Senator Mark R. Warner (D-VA) has introduced the Health Care Cybersecurity Improvement Act of 2024 in response to the recent cyberattack on Change Healthcare. The ransomware attack has severely impacted billing services for providers across the nation, leaving many at risk of financial insolvency. This legislation aims to offer advance and accelerated payments to healthcare providers in the event of a cyber incident, provided they meet minimum cybersecurity standards.
Senator Warner emphasized the urgent need for improved cybersecurity measures within the healthcare sector. “I’ve been sounding the alarm about cybersecurity in the healthcare sector for some time. It was only a matter of time before we saw a major attack that disrupted the ability to care for patients nationwide,” stated Sen. Warner. “The recent hack of Change Healthcare is a reminder that the entire healthcare industry is vulnerable and needs to step up its game. This legislation would provide some important financial incentives for providers and vendors to do so.”
The Health Care Cybersecurity Improvement Act of 2024 proposes modifications to the existing Medicare Hospital Accelerated Payment Program and the Medicare Part B Advance Payment Program. These programs, managed by the Centers for Medicare & Medicaid Services (CMS), have historically provided temporary financial relief to participants during challenging times, such as the COVID-19 pandemic. Under the proposed legislation, the Secretary of Health and Human Services (HHS) would determine if the need for accelerated payments stems from a cyber incident. If so, healthcare providers would need to meet minimum cybersecurity standards to be eligible for these payments. If a provider’s intermediary was targeted in the cyber incident, the intermediary would also be required to meet minimum cybersecurity standards for the provider to receive payments. While the bill does not specify the exact details of the minimum cybersecurity standards, it entrusts the HHS Secretary with determining these standards. If enacted, the provisions of the Health Care Cybersecurity Improvement Act of 2024 would go into effect two years from the date of enactment.
Senator Warner’s proactive approach to healthcare cybersecurity is emphasized by his comprehensive efforts to address evolving cyber threats. In 2022, he authored “Cybersecurity is Patient Safety,” a policy paper aimed at tackling the rising cybersecurity challenges faced by healthcare providers. Collaborating with experts, Warner’s paper highlighted the increase in cyberattacks on healthcare, emphasizing the need for collaborative public-private efforts to strengthen cybersecurity measures. Divided into three chapters, the paper outlined challenges faced by federal agencies, proposed measures for the private sector, and offered recommendations for healthcare providers to respond effectively to cyber incidents. Warner’s commitment extends to tangible action, including the establishment of the bipartisan Health Care Cybersecurity Working Group and co-founding the Senate Cybersecurity Caucus in 2016. He also authored key legislation like the IoT Cybersecurity Improvement Act in 2017.
