# 119-s-5443: Health Infrastructure Security and Accountability Act of 2026

119-s-5443, Health Infrastructure Security and Accountability Act of 2026, is a 119th Congress bill sponsored by Sen. Warner, Mark R. [D-VA] (D-VA); status introduced; PRIA reads it as touching household money (as of 2026-10-09).

- Canonical: https://policyrisk.com/legislation/119-s-5443
- As of: 2026-10-09
- Plain-text twin of the page above; the HTML and this file carry the same facts.

## Facts
- Bill: 119-s-5443
- Congress: 119
- Title: Health Infrastructure Security and Accountability Act of 2026
- Status: introduced
- Introduced: 2026-09-17
- Sponsor: Sen. Warner, Mark R. [D-VA] (D-VA)
- Cosponsors: 1
- Policy area: Health
- Touches household money: yes
- Last recorded action: 2026-10-09

## Summary

**This bill would strengthen cyber protections for health data by creating a two-tier security regime that sets stricter rules for some health entities and layers in audits, penalties, and Medicare payment incentives.** - Providers and business associates would face new minimum and enhanced security requirements, annual risk analyses, stress tests, and CEO/CISO sign-offs. Regulations must be issued within 18 months and most requirements would take effect about 2 years after enactment. - Hospitals that do not adopt enhanced cybersecurity practices would face payment penalties, including a 1.0 percentage-point cut to their annual update and a 1.0% reduction to DRG payments. Critical access hospitals would face smaller phased reductions that reach the same 1.0% level if noncompliant. - Enforcement gets dedicated funding. The bill would create a user fee based on an entity's share of national health spending and cap collections at $40.0 million in FY2028 and $50.0 million in FY2029. It also provides targeted CMS funding to support implementation.

## Cosponsors (1)

- Sen. Wyden, Ron [D-OR] (D-OR), 2026-09-17T00:00:00.000Z

## Provisions PRIA read

- New annual health data user fee: cost, low. If enacted, the bill would charge each covered entity and business associate an annual fee based on its prior‑year revenue as a share of national health expenditures. Total collections would be capped each year: $40 million in FY2028, $50 million in FY2029, and thereafter the prior year cap adjuste…
- Medicare payments tied to cybersecurity: mixed, high. If enacted, the bill would offer payment pools to help hospitals adopt cybersecurity practices: $800 million for FY2029–FY2030 and $500 million for FY2031–FY2032, paid to eligible hospitals on request. At the same time, the bill would reduce Medicare payment updates and DRG base payments for hospit…
- New health-sector cybersecurity rules: mixed, high. If enacted, the bill would create a two-tier cybersecurity regime for all HIPAA-covered entities and business associates. It would add "availability" to legal protections for health data and require annual risk analyses, recovery plans, stress tests, and CEO/CISO attestations. Entities would need i…

## Related bills

- 119-s-891: Bipartisan Health Care Act
- 119-s-3990: PrEP Access and Coverage Act of 2026
- 119-s-2763: Keep Billionaires Out of Social Security Act
- 119-s-51: Washington, D.C. Admission Act
- 119-s-5108: Right to IVF Act of 2026
- 119-s-1503: Equality Act

## Sources
- [119-s-5443 on Congress.gov](https://www.congress.gov/bill/119th-congress/senate-bill/5443)

## Related
- [119-s-891: Bipartisan Health Care Act](https://policyrisk.com/legislation/119-s-891)
- [119-s-3990: PrEP Access and Coverage Act of 2026](https://policyrisk.com/legislation/119-s-3990)
- [119-s-2763: Keep Billionaires Out of Social Security Act](https://policyrisk.com/legislation/119-s-2763)
- [119-s-51: Washington, D.C. Admission Act](https://policyrisk.com/legislation/119-s-51)
- [119-s-5108: Right to IVF Act of 2026](https://policyrisk.com/legislation/119-s-5108)
- [119-s-1503: Equality Act](https://policyrisk.com/legislation/119-s-1503)
- [All bills in Congress](https://policyrisk.com/legislation)

Source: PRIA, https://policyrisk.com/legislation/119-s-5443 (as of 2026-10-09).