,,ii  #aai? ,,congress  #b;d ,session   
,s4 #eddc  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,septemb] #ag1         
#bjbf,mr4 ,w>n] 7= himself & ,mr4 ,wyd57
 introduc$ ! foll[+ bill2 :i* 0 read    
twice & ref]r$ to ! ,committee on       
,f9ance  ,a ,,bill  ,to am5d titles ,,xi
 & ,,xviii ( ! ,social ,security ,act to
 /r5g!n1 increase ov]sight (1 &         
compliance )1 security /&>ds = heal?    
in=mation1 & = o!r purposes4  #a4 ,%ort 
title2 table ( cont5ts  7a7 ,%ort title 
,?is ,act may be cit$ z ! ,heal?        
,infra/ructure ,security &              
,acc\ntability ,act ( #bjbf4  7b7 ,table
 ( cont5ts ,! table ( cont5ts = ?is ,act
 is z foll[s3 ,sec4 #a4 ,%ort title2    
table ( cont5ts4,title ,i--,/r5g!n+ &   
increas+ ov]sight (1 & compliance )1    
security /&>ds = heal? information,sec4 
#aja4 ,security requirem5ts4,sec4 #ajb4 
,security risk managem5t1 report+       
requirem5ts1 & audits = cov]$ entities &
 bus9ess associates4,sec4 #ajc4         
,increas$ civil p5alties = failure to   

comply ) security /&>ds & requirem5ts = 
heal? in=mation4,sec4 #ajd4 ,us] fee to 
support data security ov]sight &        
en=cem5t activities4,title ,,ii--,m$ic>e
 assi/ance to address cyb]security      
incid5ts#bja4 ,m$ic>e safe cyb]security 
practices adoption program = eligible   
hospitals & critical access             
hospitals4#bjb4 ,m$ic>e accel]at$ &     
advanc$ paym5ts 9 response to           
cyb]security incid5ts4  ,i ,/r5g!n+ &   
increas+ ov]sight (1 & compliance )1    
security /&>ds = heal? in=mation  #aja4 
,security requirem5ts  7a7 ,9 g5]al     
,section #aagc7;d77#a7 ( ! ,social      
,security ,act 7#db ,u4,s4,c4           
#acbj;d-#b7;d77#a77 is am5d$-- 7#a7 9   
subp>agraph 7,a71 by r$esignat+ clauses 
7i7 ?r\gh 7v7 z subclauses 7,i7 ?r\gh   
7,v7 respectively & ind5t+              
appropriately2  7#b7 by r$esignat+      
subp>agraphs 7,a7 & 7,b7 z clauses 7i7 &
 7ii7 respectively & ind5t+             
appropriately2  7#c7 by /rik+ ,security 
,/&>ds4--,! ,secret>y & ins]t+ ! foll[+3

 ,m9imum ,security ,/&>ds4-- 7,a7 ,9    
g5]al ,! ,secret>y  2  7#d7 9           
subp>agraph 7,a71 z add$ by p>agraph    
7#c7-- 7,a7 9 clause 7i77,v71 by /rik+ &
 at ! end2  7,b7 9 clause 7ii71 by /rik+
 ! p]iod at ! end & ins]t+ 2 &2 &  7,c7 
by add+ at ! end ! foll[+ new clause3   
7iii7 include m9imum & enhanc$ security 
requirem5ts adopt$ "u subp>agraph 7,b7  
2 &  7#e7 by add+ at ! end ! foll[+ new 
subp>agraph3  7,b7 ,m9imum & enhanc$    
security requirem5ts  7i7 ,adoption     
,subject to clauses 7iii7 & 7iv71 9 ord]
 to protect heal? in=mation1 protect    
pati5t safety1 & ensure ! availability &
 resili5cy ( heal? c>e in=mation sy/ems 
& heal? c>e transactions1 ! ,secret>y   
%all adopt-- 7,i7 m9imum security       
requirem5ts = cov]$ entities & bus9ess  
associates2 &  7,,ii7 enhanc$ security  
requirem5ts = cov]$ entities & bus9ess  
associates t-- 7aa7 are ( sy/emic       
importance1 z det]m9$ by ! ,secret>y2 or
  7bb7 are important to national        
security1 z det]m9$ by ! ,secret>y1 9   

consultation ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security
 ,ag5cy & ! ,director ( ,national       
,intellig5ce4  7ii7 ,application (      
enhanc$ security requirem5ts  7,i7      
,notification ,! ,secret>y %all1 at a "t
 & 9 a mann] det]m9$ appropriate by !   
,secret>y1 notify ea* cov]$ entity &    
bus9ess associate t is subject to !     
enhanc$ security requirem5ts "u clause  
7i77,,ii74  7,,ii7 ,limitation on review
 ,!re %all be no adm9i/rative or        
judicial review "u section #ahfi1 #ahgh1
 or o!rwise ( ! me?odology ! ,secret>y  
uses to det]m9e :e!r a cov]$ entity or  
bus9ess associate is subject to !       
enhanc$ security requirem5ts "u clause  
7i77,,ii74  7iii7 ,factors ,9 addition  
to ! factors describ$ 9 subp>agraph     
7,a77i71 9 develop+-- 7,i7 ! m9imum     
security requirem5ts "u clause 7i77,i71 
! ,secret>y %all1 9 consultation ) !    
,director ( ,cyb]security &             
,infra/ructure ,security ,ag5cy & !     
,director ( ,national ,intellig5ce1     

design ! requirem5ts to prev5t-- 7aa7   
cyb] incid5ts utiliz+ ! tools &         
/rategies us$ to t>get cov]$ entities or
 bus9ess associates2  7bb7 ! pot5tial   
h>ms1 z def9$ by ! ,secret>y1 to        
national security t c\ld result f a cyb]
 incid5t involv+ a cov]$ entity or      
bus9ess associate2  7cc7 ! pot5tial     
h>ms1 z def9$ by ! ,secret>y1 to pati5ts
 t c\ld result f a cyb] incid5t involv+ 
a cov]$ entity or bus9ess associate2 &  
7dd7 o!r pot5tial h>ms f cyb] incid5ts1 
z det]m9$ appropriate by ! ,secret>y2 & 
7,,ii7 ! enhanc$ security requirem5ts "u
 clause 7i77,,ii71 ! ,secret>y %all1 9  
consultation ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security
 ,ag5cy & ! ,director ( ,national       
,intellig5ce1 design ! requirem5ts to   
prev5t ! pot5tial h>ms describ$ 9       
subclause 7,i7 & protect aga9/ !        
specific ?reats ! cov]$ entities &      
bus9ess associates describ$ 9 su* clause
 face4  7iv7 ,review & update (         
requirem5ts ,! ,secret>y %all review &  

update ! m9imum & enhanc$ security      
requirem5ts adopt$ "u clause 7i7 n less 
frequ5tly ?an e #b ye>s4  7v7 ,effective
 date & rulemak+  7,i7 ,effective date  
,! requirem5ts "u ?is subp>agraph %all  
take effect on ! date t is #b ye>s aft] 
! date ( enactm5t ( ?is subp>agraph4    
7,,ii7 ,rulemak+ ,n lat] ?an #ah mon?s  
aft] ! date ( enactm5t ( ?is            
subp>agraph1 ! ,secret>y %all promulgate
 regulations to c>ry out ?is            
subp>agraph4  7vi7 ,def9itions ,=       
purposes ( ?is subsection3 7,i7 ,bus9ess
 associate ,! t]m bus9ess associate has 
! mean+ giv5 su* t]m 9 section #afj4ajc 
( title #de1 ,code ( ,f$]al ,regulations
 7or a successor regulation74  7,,ii7   
,cov]$ entity ,! t]m cov]$ entity has ! 
mean+ giv5 t t]m 9 section #afj4ajc (   
title #de1 ,code ( ,f$]al ,regulations  
7or a successor regulation74  7,,iii7   
,sy/emic importance ,! t]m sy/emic      
importance means1 ) respect to a cov]$  
entity or bus9ess associate1 t ! failure
 (1 or a disruption to1 su* entity or   

associate w\ld h a debilitat+ impact on 
access to heal? c>e or ! /ability ( !   
heal? c>e sy/em ( ! ,unit$ ,/ates 7z    
det]m9$ by ! ,secret>y74  4  7b7        
,availability ( heal? in=mation ,section
 #aagc7;d77#b77;,a7 ( ! ,social         
,security ,act 7#db ,u4,s4,c4           
#acbj;d-#b7;d77#b77;,a77 is am5d$ by    
/rik+ ! integrity & confid5tiality &    
ins]t+ 8! availability1 integrity1 &    
confid5tiality4  #ajb4 ,security risk   
managem5t1 report+ requirem5ts1 & audits
 = cov]$ entities & bus9ess associates  
7a7 ,security risk managem5t & report+  
,section #aagc7;d7 ( ! ,social ,security
 ,act 7#db ,u4,s4,c4 #acbj;d-#b7;d77 is 
am5d$ by add+ at ! end ! foll[+ new     
p>agraph3  7#c7 ,security risk managem5t
 & report+  7,a7 ,9 g5]al ,ea* cov]$    
entity & bus9ess associate %all at a    
m9imum1 on an annual basis-- 7i7 conduct
 & docum5t a security risk analysis1    
includ+ in=mation reg>d+ ! mann] & ext5t
 to :i* su* entity or associate is      
expos$ to risk ?r\gh its bus9ess        

associates2  7ii7 docum5t a plan = a    
rapid & ord]ly resolution 9 ! ev5t ( a  
natural disa/]1 disruptive cyb] incid5t1
 or o!r te*nological failure to its     
in=mation sy/ems or ^? ( its bus9ess    
associates2  7iii7 conduct a /ress te/  
to evaluate :e!r su* entity or associate
 has ! capabilities & plann+ necess>y to
 recov] ess5tial functions1 su* z pati5t
 c>e op]ations & transactions describ$ 9
 subsection 7a77#b71 foll[+ a cyb]      
incid5t1 a natural disa/]1 or o!r       
sub/antial ?reat to heal? c>e op]ations1
 z det]m9$ by ! ,secret>y2  7iv7 docum5t
 :e!r1 bas$ ^u ! results ( ! /ress te/  
describ$ 9 clause 7iii71 ! cov]$ entity 
or bus9ess associate revis$ ! mo/ rec5t 
plan describ$ 9 clause 7ii72  7v7       
provide a writt5 /atem5t sign$ by ! *ief
 executive (fic] & *ief in=mation       
security (fic] 7or equival5t !re(7 /at+ 
t ! cov]$ entity or bus9ess associate is
 9 compliance ) security requirem5ts    
adopt$ "u "p #afj ( title #de1 ,code (  
,f$]al ,regulations1 & subp>ts ,a & ,c (

 "p #afd ( title #de1 ,code ( ,f$]al    
,regulations 7or a successor            
regulation71 includ+ ! applicable       
security requirem5ts adopt$ "u p>agraph 
7#a77;,b72 &  7vi7 publi% on a publicly 
accessible website-- 7,i7 :e!r ! cov]$  
entity or bus9ess associate has receiv$ 
a notification f ! ,secret>y pursuant to
 p>agraph 7#a77;,b77ii77,i72  7,,ii7    
:e!r ! cov]$ entity or bus9ess associate
 meets ! m9imum security requirem5ts &1 
if applicable1 ! enhanc$ security       
requirem5ts "u p>agraph 7#a77;,b72 &    
7,,iii7 a copy ( ea* /atem5t provid$ "u 
clause 7v7 ) respect to ea* ye> 9 a     
ma*9e-readable =mat4  7,b7 ,/ress te/   
me?odology ,! ,secret>y %all provide = n
 less ?an #b diff]5t sets ( conditions  
"u :i* ! te/ describ$ 9 subp>agraph     
7,a77iii7 is to be conduct$4  7,c7      
,waiv] au?ority ,! ,secret>y may waive !
 requirem5ts ( ?is p>agraph ) respect to
 a cov]$ entity or bus9ess associate if 
! burd5 on ! entity or associate        
significantly outweighs ! b5efits1 tak+ 

into acc\nt ! rev5ue ( ! entity or      
associate1 ! volume ( protect$ heal?    
in=mation or heal? c>e transactions     
process$ by ! entity or associate1 & su*
 o!r factors z ! ,secret>y det]m9es     
appropriate4  7,d7 ,report+  7i7 ,9     
g5]al ,subject to clause 7ii71 ea* cov]$
 entity & bus9ess associate %all submit 
! docum5tation requir$ "u subp>agraph   
7,a7 at su* "t1 9 su* =m1 & conta9+ su* 
in=mation z ! ,secret>y may require4    
7ii7 ,annual report+ = cov]$ entities & 
bus9ess associates subject to enhanc$   
security requirem5ts ,ea* cov]$ entity &
 bus9ess associate t is subject to      
enhanc$ security requirem5ts %all submit
 ! docum5tation requir$ "u subp>agraph  
7,a7 to ! ,secret>y n less frequ5tly ?an
 on an annual basis4  7,e7 ,def9itions  
,= purposes ( ?is subsection3 7i7 ,cyb] 
incid5t ,! t]m cyb] incid5t has ! mean+ 
giv5 ! t]m incid5t 9 section #bbjj7ab7 (
 ! ,homel& ,security ,act ( #bjjb 7#f   
,u4,s4,c4 #fej7ab774  7ii7              
,ma*9e-readable ,! t]m ma*9e-readable   

has ! mean+ giv5 su* t]m 9 section #cejb
 ( title #dd1 ,unit$ ,/ates ,code4      
7iii7 ,/ress te/ ,! t]m /ress te/ means 
an ext5sive real-_w simulation int5d$ to
 te/ ! op]ational resili5ce ( ! heal?   
c>e op]ations ( a cov]$ entity or       
bus9ess associate 9 response to a       
sub/antial int]ruption 9 in=mation      
sy/ems1 includ+ ! ability to-- 7,i7     
cont9ue to provide ess5tial c>e &       
s]vices dur+ & 9 ! recov]y p]iod f su*  
sub/antial int]ruption2 &  7,,ii7 timely
 rebuild ! in=mation sy/ems 7z def9$ 9  
section #bbjj7ad7 ( ! ,homel& ,security 
,act ( #bjjb 7#f ,u4,s4,c4 #fej7ad777 ( 
su* cov]$ entity or bus9ess associate4  
7,f7 ,effective date ,! requirem5ts "u  
?is p>agraph %all take effect on ! date 
t is #c ye>s aft] ! date ( enactm5t (   
?is p>agraph4  4  7b7 ,indep5d5t        
security compliance audits ,section     
#aagc7;d7 ( ! ,social ,security ,act    
7#db ,u4,s4,c4 #acbj;d-#b7;d771 z am5d$ 
by subsection 7a71 is am5d$ by add+ at !
 end ! foll[+ new p>agraph3  7#d7       

,indep5d5t security compliance audits   
7,a7 ,9 g5]al ,ea* cov]$ entity &       
bus9ess associate %all-- 7i7 contract ) 
an indep5d5t auditor t meets su*        
requirem5ts = indep5d5ce & te*nical     
exp]tise z ! ,inspector ,g5]al ( !      
,dep>tm5t ( ,heal? & ,human ,s]vices may
 e/abli% to conduct an annual audit 9   
accordance ) subp>agraph 7,b72 &  7ii7  
docum5t ! f9d+s ( ea* audit conduct$ "u 
clause 7i74  7,b7 ,audit requirem5ts ,an
 audit conduct$ "u subp>agraph 7,a77i7  
%all-- 7i7 assess compliance ( ! cov]$  
entity or bus9ess associate )-- 7,i7    
dur+ ! p]iod prior to ! effective date (
 ! requirem5ts "u p>agraph 7#a77;,b71 ! 
,heal?c>e & ,public ,heal? ,sector      
,cyb]security ,p]=mance ,goals z        
describ$ 9 ! report publi%$ by !        
,dep>tm5t ( ,heal? & ,human ,s]vices z (
 ! date ( enactm5t ( ?is p>agraph1 &    
titl$ ,heal?c>e & ,public ,heal?        
,sector-,specific ,cyb]security         
,p]=mance ,goals3 ,/r5g!n+ !            
,cyb]security ( ! ,heal?c>e ,sector &   

,keep+ ,pati5ts ,safe & ,secure2 &      
7,,ii7 on or aft] ! effective date ( !  
requirem5ts "u p>agraph 7#a77;,b71 !    
m9imum & enhanc$ security requirem5ts   
adopt$ "u su* p>agraph1 z applicable2   
7ii7 id5tify any areas 9 :i* ! cov]$    
entity or bus9ess associate did n meet  
su* goals or requirem5ts1 z applicable2 
&  7iii7 c]tify t ! cov]$ entity or     
bus9ess associate-- 7,i7 has resolv$ any
 areas ( noncompliance2 or  7,,ii7 is   
implem5t+ an appropriate plan to resolve
 su* areas ( noncompliance 9 a timely   
mann]4  7,c7 ,waiv] au?ority ,!         
,secret>y may waive ! requirem5ts ( ?is 
p>agraph ) respect to a cov]$ entity or 
bus9ess associate if ! burd5 on ! entity
 or associate significantly outweighs ! 
b5efits1 tak+ into acc\nt ! rev5ue ( !  
entity or associate1 ! volume ( protect$
 heal? in=mation or heal? c>e           
transactions process$ by ! entity or    
associate1 & su* z o!r factors z !      
,secret>y det]m9es appropriate4  7,d7   
,report+  7i7 ,9 g5]al ,subject to      

clause 7ii71 ea* cov]$ entity & bus9ess 
associate %all submit ! docum5tation    
requir$ "u subp>agraph 7,a77ii7 at su*  
"t1 9 su* =m1 & conta9+ su* in=mation z 
! ,secret>y may require4  7ii7 ,annual  
report+ = entities & associates subject 
to enhanc$ security requirem5ts ,ea*    
cov]$ entity & bus9ess associate t is   
subject to enhanc$ security requirem5ts 
%all submit ! docum5tation requir$ "u   
subp>agraph 7,a77ii7 to ! ,secret>y n   
less frequ5tly ?an on an annual basis4  
7,e7 ,effective date ,! requirem5ts "u  
?is p>agraph %all take effect on ! date 
t is #ahj days aft] ! date ( enactm5t ( 
?is p>agraph4  4  7c7 ,secret>ial audits
 ( data security practices ,section     
#aagc7;d7 ( ! ,social ,security ,act    
7#db ,u4,s4,c4 #acbj;d-#b7;d771 z am5d$ 
by subsections 7a7 & 7b71 is am5d$ by   
add+ at ! end ! foll[+ new p>agraph3    
7#e7 ,secret>ial audits ( data security 
practices  7,a7 ,9 g5]al ,ea* ye>       
7beg9n+ on or aft] ! date t is #d ye>s  
aft] ! date ( enactm5t ( ?is p>agraph7 !

 ,secret>y %all conduct an annual audit 
( ! data security practices ( at lea/   
#bj cov]$ entities or bus9ess associates
 "u ?is "p4 ,! ,comptroll] ,g5]al ( !   
,unit$ ,/ates %all monitor audit+       
activities conduct$ "u ?is p>agraph4    
7,b7 ,consid]ations ,9 select+ cov]$    
entities or bus9ess associates = audit  
"u subp>agraph 7,a7 ! ,secret>y %all    
consid]-- 7i7 :e!r ! cov]$ entity or    
bus9ess associate is ( sy/emic          
importance2  7ii7 :e!r any compla9ts h  
be5 made ) respect to ! data security   
practices ( ! cov]$ entity or bus9ess   
associate2 &  7iii7 :e!r ! cov]$ entity 
or bus9ess associate has a hi/ory (     
previ\s violations4  7,c7 ,corrective   
action plan & p5alties ,! f9d+s ( an    
audit "u ?is p>agraph may result 9 a    
civil money p5alty bas$ on ! failure ( a
 cov]$ entity or bus9ess associate to   
submit docum5tation demon/rat+ t ! cov]$
 entity or bus9ess associate has tak5   
corrective actions to a*ieve compliance 
9 response to a f9d+ ( a pot5tial       

violation ( a provision ( ?is "p )9 a   
p]iod ( "t specifi$ by ! ,secret>y aft] 
receipt ( su* f9d+s4  7,d7 ,reports to  
,congress ,! ,secret>y %all submit to   
,congress reports summ>iz+ ! results ( !
 audits conduct$ "u ?is p>agraph        
bi5nially end+ on ! date t is #aj ye>s  
aft] ! date on :i* ! fir/ report is     
submitt$ "u ?is subp>agraph4  4  7d7    
,civil & crim9al p5alties = failure ,to 
comply ) docum5tation1 report+1 & audit 
requirem5ts ,section #aagc7;d7 ( !      
,social ,security ,act 7#db ,u4,s4,c4   
#acbj;d-#b7;d771 z am5d$ by subsections 
7a71 7b71 & 7c71 is am5d$ by add+ at !  
end ! foll[+ new p>agraph3  7#f7 ,civil 
& crim9al p5alties = failure to comply )
 docum5tation1 report+1 & audit         
requirem5ts  7,a7 ,civil p5alties  7i7  
,9 g5]al ,a cov]$ entity or bus9ess     
associate t-- 7,i7 fails to timely      
submit docum5tation or a report requir$ 
"u p>agraph 7#c71 7#d71 or 7#e72  7,,ii7
 fails to comply ) an audit "u p>agraph 
7#e72 or  7,,iii7 fails to comply ) a   

responsibility ( a cov]$ entity or a    
bus9ess associate "u section #afj4caj ( 
title #de1 ,code ( ,f$]al ,regulations  
7or a successor regulation72  %all be   
subject to a civil money p5alty ( n m   
?an #e1jjj p] day = ea* su* failure4    
7ii7 ,proc$ures ,! provisions ( section 
#aabh;,a 7o!r ?an subsections 7a71 7b71 
& 7d77#a71 & ! second s5t5ce (          
subsection 7f77 %all apply to !         
imposition ( a civil money p5alty "u ?is
 subp>agraph 9 ! same mann] z su*       
provisions apply to ! imposition ( a    
p5alty "u su* section #aabh;,a4  7iii7  
,cl>ification ,any civil money p5alty "u
 ?is subp>agraph ) respect to a failure 
describ$ 9 clause 7i7 %all be 9 lieu ( !
 p5alties describ$ 9 section #aagf4     
7,b7 ,crim9al p5alties ,9 addition to   
any p5alties impos$ "u subp>agraph 7,a71
 :oev] submits1 or causes to be         
submitt$1 any docum5tation or report    
requir$ ( a cov]$ entity or bus9ess     
associate "u p>agraph 7#c71 7#d71 or    
7#e7 kn[+ t su* docum5tation or report  

conta9s false in=mation1 or willfully   
fails to timely submit1 or willfully    
causes to n be timely submitt$1 su* a   
docum5t or report1 %all be guilty ( a   
felony & ^u conviction !re( f9$ n m ?an 
#a1jjj1jjj or imprison$ = n m ?an #aj   
ye>s1 or bo?4  4  #ajc4 ,increas$ civil 
p5alties = failure to comply ) security 
/&>ds & requirem5ts = heal? in=mation   
7a7 ,increas$ civil p5alties ,section   
#aagf ( ! ,social ,security ,act 7#db   
,u4,s4,c4 #acbj;d-#e7 is am5d$-- 7#a7 9 
subsection 7a77#a71 9 ! matt] prec$+    
subp>agraph 7,a71 by /rik+ subsection   
7b7 & ins]t+ subsections 7b7 & 7d72     
7#b7 by r$esignat+ subsections 7d7 & 7e7
 z subsections 7e7 & 7f72 &  7#c7 by    
ins]t+ aft] subsection 7c7 ! foll[+ new 
subsection3  7d7 ,special rules =       
failure ,to comply ) security /&>ds &   
requirem5ts = heal? in=mation  7#a7 ,9  
g5]al ,9 ! case ( a violation ( !       
security /&>ds & requirem5ts "u section 
#aagc7;d7 t occurs aft] ! effective date
 ( ! requirem5ts "u p>agraph 7#a77;,b7 (

 su* section1 ! foll[+ rules %all apply3
 7,a7 ,subsection 7a77#a77;,a7 %all be  
appli$ by sub/itut+ t is at lea/ #ejj = 
t is at lea/ ! am\nt describ$ 9 p>agraph
 7#c77;,a7 b n to exce$ ! am\nt describ$
 9 p>agraph 7#c77;,d74  7,b7 ,subsection
 7a77#a77;,b7 %all be appli$ by         
sub/itut+ t is at lea/ #e1jjj = t is at 
lea/ ! am\nt describ$ 9 p>agraph        
7#c77;,b7 b n to exce$ ! am\nt describ$ 
9 p>agraph 7#c77;,d74  7,c7 ,subsection 
7a77#a77;,c77i7 %all be appli$ by       
sub/itut+ t is at lea/ #ej1jjj = t is at
 lea/ ! am\nt describ$ 9 p>agraph       
7#c77;,c7 b n to exce$ ! am\nt describ$ 
9 p>agraph 7#c77;,d74  7,d7 ,subsection 
7a77#a77;,c77ii7 %all be appli$ by      
sub/itut+ t is at lea/ #bej1jjj = t is  
at lea/ ! am\nt describ$ 9 p>agraph     
7#c77;,d74  7,e7 ,9 addition to !       
factors describ$ 9 ! second s5t5ce (    
subsection 7a77#a71 9 det]m9+ ! am\nt ( 
a p5alty "u ?is section = a violation ( 
! security /&>ds & requirem5ts "u       
section #aagc7;d71 ! ,secret>y %all also

 base su* det]m9ation on-- 7i7 ! size ( 
! cov]$ entity or bus9ess associate 7z  
su* t]ms are def9$ 9 section            
#aagc7;d77#a77;,b77vi77 subject to !    
p5alty2  7ii7 ! full compliance hi/ory (
 ! cov]$ entity or bus9ess associate2   
7iii7 good fai? ef=ts to comply ) !     
security /&>ds & requirem5ts2 &  7iv7   
su* o!r matt]s z ! ,secret>y det]m9es   
appropriate4  7,f7 ,subsection 7a77#c7  
%all n apply4  7#b7 ,di/ribution ( c]ta9
 civil monet>y p5alties collect$  7,a7  
,9 g5]al ,subject to ! regulation       
promulgat$ pursuant to subp>agraph 7,b71
 any civil monet>y p5alty or monet>y    
settlem5t collect$ ) respect to a       
violation ( ! security /&>ds &          
requirem5ts "u section #aagc7;d7 t      
occurs aft] ! effective date ( su*      
requirem5ts "u p>agraph 7#a77;,b7 ( su* 
section %all be transf]r$ to ! ,(fice = 
,civil ,rights ( ! ,dep>tm5t ( ,heal? & 
,human ,s]vices to be us$ = ! purposes (
 en=c+ ! provisions ( ?is "p & subp>ts  
,c & ,e ( "p #afd ( title #de1 ,code (  

,f$]al ,regulations 7or any successor   
regulation74  7,b7 ,e/abli%m5t (        
me?odology to di/ribute p]c5tage (      
,c,m,ps collect$ to h>m$ individuals ,n 
lat] ?an #ah mon?s aft] ! date ( !      
enactm5t ( ?is subp>agraph1 ! ,secret>y 
%all e/abli% by regulation a me?odology 
"u :i* an individual :o is h>m$ by an   
act t con/itutes a violation ref]r$ to 9
 subp>agraph 7,a7 may receive a p]c5tage
 ( any civil monet>y p5alty or monet>y  
settlem5t collect$ ) respect to su*     
violation4  7,c7 ,application (         
me?odology ,! me?odology "u subp>agraph 
7,b7 %all be appli$ to any civil monet>y
 p5alty or monet>y settlem5t collect$ ) 
respect to a violation ( ! security     
/&>ds & requirem5ts "u section #aagc7;d7
 t occurs aft] ! effective date ( su*   
requirem5ts "u p>agraph 7#a77;,b7 ( su* 
section4  4  7b7 ,/rik+ am5dm5t to !    
,heal? ,in=mation ,te*nology = ,economic
 & ,cl9ical ,heal? ,act relat$ to f9es &
 audits  7#a7 ,9 g5]al ,"p #a ( subtitle
 ,d ( ! ,heal? ,in=mation ,te*nology =  

,economic & ,cl9ical ,heal? ,act 7#db   
,u4,s4,c4 #agica et seq471 z am5d$ by   
,public ,law #aaf-cba1 is am5d$ by /rik+
 section #acdab4  7#b7 ,effective date  
,! am5dm5t made by ?is subsection %all  
take effect on ! date ( enactm5t ( ?is  
,act1 & apply to det]m9ations made on or
 aft] su* date4  #ajd4 ,us] fee to      
support data security ov]sight &        
en=cem5t activities ,section #aagc7;d7 (
 ! ,social ,security ,act 7#db ,u4,s4,c4
 #acbj;d-#b7;d771 z am5d$ by section    
#ajb1 is am5d$ by add+ at ! end ! foll[+
 new p>agraph3  7#g7 ,us] fee to support
 data security ov]sight & en=cem5t      
activities  7,a7 ,9 g5]al ,ea* cov]$    
entity & bus9ess associate %all pay !   
fee e/abli%$ by ! ,secret>y "u          
subp>agraph 7,b74  7,b7 ,au?orization ,!
 ,secret>y is au?oriz$ to *>ge a fee to 
ea* cov]$ entity & bus9ess associate t  
is equal to ! pro rata %>e ( ! entity or
 associate 7equal to ! ratio1 z e/imat$ 
by ! ,secret>y1 ( ! rev5ue ( ! entity or
 associate = ! prec$+ fiscal ye> to     

national heal? exp5ditures1 z det]m9$ by
 ! ,secret>y1 = ! prec$+ fiscal ye>7 ( !
 aggregate am\nt ( fees :i* ! ,secret>y 
is direct$ to collect 9 a fiscal ye>4   
,any am\nts collect$ %all be available  
)\t fur!r appropriation to ! ,secret>y =
 ! purpose ( c>ry+ out ov]sight &       
en=cem5t activities "u ?is subsection4  
7,c7 ,limitation ,9 any fiscal ye>      
7beg9n+ ) fiscal ye> #bjbh7 ! fees      
collect$ by ! ,secret>y "u subp>agraph  
7,b7 %all n exce$ ! less] (-- 7i7 !     
e/imat$ co/s to be incurr$ by !         
,secret>y 9 ! fiscal ye> 9 c>ry+ out    
ov]sight & en=cem5t activities "u ?is   
subsection2 or  7ii7 7,i7 9 fiscal ye>  
#bjbh1 #dj1jjj1jjj2  7,,ii7 9 fiscal ye>
 #bjbi1 #ej1jjj1jjj2 &  7,,iii7 9 fiscal
 ye> #bjcj or a subsequ5t fiscal ye>1 ! 
am\nt det]m9$ "u ?is clause = ! prec$+  
fiscal ye>1 increas$ by ! p]c5tage      
increase 9 ! consum] price index = all  
urban consum]s 7all items2 ,unit$ ,/ates
 city av]age7 ov] ! previ\s ye>4  4     
,,ii ,m$ic>e ,assi/ance to address      

cyb]security incid5ts  #bja4 ,m$ic>e    
safe cyb]security practices adoption    
program = eligible hospitals & critical 
access hospitals  7a7 ,inc5tive paym5ts 
,section #ahhf ( ! ,social ,security    
,act 7#db ,u4,s4,c4 #acieww7 is am5d$ by
 add+ at ! end ! foll[+ new subsection3 
7u7 ,inc5tives = adoption ( ess5tial &  
enhanc$ cyb]security practices  7#a7    
,inve/m5t  7,a7 ,fiscal ye>s #bjbi &    
#bjcj ,= fiscal ye>s #bjbi & #bjcj1 ^u  
reque/1 a critical access hospital or an
 eligible high-ne$s hospital %all be    
paid f ! ,f$]al ,hospital ,insurance    
,tru/ ,fund e/abli%$ "u section #ahag a 
proportional %>e 7z det]m9$ by !        
,secret>y7 ( #hjj1jjj1jjj to adopt      
ess5tial cyb]security practices4  7,b7  
,fiscal ye>s #bjca & #bjcb ,= fiscal    
ye>s #bjca & #bjcb1 ^u reque/1 a        
critical access hospital or an eligible 
hospital %all be paid f ! ,f$]al        
,hospital ,insurance ,tru/ ,fund        
e/abli%$ "u section #ahag a proportional
 %>e 7z det]m9$ by ! ,secret>y7 (       

#ejj1jjj1jjj to adopt enhanc$           
cyb]security practices4  7,c7 ,=m (     
paym5t ,a paym5t "u ?is subsection may  
be 9 ! =m ( a s+le consolidat$ paym5t or
 9 ! =m ( su* p]iodic in/allm5ts z !    
,secret>y may specify4  7#b7 ,adoption  
7,a7 ,ess5tial cyb]security practices   
,beg9n+ 9 fiscal ye> #bjca = an eligible
 hospital1 & 9 cal5d> ye> #bjca = a     
critical access hospital1 su* hospital  
or critical access hospital %all be     
treat$ z an adopt] ( ess5tial           
cyb]security practices = a paym5t ye> if
 su* hospital or critical access        
hospital submits in=mation to !         
,secret>y1 9 a =m & mann] specifi$ by ! 
,secret>y1 & 9 addition to ! in=mation  
requir$ by subsection 7n77#c77;,a77iii71
 atte/+ to implem5tation ( ess5tial     
cyb]security practices select$ by !     
,secret>y = ! ,,ehr report+ p]iod )     
respect to su* ye>4  7,b7 ,enhanc$      
cyb]security practices ,beg9n+ 9 fiscal 
ye> #bjcb = an eligible hospital1 & 9   
cal5d> ye> #bjcb = a critical access    

hospital1 su* hospital or critical      
access hospital %all be treat$ z an     
adopt] ( enhanc$ cyb]security practices 
= a paym5t ye> if su* hospital or       
critical access hospital submits        
in=mation to ! ,secret>y1 9 a =m & mann]
 specifi$ by ! ,secret>y1 & 9 addition  
to ! in=mation requir$ by subsection    
7n77#c77;,a77iii71 atte/+ to            
implem5tation ( enhanc$ cyb]security    
practices select$ by ! ,secret>y dur+ ! 
,,ehr report+ p]iod ) respect to su*    
ye>4  7,c7 ,id5tification ( ess5tial    
cyb]security practices ,beg9n+ 9 fiscal 
ye> #bjbi1 ! ,secret>y %all1 ?r\gh      
notice & comm5t rulemak+1 id5tify       
ess5tial cyb]security practices = an    
,,ehr report+ p]iod t address kn[n      
vuln]abilities to data infra/ructure &  
pati5t heal? in=mation & ensure pati5t  
safety & cont9uity ( pati5t c>e4  7,d7  
,id5tification ( enhanc$ cyb]security   
practices ,beg9n+ 9 fiscal ye> #bjcj1 ! 
,secret>y %all1 ?r\gh notice & comm5t   
rulemak+1 id5tify enhanc$ cyb]security  

practices = an ,,ehr report+ p]iod t    
address ! safe use ( digital data1      
safety & cont9uity ( pati5t c>e1 advance
 cyb]security resili5ce across !        
hospital sector1 address high-risk      
cyb]security vuln]abilities 7z det]m9$  
by ! ,secret>y71 & ensure pati5t safety 
& cont9uity ( c>e4  7,e7 ,updat+ ,!     
,secret>y may update ess5tial & enhanc$ 
cyb]security practices requir$ "u ?is   
subsection ?r\gh notice & comm5t        
rulemak+ z ne$$ to reflect evolv+       
cyb]security practices4  7#c7           
,application  7,a7 ,limitations on      
review ,!re %all be no adm9i/rative or  
judicial review "u section #ahfi1       
section #ahgh1 or o!rwise1 (-- 7i7 !    
me?odology & /&>ds = det]m9+ paym5t     
am\nts "u ?is subsection & paym5t       
adju/m5ts "u subsection                 
7b77#c77;,b77xiii7 & section            
#ahad7l77#e77;,a72  7ii7 ! me?odology & 
/&>ds = det]m9+ :e!r an eligible        
hospital is an ess5tial or enhanc$      
cyb]security practices adopt] "u        

p>agraph 7#b7 & ! ,secret>y's           
det]m9ation ( :e!r to apply ! h>d%ip    
exception to an eligible hospital "u    
subsection 7b77#c77;,b77xiii77,,iii72 or
  7iii7 any alt]ation by ! ,secret>y ( !
 requirem5ts specifi$ 9 p>agraph 7#b74  
7,b7 ,po/+ on website ,! ,secret>y %all 
po/ on ! ,int]net website ( ! ,c5t]s =  
,m$ic>e  ,m$icaid ,s]vices1 9 an easily 
und]/&able =mat1 ! numb] by ,/ate (     
eligible hospitals & critical access    
hospitals t are n ess5tial or enhanc$   
cyb]security adopt]s z applicable = a   
ye>4  7#d7 ,def9itions ,= purposes ( ?is
 subsection3 7,a7 ,,ehr report+ p]iod ,!
 t]m ,,ehr report+ p]iod means ! p]iod  
det]m9$ by ! ,secret>y "u subsection    
7n77#f77;,a74  7,b7 ,eligible high-ne$s 
hospital ,! t]m eligible high-ne$s      
hospital means an eligible hospital t-- 
7i7 is a subsection 7d7 ,pu]to ,rico    
hospital 7z def9$ 9 subsection          
7d77#i77;,a772  7ii7 is op]at$ by !     
,indian ,heal? ,s]vice or by an ,indian 
tribe or tribal organization 7z ^? t]ms 

are def9$ 9 section #d ( ! ,indian      
,heal? ,c>e ,improvem5t ,act72  7iii7   
has a disproportionate p]c5tage (       
,m$ic>e b5efici>ies :o are dually       
eligible = b5efits "u ?is title & title 
,,xix across all subsection 7d7         
hospitals 9 ! basel9e p]iod 7z specifi$ 
by ! ,secret>y7 ( at lea/ #ge p]c5t2    
7iv7 has a disproportionate p]c5tage (  
,m$ic>e b5efici>ies :o are subsidy      
eligible individuals 7z def9$ 9 section 
#ahfj;,d-#ad7;a77#c77 across all        
subsection 7d7 hospitals 9 ! basel9e    
p]iod 7z specifi$ by ! ,secret>y7 ( at  
lea/ #ge p]c5t 7z det]m9$ by ! ,secret>y
 "u subsection 7d77#e77;,f77vi772  7v7  
is locat$ 9 a rural area 7z def9$ 9     
subsection 7d77#b77;,d772  7vi7 is      
classifi$ z a rural ref]ral c5t] "u     
subsection 7d77#e77;,c72  7vii7 is a    
sole community hospital 7z def9$ 9      
subsection 7d77#e77;,d77iii772  7viii7  
is a l[-volume hospital 7z def9$ 9      
subsection 7d77#ab77;,c77i772 or  7ix7  
is a m$ic>e-dep5d5t1 small rural        

hospital 7z def9$ 9 subsection          
7d77#e77;,g774  7,c7 ,eligible hospital 
,! t]m eligible hospital has ! mean+    
giv5 t t]m 9 subsection 7n77#f77;,b74   
7,d7 ,enhanc$ cyb]security practices ,! 
t]m enhanc$ cyb]security practices means
 enhanc$ security requirem5ts adopt$ "u 
section #aagc7;d77#a77;,b77i77,,ii7 &   
su* additional practices z ! ,secret>y  
may select = a ye> t are great] ?an     
ess5tial cyb]security practices4  7,e7  
,ess5tial cyb]security practices ,! t]m 
ess5tial cyb]security practices means ! 
m9imum security requirem5ts adopt$ "u   
section #aagc7;d77#a77;,b77i77,i7 & su* 
additional practices z ! ,secret>y may  
select = a ye>4  4  7b7 ,paym5t         
r$uctions = failure ,to adopt safe      
cyb]security practices2 significant     
h>d%ip exception  7#a7 ,hospitals       
,section #ahhf7;b77#c77;,b7 ( ! ,social 
,security ,act 7#db ,u4,s4,c4           
#acieww7b77#c77;,b77 is am5d$ by add+ at
 ! end ! foll[+ new clause3  7xiii7 7,i7
 ,= purposes ( clause 7i7-- 7aa7 =      

fiscal ye> #bjca1 9 ! case ( an eligible
 hospital t is n an adopt] ( ! ess5tial 
cyb]security practices = a paym5t ye> 7z
 det]m9$ "u subsection 7u77#b77;,a77 =  
an ,,ehr report+ p]iod = su* ye>1 !     
applicable p]c5tage increase o!rwise    
applicable "u clause 7i7 7det]m9$ )\t   
reg>d to clause 7viii7 or 7xi77 = su*   
fiscal ye> %all be r$uc$ 7b n bel[ z]o7 
by #j4be p]c5tage po9t2  7bb7 = fiscal  
ye> #bjcb1 9 ! case ( an eligible       
hospital t is n an adopt] ( ! ess5tial  
cyb]security practices = a paym5t ye> 7z
 det]m9$ "u subsection 7u77#b77;,a77 =  
an ,,ehr report+ p]iod = su* ye>--      
7,,aa7 ! applicable p]c5tage increase   
o!rwise applicable "u clause 7i7        
7det]m9$ )\t reg>d to clause 7viii7 or  
7xi77 = su* fiscal ye> %all be r$uc$ 7b 
n bel[ z]o7 by #j4ej p]c5tage po9t2 &   
7,,bb7 ! base op]at+ ,,drg paym5t am\nt 
7z def9$ 9 subsection 7o77#g77;,d77 =   
su* hospital = ea* dis*>ge 9 su* fiscal 
ye> %all be r$uc$ by #j4be p]c5t2  7cc7 
= fiscal ye> #bjcc1 9 ! case ( an       

eligible hospital t is n an adopt] ( !  
enhanc$ cyb]security practices = a      
paym5t ye> 7z det]m9$ "u subsection     
7u77#b77;,b77 = an ,,ehr report+ p]iod =
 su* fiscal ye>-- 7,,aa7 ! applicable   
p]c5tage increase o!rwise applicable "u 
clause 7i7 7det]m9$ )\t reg>d to clause 
7viii7 or 7xi77 = su* fiscal ye> %all be
 r$uc$ 7b n bel[ z]o7 by #j4ge p]c5tage 
po9t2 & 7,,bb7 ! base op]at+ ,,drg      
paym5t am\nt 7z def9$ 9 subsection      
7o77#g77;,d77 = su* hospital = ea*      
dis*>ge 9 su* fiscal ye> %all be r$uc$  
by #j4ej p]c5t2  7dd7 = fiscal ye>      
#bjcd1 9 ! case ( an eligible hospital t
 is n an adopt] ( ! enhanc$ cyb]security
 practices = a paym5t ye> 7z det]m9$ "u 
subsection 7u77#b77;,b77 = an ,,ehr     
report+ p]iod = su* fiscal ye>-- 7,,aa7 
! applicable p]c5tage increase o!rwise  
applicable "u clause 7i7 7det]m9$ )\t   
reg>d to clause 7viii7 or 7xi77 = su*   
fiscal ye> %all be r$uc$ 7b n bel[ z]o7 
by #a4j p]c5tage po9t2 & 7,,bb7 ! base  
op]at+ ,,drg paym5t am\nt 7z def9$ 9    

subsection 7o77#g77;,d77 = su* hospital 
= ea* dis*>ge 9 su* fiscal ye> %all be  
r$uc$ by #j4ge p]c5t2 &  7ee7 = fiscal  
ye> #bjce & ea* subsequ5t fiscal ye>1 9 
! case ( an eligible hospital t is n an 
adopt] ( ! enhanc$ cyb]security         
practices = a paym5t ye> 7z det]m9$ "u  
subsection 7u77#b77;,b77 = an ,,ehr     
report+ p]iod = su* fiscal ye>-- 7,,aa7 
! applicable p]c5tage increase o!rwise  
applicable "u clause 7i7 7det]m9$ )\t   
reg>d to clause 7viii7 or 7xi77 = su*   
fiscal ye> %all be r$uc$ 7b n bel[ z]o7 
by #a4j p]c5tage po9t2 & 7,,bb7 ! base  
op]at+ ,,drg paym5t am\nt 7z def9$ 9    
subsection 7o77#g77;,d77 = su* hospital 
= ea* dis*>ge 9 su* fiscal ye> %all be  
r$uc$ by #a4j p]c5t4  7,,ii7 ,a r$uction
 "u subclause 7,i7 %all apply only )    
respect to ! fiscal ye> involv$1 & !    
,secret>y %all n take into acc\nt su*   
r$uction 9 mak+ paym5ts to a hospital "u
 ?is section 9 a subsequ5t fiscal ye>4  
7,,iii7 ,! ,secret>y may1 on a          
case-by-case basis1 except an eligible  

hospital f ! application ( subclause    
7,i7 ) respect to a fiscal ye> if !     
,secret>y det]m9es1 subject to annual   
r5ewal1 t requir+ su* hospital to be an 
ess5tial or enhanc$ cyb]security        
practices adopt] dur+ su* fiscal ye>    
w\ld result 9 a significant h>d%ip1 su* 
z 9 ! case ( a natural disa/]1 a        
bankruptcy1 limit$ int]net connectivity1
 an incid5t 7z def9$ 9 section #bbjj ( !
 ,homel& ,security ,act ( #bjjb7 t      
significantly disrupts m$ic>e claims    
process+1 or any o!r simil> situation t 
! ,secret>y det]m9es int]f]$ ) ! ability
 ( ! eligible hospital to meet !        
requirem5ts4 ,an eligible hospital may n
 be grant$ an exemption "u ?is subclause
 = m ?an #e ye>s1 except 9 cases :]e !  
,secret>y det]m9es su* hospital has     
exp]i5c$ an incid5t 7z s def9$7 t       
significantly disrupts m$ic>e claims    
process+4 ,! ,secret>y %all e/abli% an  
exception process & po/ an application =
 an exception on ! ,int]net website ( ! 
,c5t]s = ,m$ic>e  ,m$icaid ,s]vices4    

,su* process %all require t !           
application be submitt$ to ! ,secret>y  
by n lat] ?an #f mon?s aft] ! conclusion
 ( ! ,,ehr report+ p]iod = ! relevant   
ye>4  7,,iv7 ,9 ! case ( a ,/ate = :i* !
 ,secret>y has waiv$ all or "p ( ?is    
section "u ! au?ority ( section         
#aaae;,a1 no?+ 9 ?is section %all       
preclude su* ,/ate f implem5t+ an       
adju/m5t simil> to ! adju/m5t "u        
subclause 7,i74  7,v7 ,9 ?is clause1 !  
t]m eligible hospital has ! mean+ giv5  
su* t]m 9 subsection 7u77#d74  4  7#b7  
,critical access hospitals ,section     
#ahad7l7 ( ! ,social ,security ,act 7#db
 ,u4,s4,c4 #acie;f7l77 is am5d$-- 7,a7  
by r$esignat+ p>agraph 7#e7 z p>agraph  
7#f72  7,b7 by ins]t+ aft] p>agraph 7#d7
 ! foll[+ new p>agraph3  7#e7 7,a7      
,subject to subp>agraphs 7,b7 & 7,c71 = 
co/ report+ p]iods beg9n+ 9-- 7i7 fiscal
 ye> #bjca1 9 ! case ( a critical access
 hospital t is n an ess5tial            
cyb]security practices adopt] 7z det]m9$
 "u section #ahhf7u77#c77;,a77 = an     

,,ehr report+ p]iod ) respect to su*    
fiscal ye>1 ! p]c5t describ$ 9 p>agraph 
7#a7 %all be r$uc$ by #j4be p]c5t2  7ii7
 fiscal ye> #bjcb1 9 ! case ( a critical
 access hospital t is n an ess5tial     
cyb]security practices adopt] 7z det]m9$
 "u section #ahhf7u77#c77;,a77 = an     
,,ehr report+ p]iod ) respect to su*    
fiscal ye>1 ! p]c5t describ$ 9 p>agraph 
7#a7 %all be r$uc$ by #j4ej p]c5t2      
7iii7 fiscal ye> #bjcc1 9 ! case ( a    
critical access hospital t is n an      
enhanc$ cyb]security practices adopt] 7z
 det]m9$ "u section #ahhf7u77#c77;,b77 =
 a ,,ehr report+ p]iod ) respect to su* 
fiscal ye>1 ! p]c5t describ$ 9 p>agraph 
7#a7 %all be r$uc$ by #j4ge p]c5t2 &    
7iv7 fiscal ye> #bjcd or a subsequ5t    
fiscal ye>1 9 ! case ( a critical access
 hospital t is n an enhanc$ cyb]security
 practices adopt] 7z det]m9$ "u section 
#ahhf7u77#c77;,b77 = a ,,ehr report+    
p]iod ) respect to su* fiscal ye>1 !    
p]c5t describ$ 9 p>agraph 7#a7 %all be  
r$uc$ by #a p]c5t4  7,b7 ,! p]c5t       

describ$ 9 p>agraph 7#a7 %all be r$uc$  
by no m ?an a total ( #a p]c5t = a      
fiscal ye> z ! result ( ! application ( 
?is p>agraph & o!r sections ( ?is title4
  7,c7 ,! provisions ( subclause 7,,iii7
 ( section #ahhf7;b77#c77;,b77xiii7 %all
 apply ) respect to subp>agraph 7,a7 = a
 critical access hospital ) respect to a
 co/ report+ p]iod 9 ! same mann] z su* 
subclause applies ) respect to subclause
 7,i7 ( su* section = an eligible       
hospital4  2 &  7,c7 9 p>agraph 7#f71 z 
r$esignat$ by subp>agraph 7,a7-- 7i7 9  
subp>agraph 7,c71 by /rik+ & at ! end2  
7ii7 9 subp>agraph 7,d71 by /rik+ !     
p]iod at ! end & ins]t+ 2 &2 &  7iii7 by
 add+ at ! end ! foll[+ new             
subp>agraphs3  7,e7 ! me?odology & /&>ds
 = det]m9+ paym5t am\nts = critical     
access hospitals "u section #ahhf7u7 &  
paym5t adju/m5ts "u p>agraph 7#e72  7,f7
 ! me?odology & /&>ds = det]m9+ :e!r a  
critical access hospital is an ess5tial 
or enhanc$ cyb]security practices adopt]
 "u section #ahhf7u77#b7 & ! ,secret>y's

 det]m9ation ( :e!r to apply ! h>d%ip   
exception "u subsection                 
7b77#c77;,b77xiii77,,iii7 to a critical 
access hospital pursuant to p>agraph    
7#e77;,c72 or  7,g7 any alt]ation by !  
,secret>y ( ! requirem5ts specifi$ 9    
section #ahhf7u77#b7 ) respect to a     
critical access hospital4  4  7c7       
,implem5tation fund+ ,9 addition to any 
am\nts o!rwise made available1 !re is   
appropriat$ to ! ,c5t]s = ,m$ic>e       
,m$icaid ,s]vices ,program ,managem5t   
,acc\nt f ! ,f$]al ,hospital ,insurance 
,tru/ ,fund "u section #ahag ( ! ,social
 ,security ,act 7#db ,u4,s4,c4 #acie;i71
 #dj1jjj1jjj = fiscal ye> #bjbg &       
#ae1jjj1jjj = ea* ( fiscal ye>s #bjbi   
?r\gh #bjcc1 to rema9 available until   
exp5d$1 to c>ry out ! am5dm5ts made by  
?is section4  #bjb4 ,m$ic>e accel]at$ & 
advance paym5ts 9 response to           
cyb]security incid5ts  7a7 ,"p ,a       
,section #ahae7;e77#c7 ( ! ,social      
,security ,act 7#db ,u4,s4,c4           
#acie;g7e77#c77 is am5d$ to read z      

foll[s3  7#c7 7,a7 ,subject to          
subsection 7f71 9 ! case ( an eligible  
provid] ( s]vices 7z def9$ 9 subp>agraph
 7,b77 t has an agreem5t 9 effect "u    
section #ahff & t has significant ca%   
fl[ problems result+ f op]ations ( its  
m$ic>e adm9i/rative contractor "u       
section #ahgd;,a or f unusual           
circum/ances ( su* provid]'s op]ation1  
includ+ significant disruption to       
,m$ic>e claims process+ due to a        
cyb]security incid5t 7z def9$ 9         
subp>agraph 7,c771 ! ,secret>y may make 
available appropriate accel]at$ paym5ts 
subject to appropriate safegu>ds aga9/  
fraud1 wa/e1 & abuse det]m9$ by !       
,secret>y4  7,b7 ,9 ?is p>agraph1 ! t]m 
eligible provid]s ( s]vices means-- 7i7 
a subsection 7d7 hospital or a          
subsection 7d7 ,pu]to ,rico hospital 7z 
def9$ = purposes ( section #ahhf72  7ii7
 a hospital describ$ 9 any ( clauses 7i7
 ?r\gh 7vi7 ( section                   
#ahhf7;d77#a77;,b72  7iii7 a critical   
access hospital 7z def9$ 9 section      

#ahfa7mm77#a772  7iv7 a rural em]g5cy   
hospital 7z def9$ 9 section             
#ahfa7kkk77#b772  7v7 a skill$ nurs+    
facility 7z def9$ 9 section #ahai7;a772 
7vi7 a home heal? ag5cy 7z def9$ 9      
section #ahfa7o772  7vii7 a hospice     
program 7z def9$ 9 section              
#ahfa7;dd77#b772  7viii7 a compreh5sive 
outpati5t rehabilitation facility 7z    
def9$ 9 section #ahfa7;cc77#b772  7ix7 a
 rural heal? cl9ic 7z def9$ 9 section   
#ahfa7;aa77#b772  7x7 a ,f$]ally        
qualifi$ heal? c5t] 7z def9$ 9 section  
#ahfa7;aa77#d772  7xi7 an opioid        
treatm5t program 7z def9$ 9 section     
#ahfa7;jjj77#b772 &  7xii7 a community  
m5tal heal? c5t] 7z def9$ 9 section     
#ahfa7;ff77#c77;,b774  7,c7 ,9 ?is      
p>agraph1 ! t]m cyb]security incid5t has
 ! mean+ giv5 ! t]m incid5t 9 section   
#bbjj ( ! ,homel& ,security ,act (      
#bjjb4  7,d7 ,not)/&+ any o!r provision 
( law1 ! ,secret>y may implem5t !       
provisions ( ?is p>agraph by program    
in/ruction or o!rwise4  4  7b7 ,"p ,b   

,section #ahce ( ! ,social ,security    
,act 7#db ,u4,s4,c4 #acien7 is am5d$ by 
add+ at ! end ! foll[+ new subsection3  
7f7 7#a7 ,^u ! reque/ ( a suppli] 7z    
def9$ 9 section #ahfa7;d77 t is         
p>ticipat+ 9 ! ,m$ic>e program "u ?is   
title1 t is furni%+ items or s]vices "u 
?is "p1 & t has significant ca% fl[     
problems result+ f op]ations ( its      
m$ic>e adm9i/rative contractor "u       
section #ahgd;,a or f unusual           
circum/ances ( su* suppli]'s op]ation1  
includ+ significant disruption to       
,m$ic>e claims process+ due to a        
cyb]security incid5t 7z def9$ 9 p>agraph
 7#b771 ! ,secret>y may make available  
appropriate advance paym5ts subject to  
appropriate safegu>ds aga9/ fraud1 wa/e1
 & abuse det]m9$ by ! ,secret>y4  7#b7  
,9 ?is p>agraph1 ! t]m cyb]security     
incid5t has ! mean+ giv5 ! t]m incid5t 9
 section #bbjj ( ! ,homel& ,security    
,act ( #bjjb4  7#c7 ,not)/&+ any o!r    
provision ( law1 ! ,secret>y may        
implem5t ! provisions ( ?is subsection  

by program in/ruction or o!rwise4  4    
7c7 ,protection ( ,tru/ ,funds  7#a7 ,"p
 ,a ,section #ahag ( ! ,social ,security
 ,act 7#db ,u4,s4,c4 #acie;i7 is am5d$  
by add+ at ! end ! foll[+ new           
subsection3  7l7 7#a7 ,beg9n+ on ! date 
( enactm5t ( ?is subsection1 !re %all be
 transf]r$ f ! ,g5]al ,fund ( !         
,treasury to ! ,tru/ ,fund an am\nt1 z  
e/imat$ by ! ,*ief ,actu>y ( ! ,c5t]s = 
,m$ic>e  ,m$icaid ,s]vices1 equal to !  
am\nt ( accel]at$ paym5ts made = items &
 s]vices "u ?is "p4  7#b7 ,!re %all be  
transf]r$ f ! ,tru/ ,fund to ! ,g5]al   
,fund ( ! ,treasury am\nts equival5t to 
! sum (-- 7,a7 ! am\nts by :i* claims h 
(fset 79 :ole or 9 "p7 ! am\nt ( su*    
paym5ts describ$ 9 p>agraph 7#a72 &     
7,b7 ! am\nt ( su* paym5ts t h be5      
repaid 79 :ole or 9 "p74  7#c7 ,am\nts  
describ$ 9 p>agraphs 7#a7 & 7#b7 %all be
 transf]r$ f "t to "t z det]m9$         
appropriate by ! ,secret>y4  4  7#b7 ,"p
 ,b ,section #ahdd ( ! ,social ,security
 ,act 7#db ,u4,s4,c4 #aciew7 is am5d$ by

 add+ at ! end ! foll[+ new subsection3 
7g7 7#a7 ,beg9n+ on ! date ( enactm5t ( 
?is subsection1 !re %all be transf]r$ f 
! ,g5]al ,fund ( ! ,treasury to ! ,tru/ 
,fund an am\nt1 z e/imat$ by ! ,*ief    
,actu>y ( ! ,c5t]s = ,m$ic>e  ,m$icaid  
,s]vices1 equal to am\nts paid 9 advance
 = items & s]vices "u ?is "p4  7#b7 ,!re
 %all be transf]r$ f ! ,tru/ ,fund to ! 
,g5]al ,fund ( ! ,treasury am\nts       
equival5t to ! sum (-- 7,a7 ! am\nts by 
:i* claims h (fset 79 :ole or 9 "p7 !   
am\nt ( su* paym5ts describ$ 9 p>agraph 
7#a72 &  7,b7 ! am\nt ( su* paym5ts t h 
be5 repaid 79 :ole or 9 "p74  7#c7      
,am\nts describ$ 9 p>agraphs 7#a7 & 7#b7
 %all be transf]r$ f "t to "t z det]m9$ 
appropriate by ! ,secret>y4  4