in such form1 and containing
 such information as the ,secretary may 
require4  7ii7 ,annual reporting for    
entities and associates subject to      
enhanced security requirements ,each    
covered entity and business associate   
that is subject to enhanced security    
requirements shall submit the           
documentation required under            
subparagraph 7,a77ii7 to the ,secretary 
not less frequently than on an annual   
basis4  7,e7 ,effective date ,the       
requirements under this paragraph shall 
take effect on the date that is #ahj    
days after the date of enactment of this
 paragraph4  4  7c7 ,secretarial audits 
of data security practices ,section     
#aagc7;d7 of the ,social ,security ,act 
7#db ,u4,s4,c4 #acbj;d-#b7;d771 as      
amended by subsections 7a7 and 7b71 is  
amended by adding at the end the        
following new paragraph3  7#e7          

,secretarial audits of data security    
practices  7,a7 ,in general ,each year  
7beginning on or after the date that is 
#d years after the date of enactment of 
this paragraph7 the ,secretary shall    
conduct an annual audit of the data     
security practices of at least #bj      
covered entities or business associates 
under this part4 ,the ,comptroller      
,general of the ,united ,states shall   
monitor auditing activities conducted   
under this paragraph4  7,b7             
,considerations ,in selecting covered   
entities or business associates for     
audit under subparagraph 7,a7 the       
,secretary shall consider-- 7i7 whether 
the covered entity or business associate
 is of systemic importance2  7ii7       
whether any complaints have been made   
with respect to the data security       
practices of the covered entity or      
business associate2 and  7iii7 whether  
the covered entity or business associate
 has a history of previous violations4  
7,c7 ,corrective action plan and        

penalties ,the findings of an audit     
under this paragraph may result in a    
civil money penalty based on the failure
 of a covered entity or business        
associate to submit documentation       
demonstrating that the covered entity or
 business associate has taken corrective
 actions to achieve compliance in       
response to a finding of a potential    
violation of a provision of this part   
within a period of time specified by the
 ,secretary after receipt of such       
findings4  7,d7 ,reports to ,congress   
,the ,secretary shall submit to         
,congress reports summarizing the       
results of the audits conducted under   
this paragraph biennially ending on the 
date that is #aj years after the date on
 which the first report is submitted    
under this subparagraph4  4  7d7 ,civil 
and criminal penalties for failure ,to  
comply with documentation1 reporting1   
and audit requirements ,section         
#aagc7;d7 of the ,social ,security ,act 
7#db ,u4,s4,c4 #acbj;d-#b7;d771 as      

amended by subsections 7a71 7b71 and    
7c71 is amended by adding at the end the
 following new paragraph3  7#f7 ,civil  
and criminal penalties for failure to   
comply with documentation1 reporting1   
and audit requirements  7,a7 ,civil     
penalties  7i7 ,in general ,a covered   
entity or business associate that-- 7,i7
 fails to timely submit documentation or
 a report required under paragraph 7#c71
 7#d71 or 7#e72  7,,ii7 fails to comply 
with an audit under paragraph 7#e72 or  
7,,iii7 fails to comply with a          
responsibility of a covered entity or a 
business associate under section        
#afj4caj of title #de1 ,code of ,federal
 ,regulations 7or a successor           
regulation72  shall be subject to a     
civil money penalty of not more than    
#e1jjj per day for each such failure4   
7ii7 ,procedures ,the provisions of     
section #aabh;,a 7other than subsections
 7a71 7b71 and 7d77#a71 and the second  
sentence of subsection 7f77 shall apply 
to the imposition of a civil money      

penalty under this subparagraph in the  
same manner as such provisions apply to 
the imposition of a penalty under such  
section #aabh;,a4  7iii7 ,clarification 
,any civil money penalty under this     
subparagraph with respect to a failure  
described in clause 7i7 shall be in lieu
 of the penalties described in section  
#aagf4  7,b7 ,criminal penalties ,in    
addition to any penalties imposed under 
subparagraph 7,a71 whoever submits1 or  
causes to be submitted1 any             
documentation or report required of a   
covered entity or business associate    
under paragraph 7#c71 7#d71 or 7#e7     
knowing that such documentation or      
report contains false information1 or   
willfully fails to timely submit1 or    
willfully causes to not be timely       
submitted1 such a document or report1   
shall be guilty of a felony and upon    
conviction thereof fined not more than  
#a1jjj1jjj or imprisoned for not more   
than #aj years1 or both4  4  #ajc4      
,increased civil penalties for failure  

to comply with security standards and   
requirements for health information  7a7
 ,increased civil penalties ,section    
#aagf of the ,social ,security ,act 7#db
 ,u4,s4,c4 #acbj;d-#e7 is amended-- 7#a7
 in subsection 7a77#a71 in the matter   
preceding subparagraph 7,a71 by striking
 subsection 7b7 and inserting           
subsections 7b7 and 7d72  7#b7 by       
redesignating subsections 7d7 and 7e7 as
 subsections 7e7 and 7f72 and  7#c7 by  
inserting after subsection 7c7 the      
following new subsection3  7d7 ,special 
rules for failure ,to comply with       
security standards and requirements for 
health information  7#a7 ,in general ,in
 the case of a violation of the security
 standards and requirements under       
section #aagc7;d7 that occurs after the 
effective date of the requirements under
 paragraph 7#a77;,b7 of such section1   
the following rules shall apply3 7,a7   
,subsection 7a77#a77;,a7 shall be       
applied by substituting that is at least
 #ejj for that is at least the amount   

described in paragraph 7#c77;,a7 but not
 to exceed the amount described in      
paragraph 7#c77;,d74  7,b7 ,subsection  
7a77#a77;,b7 shall be applied by        
substituting that is at least #e1jjj for
 that is at least the amount described  
in paragraph 7#c77;,b7 but not to exceed
 the amount described in paragraph      
7#c77;,d74  7,c7 ,subsection            
7a77#a77;,c77i7 shall be applied by     
substituting that is at least #ej1jjj   
for that is at least the amount         
described in paragraph 7#c77;,c7 but not
 to exceed the amount described in      
paragraph 7#c77;,d74  7,d7 ,subsection  
7a77#a77;,c77ii7 shall be applied by    
substituting that is at least #bej1jjj  
for that is at least the amount         
described in paragraph 7#c77;,d74  7,e7 
,in addition to the factors described in
 the second sentence of subsection      
7a77#a71 in determining the amount of a 
penalty under this section for a        
violation of the security standards and 
requirements under section #aagc7;d71   

the ,secretary shall also base such     
determination on-- 7i7 the size of the  
covered entity or business associate 7as
 such terms are defined in section      
#aagc7;d77#a77;,b77vi77 subject to the  
penalty2  7ii7 the full compliance      
history of the covered entity or        
business associate2  7iii7 good faith   
efforts to comply with the security     
standards and requirements2 and  7iv7   
such other matters as the ,secretary    
determines appropriate4  7,f7           
,subsection 7a77#c7 shall not apply4    
7#b7 ,distribution of certain civil     
monetary penalties collected  7,a7 ,in  
general ,subject to the regulation      
promulgated pursuant to subparagraph    
7,b71 any civil monetary penalty or     
monetary settlement collected with      
respect to a violation of the security  
standards and requirements under section
 #aagc7;d7 that occurs after the        
effective date of such requirements     
under paragraph 7#a77;,b7 of such       
section shall be transferred to the     

,office for ,civil ,rights of the       
,department of ,health and ,human       
,services to be used for the purposes of
 enforcing the provisions of this part  
and subparts ,c and ,e of part #afd of  
title #de1 ,code of ,federal            
,regulations 7or any successor          
regulation74  7,b7 ,establishment of    
methodology to distribute percentage of 
,c,m,ps collected to harmed individuals 
,not later than #ah months after the    
date of the enactment of this           
subparagraph1 the ,secretary shall      
establish by regulation a methodology   
under which an individual who is harmed 
by an act that constitutes a violation  
referred to in subparagraph 7,a7 may    
receive a percentage of any civil       
monetary penalty or monetary settlement 
collected with respect to such          
violation4  7,c7 ,application of        
methodology ,the methodology under      
subparagraph 7,b7 shall be applied to   
any civil monetary penalty or monetary  
settlement collected with respect to a  

violation of the security standards and 
requirements under section #aagc7;d7    
that occurs after the effective date of 
such requirements under paragraph       
7#a77;,b7 of such section4  4  7b7      
,striking amendment to the ,health      
,information ,technology for ,economic  
and ,clinical ,health ,act related to   
fines and audits  7#a7 ,in general ,part
 #a of subtitle ,d of the ,health       
,information ,technology for ,economic  
and ,clinical ,health ,act 7#db         
,u4,s4,c4 #agica et seq471 as amended by
 ,public ,law #aaf-cba1 is amended by   
striking section #acdab4  7#b7          
,effective date ,the amendment made by  
this subsection shall take effect on the
 date of enactment of this ,act1 and    
apply to determinations made on or after
 such date4  #ajd4 ,user fee to support 
data security oversight and enforcement 
activities ,section #aagc7;d7 of the    
,social ,security ,act 7#db ,u4,s4,c4   
#acbj;d-#b7;d771 as amended by section  
#ajb1 is amended by adding at the end   

the following new paragraph3  7#g7 ,user
 fee to support data security oversight 
and enforcement activities  7,a7 ,in    
general ,each covered entity and        
business associate shall pay the fee    
established by the ,secretary under     
subparagraph 7,b74  7,b7 ,authorization 
,the ,secretary is authorized to charge 
a fee to each covered entity and        
business associate that is equal to the 
pro rata share of the entity or         
associate 7equal to the ratio1 as       
estimated by the ,secretary1 of the     
revenue of the entity or associate for  
the preceding fiscal year to national   
health expenditures1 as determined by   
the ,secretary1 for the preceding fiscal
 year7 of the aggregate amount of fees  
which the ,secretary is directed to     
collect in a fiscal year4 ,any amounts  
collected shall be available without    
further appropriation to the ,secretary 
for the purpose of carrying out         
oversight and enforcement activities    
under this subsection4  7,c7 ,limitation

 ,in any fiscal year 7beginning with    
fiscal year #bjbh7 the fees collected by
 the ,secretary under subparagraph 7,b7 
shall not exceed the lesser of-- 7i7 the
 estimated costs to be incurred by the  
,secretary in the fiscal year in        
carrying out oversight and enforcement  
activities under this subsection2 or    
7ii7 7,i7 in fiscal year #bjbh1         
#dj1jjj1jjj2  7,,ii7 in fiscal year     
#bjbi1 #ej1jjj1jjj2 and  7,,iii7 in     
fiscal year #bjcj or a subsequent fiscal
 year1 the amount determined under this 
clause for the preceding fiscal year1   
increased by the percentage increase in 
the consumer price index for all urban  
consumers 7all items2 ,united ,states   
city average7 over the previous year4  4
  ,,ii ,medicare ,assistance to address 
cybersecurity incidents  #bja4 ,medicare
 safe cybersecurity practices adoption  
program for eligible hospitals and      
critical access hospitals  7a7          
,incentive payments ,section #ahhf of   
the ,social ,security ,act 7#db         

,u4,s4,c4 #acieww7 is amended by adding 
at the end the following new subsection3
  7u7 ,incentives for adoption of       
essential and enhanced cybersecurity    
practices  7#a7 ,investment  7,a7       
,fiscal years #bjbi and #bjcj ,for      
fiscal years #bjbi and #bjcj1 upon      
request1 a critical access hospital or  
an eligible high-needs hospital shall be
 paid from the ,federal ,hospital       
,insurance ,trust ,fund established     
under section #ahag a proportional share
 7as determined by the ,secretary7 of   
#hjj1jjj1jjj to adopt essential         
cybersecurity practices4  7,b7 ,fiscal  
years #bjca and #bjcb ,for fiscal years 
#bjca and #bjcb1 upon request1 a        
critical access hospital or an eligible 
hospital shall be paid from the ,federal
 ,hospital ,insurance ,trust ,fund      
established under section #ahag a       
proportional share 7as determined by the
 ,secretary7 of #ejj1jjj1jjj to adopt   
enhanced cybersecurity practices4  7,c7 
,form of payment ,a payment under this  

subsection may be in the form of a      
single consolidated payment or in the   
form of such periodic installments as   
the ,secretary may specify4  7#b7       
,adoption  7,a7 ,essential cybersecurity
 practices ,beginning in fiscal year    
#bjca for an eligible hospital1 and in  
calendar year #bjca for a critical      
access hospital1 such hospital or       
critical access hospital shall be       
treated as an adopter of essential      
cybersecurity practices for a payment   
year if such hospital or critical access
 hospital submits information to the    
,secretary1 in a form and manner        
specified by the ,secretary1 and in     
addition to the information required by 
subsection 7n77#c77;,a77iii71 attesting 
to implementation of essential          
cybersecurity practices selected by the 
,secretary for the ,,ehr reporting      
period with respect to such year4  7,b7 
,enhanced cybersecurity practices       
,beginning in fiscal year #bjcb for an  
eligible hospital1 and in calendar year 

#bjcb for a critical access hospital1   
such hospital or critical access        
hospital shall be treated as an adopter 
of enhanced cybersecurity practices for 
a payment year if such hospital or      
critical access hospital submits        
information to the ,secretary1 in a form
 and manner specified by the ,secretary1
 and in addition to the information     
required by subsection                  
7n77#c77;,a77iii71 attesting to         
implementation of enhanced cybersecurity
 practices selected by the ,secretary   
during the ,,ehr reporting period with  
respect to such year4  7,c7             
,identification of essential            
cybersecurity practices ,beginning in   
fiscal year #bjbi1 the ,secretary shall1
 through notice and comment rulemaking1 
identify essential cybersecurity        
practices for an ,,ehr reporting period 
that address known vulnerabilities to   
data infrastructure and patient health  
information and ensure patient safety   
and continuity of patient care4  7,d7   

,identification of enhanced             
cybersecurity practices ,beginning in   
fiscal year #bjcj1 the ,secretary shall1
 through notice and comment rulemaking1 
identify enhanced cybersecurity         
practices for an ,,ehr reporting period 
that address the safe use of digital    
data1 safety and continuity of patient  
care1 advance cybersecurity resilience  
across the hospital sector1 address     
high-risk cybersecurity vulnerabilities 
7as determined by the ,secretary71 and  
ensure patient safety and continuity of 
care4  7,e7 ,updating ,the ,secretary   
may update essential and enhanced       
cybersecurity practices required under  
this subsection through notice and      
comment rulemaking as needed to reflect 
evolving cybersecurity practices4  7#c7 
,application  7,a7 ,limitations on      
review ,there shall be no administrative
 or judicial review under section #ahfi1
 section #ahgh1 or otherwise1 of-- 7i7  
the methodology and standards for       
determining payment amounts under this  

subsection and payment adjustments under
 subsection 7b77#c77;,b77xiii7 and      
section #ahad7l77#e77;,a72  7ii7 the    
methodology and standards for           
determining whether an eligible hospital
 is an essential or enhanced            
cybersecurity practices adopter under   
paragraph 7#b7 and the ,secretary's     
determination of whether to apply the   
hardship exception to an eligible       
hospital under subsection               
7b77#c77;,b77xiii77,,iii72 or  7iii7 any
 alteration by the ,secretary of the    
requirements specified in paragraph     
7#b74  7,b7 ,posting on website ,the    
,secretary shall post on the ,internet  
website of the ,centers for ,medicare   
,medicaid ,services1 in an easily       
understandable format1 the number by    
,state of eligible hospitals and        
critical access hospitals that are not  
essential or enhanced cybersecurity     
adopters as applicable for a year4  7#d7
 ,definitions ,for purposes of this     
subsection3 7,a7 ,,ehr reporting period 

,the term ,,ehr reporting period means  
the period determined by the ,secretary 
under subsection 7n77#f77;,a74  7,b7    
,eligible high-needs hospital ,the term 
eligible high-needs hospital means an   
eligible hospital that-- 7i7 is a       
subsection 7d7 ,puerto ,rico hospital   
7as defined in subsection 7d77#i77;,a772
  7ii7 is operated by the ,indian       
,health ,service or by an ,indian tribe 
or tribal organization 7as those terms  
are defined in section #d of the ,indian
 ,health ,care ,improvement ,act72      
7iii7 has a disproportionate percentage 
of ,medicare beneficiaries who are      
dually eligible for benefits under this 
title and title ,,xix across all        
subsection 7d7 hospitals in the baseline
 period 7as specified by the ,secretary7
 of at least #ge percent2  7iv7 has a   
disproportionate percentage of ,medicare
 beneficiaries who are subsidy eligible 
individuals 7as defined in section      
#ahfj;,d-#ad7;a77#c77 across all        
subsection 7d7 hospitals in the baseline

 period 7as specified by the ,secretary7
 of at least #ge percent 7as determined 
by the ,secretary under subsection      
7d77#e77;,f77vi772  7v7 is located in a 
rural area 7as defined in subsection    
7d77#b77;,d772  7vi7 is classified as a 
rural referral center under subsection  
7d77#e77;,c72  7vii7 is a sole community
 hospital 7as defined in subsection     
7d77#e77;,d77iii772  7viii7 is a        
low-volume hospital 7as defined in      
subsection 7d77#ab77;,c77i772 or  7ix7  
is a medicare-dependent1 small rural    
hospital 7as defined in subsection      
7d77#e77;,g774  7,c7 ,eligible hospital 
,the term eligible hospital has the     
meaning given that term in subsection   
7n77#f77;,b74  7,d7 ,enhanced           
cybersecurity practices ,the term       
enhanced cybersecurity practices means  
enhanced security requirements adopted  
under section                           
#aagc7;d77#a77;,b77i77,,ii7 and such    
additional practices as the ,secretary  
may select for a year that are greater  

than essential cybersecurity practices4 
7,e7 ,essential cybersecurity practices 
,the term essential cybersecurity       
practices means the minimum security    
requirements adopted under section      
#aagc7;d77#a77;,b77i77,i7 and such      
additional practices as the ,secretary  
may select for a year4  4  7b7 ,payment 
reductions for failure ,to adopt safe   
cybersecurity practices2 significant    
hardship exception  7#a7 ,hospitals     
,section #ahhf7;b77#c77;,b7 of the      
,social ,security ,act 7#db ,u4,s4,c4   
#acieww7b77#c77;,b77 is amended by      
adding at the end the following new     
clause3  7xiii7 7,i7 ,for purposes of   
clause 7i7-- 7aa7 for fiscal year #bjca1
 in the case of an eligible hospital    
that is not an adopter of the essential 
cybersecurity practices for a payment   
year 7as determined under subsection    
7u77#b77;,a77 for an ,,ehr reporting    
period for such year1 the applicable    
percentage increase otherwise applicable
 under clause 7i7 7determined without   

regard to clause 7viii7 or 7xi77 for    
such fiscal year shall be reduced 7but  
not below zero7 by #j4be percentage     
point2  7bb7 for fiscal year #bjcb1 in  
the case of an eligible hospital that is
 not an adopter of the essential        
cybersecurity practices for a payment   
year 7as determined under subsection    
7u77#b77;,a77 for an ,,ehr reporting    
period for such year-- 7,,aa7 the       
applicable percentage increase otherwise
 applicable under clause 7i7 7determined
 without regard to clause 7viii7 or     
7xi77 for such fiscal year shall be     
reduced 7but not below zero7 by #j4ej   
percentage point2 and 7,,bb7 the base   
operating ,,drg payment amount 7as      
defined in subsection 7o77#g77;,d77 for 
such hospital for each discharge in such
 fiscal year shall be reduced by #j4be  
percent2  7cc7 for fiscal year #bjcc1 in
 the case of an eligible hospital that  
is not an adopter of the enhanced       
cybersecurity practices for a payment   
year 7as determined under subsection    

7u77#b77;,b77 for an ,,ehr reporting    
period for such fiscal year-- 7,,aa7 the
 applicable percentage increase         
otherwise applicable under clause 7i7   
7determined without regard to clause    
7viii7 or 7xi77 for such fiscal year    
shall be reduced 7but not below zero7 by
 #j4ge percentage point2 and 7,,bb7 the 
base operating ,,drg payment amount 7as 
defined in subsection 7o77#g77;,d77 for 
such hospital for each discharge in such
 fiscal year shall be reduced by #j4ej  
percent2  7dd7 for fiscal year #bjcd1 in
 the case of an eligible hospital that  
is not an adopter of the enhanced       
cybersecurity practices for a payment   
year 7as determined under subsection    
7u77#b77;,b77 for an ,,ehr reporting    
period for such fiscal year-- 7,,aa7 the
 applicable percentage increase         
otherwise applicable under clause 7i7   
7determined without regard to clause    
7viii7 or 7xi77 for such fiscal year    
shall be reduced 7but not below zero7 by
 #a4j percentage point2 and 7,,bb7 the  

base operating ,,drg payment amount 7as 
defined in subsection 7o77#g77;,d77 for 
such hospital for each discharge in such
 fiscal year shall be reduced by #j4ge  
percent2 and  7ee7 for fiscal year #bjce
 and each subsequent fiscal year1 in the
 case of an eligible hospital that is   
not an adopter of the enhanced          
cybersecurity practices for a payment   
year 7as determined under subsection    
7u77#b77;,b77 for an ,,ehr reporting    
period for such fiscal year-- 7,,aa7 the
 applicable percentage increase         
otherwise applicable under clause 7i7   
7determined without regard to clause    
7viii7 or 7xi77 for such fiscal year    
shall be reduced 7but not below zero7 by
 #a4j percentage point2 and 7,,bb7 the  
base operating ,,drg payment amount 7as 
defined in subsection 7o77#g77;,d77 for 
such hospital for each discharge in such
 fiscal year shall be reduced by #a4j   
percent4  7,,ii7 ,a reduction under     
subclause 7,i7 shall apply only with    
respect to the fiscal year involved1 and

 the ,secretary shall not take into     
account such reduction in making        
payments to a hospital under this       
section in a subsequent fiscal year4    
7,,iii7 ,the ,secretary may1 on a       
case-by-case basis1 except an eligible  
hospital from the application of        
subclause 7,i7 with respect to a fiscal 
year if the ,secretary determines1      
subject to annual renewal1 that         
requiring such hospital to be an        
essential or enhanced cybersecurity     
practices adopter during such fiscal    
year would result in a significant      
hardship1 such as in the case of a      
natural disaster1 a bankruptcy1 limited 
internet connectivity1 an incident 7as  
defined in section #bbjj of the         
,homeland ,security ,act of #bjjb7 that 
significantly disrupts medicare claims  
processing1 or any other similar        
situation that the ,secretary determines
 interfered with the ability of the     
eligible hospital to meet the           
requirements4 ,an eligible hospital may 

not be granted an exemption under this  
subclause for more than #e years1 except
 in cases where the ,secretary          
determines such hospital has experienced
 an incident 7as so defined7 that       
significantly disrupts medicare claims  
processing4 ,the ,secretary shall       
establish an exception process and post 
an application for an exception on the  
,internet website of the ,centers for   
,medicare  ,medicaid ,services4 ,such   
process shall require that the          
application be submitted to the         
,secretary by not later than #f months  
after the conclusion of the ,,ehr       
reporting period for the relevant year4 
7,,iv7 ,in the case of a ,state for     
which the ,secretary has waived all or  
part of this section under the authority
 of section #aaae;,a1 nothing in this   
section shall preclude such ,state from 
implementing an adjustment similar to   
the adjustment under subclause 7,i74    
7,v7 ,in this clause1 the term eligible 
hospital has the meaning given such term

 in subsection 7u77#d74  4  7#b7        
,critical access hospitals ,section     
#ahad7l7 of the ,social ,security ,act  
7#db ,u4,s4,c4 #acie;f7l77 is amended-- 
7,a7 by redesignating paragraph 7#e7 as 
paragraph 7#f72  7,b7 by inserting after
 paragraph 7#d7 the following new       
paragraph3  7#e7 7,a7 ,subject to       
subparagraphs 7,b7 and 7,c71 for cost   
reporting periods beginning in-- 7i7    
fiscal year #bjca1 in the case of a     
critical access hospital that is not an 
essential cybersecurity practices       
adopter 7as determined under section    
#ahhf7u77#c77;,a77 for an ,,ehr         
reporting period with respect to such   
fiscal year1 the percent described in   
paragraph 7#a7 shall be reduced by #j4be
 percent2  7ii7 fiscal year #bjcb1 in   
the case of a critical access hospital  
that is not an essential cybersecurity  
practices adopter 7as determined under  
section #ahhf7u77#c77;,a77 for an ,,ehr 
reporting period with respect to such   
fiscal year1 the percent described in   

paragraph 7#a7 shall be reduced by #j4ej
 percent2  7iii7 fiscal year #bjcc1 in  
the case of a critical access hospital  
that is not an enhanced cybersecurity   
practices adopter 7as determined under  
section #ahhf7u77#c77;,b77 for a ,,ehr  
reporting period with respect to such   
fiscal year1 the percent described in   
paragraph 7#a7 shall be reduced by #j4ge
 percent2 and  7iv7 fiscal year #bjcd or
 a subsequent fiscal year1 in the case  
of a critical access hospital that is   
not an enhanced cybersecurity practices 
adopter 7as determined under section    
#ahhf7u77#c77;,b77 for a ,,ehr reporting
 period with respect to such fiscal     
year1 the percent described in paragraph
 7#a7 shall be reduced by #a percent4   
7,b7 ,the percent described in paragraph
 7#a7 shall be reduced by no more than a
 total of #a percent for a fiscal year  
as the result of the application of this
 paragraph and other sections of this   
title4  7,c7 ,the provisions of         
subclause 7,,iii7 of section            

#ahhf7;b77#c77;,b77xiii7 shall apply    
with respect to subparagraph 7,a7 for a 
critical access hospital with respect to
 a cost reporting period in the same    
manner as such subclause applies with   
respect to subclause 7,i7 of such       
section for an eligible hospital4  2 and
  7,c7 in paragraph 7#f71 as            
redesignated by subparagraph 7,a7-- 7i7 
in subparagraph 7,c71 by striking and at
 the end2  7ii7 in subparagraph 7,d71 by
 striking the period at the end and     
inserting 2 and2 and  7iii7 by adding at
 the end the following new              
subparagraphs3  7,e7 the methodology and
 standards for determining payment      
amounts for critical access hospitals   
under section #ahhf7u7 and payment      
adjustments under paragraph 7#e72  7,f7 
the methodology and standards for       
determining whether a critical access   
hospital is an essential or enhanced    
cybersecurity practices adopter under   
section #ahhf7u77#b7 and the            
,secretary's determination of whether to

 apply the hardship exception under     
subsection 7b77#c77;,b77xiii77,,iii7 to 
a critical access hospital pursuant to  
paragraph 7#e77;,c72 or  7,g7 any       
alteration by the ,secretary of the     
requirements specified in section       
#ahhf7u77#b7 with respect to a critical 
access hospital4  4  7c7 ,implementation
 funding ,in addition to any amounts    
otherwise made available1 there is      
appropriated to the ,centers for        
,medicare  ,medicaid ,services ,program 
,management ,account from the ,federal  
,hospital ,insurance ,trust ,fund under 
section #ahag of the ,social ,security  
,act 7#db ,u4,s4,c4 #acie;i71           
#dj1jjj1jjj for fiscal year #bjbg and   
#ae1jjj1jjj for each of fiscal years    
#bjbi through #bjcc1 to remain available
 until expended1 to carry out the       
amendments made by this section4  #bjb4 
,medicare accelerated and advance       
payments in response to cybersecurity   
incidents  7a7 ,part ,a ,section        
#ahae7;e77#c7 of the ,social ,security  

,act 7#db ,u4,s4,c4 #acie;g7e77#c77 is  
amended to read as follows3  7#c7 7,a7  
,subject to subsection 7f71 in the case 
of an eligible provider of services 7as 
defined in subparagraph 7,b77 that has  
an agreement in effect under section    
#ahff and that has significant cash flow
 problems resulting from operations of  
its medicare administrative contractor  
under section #ahgd;,a or from unusual  
circumstances of such provider's        
operation1 including significant        
disruption to ,medicare claims          
processing due to a cybersecurity       
incident 7as defined in subparagraph    
7,c771 the ,secretary may make available
 appropriate accelerated payments       
subject to appropriate safeguards       
against fraud1 waste1 and abuse         
determined by the ,secretary4  7,b7 ,in 
this paragraph1 the term eligible       
providers of services means-- 7i7 a     
subsection 7d7 hospital or a subsection 
7d7 ,puerto ,rico hospital 7as defined  
for purposes of section #ahhf72  7ii7 a 

hospital described in any of clauses 7i7
 through 7vi7 of section                
#ahhf7;d77#a77;,b72  7iii7 a critical   
access hospital 7as defined in section  
#ahfa7mm77#a772  7iv7 a rural emergency 
hospital 7as defined in section         
#ahfa7kkk77#b772  7v7 a skilled nursing 
facility 7as defined in section         
#ahai7;a772  7vi7 a home health agency  
7as defined in section #ahfa7o772  7vii7
 a hospice program 7as defined in       
section #ahfa7;dd77#b772  7viii7 a      
comprehensive outpatient rehabilitation 
facility 7as defined in section         
#ahfa7;cc77#b772  7ix7 a rural health   
clinic 7as defined in section           
#ahfa7;aa77#b772  7x7 a ,federally      
qualified health center 7as defined in  
section #ahfa7;aa77#d772  7xi7 an opioid
 treatment program 7as defined in       
section #ahfa7;jjj77#b772 and  7xii7 a  
community mental health center 7as      
defined in section #ahfa7;ff77#c77;,b774
  7,c7 ,in this paragraph1 the term     
cybersecurity incident has the meaning  

given the term incident in section #bbjj
 of the ,homeland ,security ,act of     
#bjjb4  7,d7 ,notwithstanding any other 
provision of law1 the ,secretary may    
implement the provisions of this        
paragraph by program instruction or     
otherwise4  4  7b7 ,part ,b ,section    
#ahce of the ,social ,security ,act 7#db
 ,u4,s4,c4 #acien7 is amended by adding 
at the end the following new subsection3
  7f7 7#a7 ,upon the request of a       
supplier 7as defined in section         
#ahfa7;d77 that is participating in the 
,medicare program under this title1 that
 is furnishing items or services under  
this part1 and that has significant cash
 flow problems resulting from operations
 of its medicare administrative         
contractor under section #ahgd;,a or    
from unusual circumstances of such      
supplier's operation1 including         
significant disruption to ,medicare     
claims processing due to a cybersecurity
 incident 7as defined in paragraph      
7#b771 the ,secretary may make available

 appropriate advance payments subject to
 appropriate safeguards against fraud1  
waste1 and abuse determined by the      
,secretary4  7#b7 ,in this paragraph1   
the term cybersecurity incident has the 
meaning given the term incident in      
section #bbjj of the ,homeland ,security
 ,act of #bjjb4  7#c7 ,notwithstanding  
any other provision of law1 the         
,secretary may implement the provisions 
of this subsection by program           
instruction or otherwise4  4  7c7       
,protection of ,trust ,funds  7#a7 ,part
 ,a ,section #ahag of the ,social       
,security ,act 7#db ,u4,s4,c4 #acie;i7  
is amended by adding at the end the     
following new subsection3  7l7 7#a7     
,beginning on the date of enactment of  
this subsection1 there shall be         
transferred from the ,general ,fund of  
the ,treasury to the ,trust ,fund an    
amount1 as estimated by the ,chief      
,actuary of the ,centers for ,medicare  
,medicaid ,services1 equal to the amount
 of accelerated payments made for items 

and services under this part4  7#b7     
,there shall be transferred from the    
,trust ,fund to the ,general ,fund of   
the ,treasury amounts equivalent to the 
sum of-- 7,a7 the amounts by which      
claims have offset 7in whole or in part7
 the amount of such payments described  
in paragraph 7#a72 and  7,b7 the amount 
of such payments that have been repaid  
7in whole or in part74  7#c7 ,amounts   
described in paragraphs 7#a7 and 7#b7   
shall be transferred from time to time  
as determined appropriate by the        
,secretary4  4  7#b7 ,part ,b ,section  
#ahdd of the ,social ,security ,act 7#db
 ,u4,s4,c4 #aciew7 is amended by adding 
at the end the following new subsection3
  7g7 7#a7 ,beginning on the date of    
enactment of this subsection1 there     
shall be transferred from the ,general  
,fund of the ,treasury to the ,trust    
,fund an amount1 as estimated by the    
,chief ,actuary of the ,centers for     
,medicare  ,medicaid ,services1 equal to
 amounts paid in advance for items and  

services under this part4  7#b7 ,there  
shall be transferred from the ,trust    
,fund to the ,general ,fund of the      
,treasury amounts equivalent to the sum 
of-- 7,a7 the amounts by which claims   
have offset 7in whole or in part7 the   
amount of such payments described in    
paragraph 7#a72 and  7,b7 the amount of 
such payments that have been repaid 7in 
whole or in part74  7#c7 ,amounts       
described in paragraphs 7#a7 and 7#b7   
shall be transferred from time to time  
as determined appropriate by the        
,secretary4  4