On Sept. 15, the House Energy and Commerce Subcommittee on Health held a hearing on two hospital cybersecurity bills: the Rural Hospital Cybersecurity Enhancement Act, which would direct the Department of Health and Human Services (HHS) to write a rural workforce strategy and publish free training materials, and the Health Care Cybersecurity and Resiliency Act, which would tighten coordination between HHS and the Cybersecurity and Infrastructure Security Agency (CISA), authorize grants, and require multifactor authentication and encryption through an update to the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Two days later, Sens. Mark Warner (D-Va.) and Ron Wyden (D-Ore.) reintroduced the Health Infrastructure Security and Accountability Act, which would set mandatory standards, audit compliance, lift the caps on HIPAA fines, and pay $1.3 billion through Medicare, with $800 million of it to rural and safety-net hospitals.
An alarming set of breach numbers set the backdrop for the hearing. As of Aug. 30, 496 breaches affecting 500 or more people had been reported to the HHS Office for Civil Rights this year, exposing the records of 74.6 million individuals. Hacking and other IT incidents caused 426 of them (86%) and accounted for 97.8% of the people affected. Still, last year set the record: 804 large breaches and more than 140 million people, on top of the 192.7 million exposed by the Change Healthcare attack—the largest health care breach in U.S. history—in 2024. These incidents undermine hospitals’ mission: Ransomware attacks raise in-hospital mortality among patients already admitted by 34% to 38%.
The three bills are usually described as a choice between mandates and money. That description is wrong, and the error points Congress toward the bill that does the least.
A decade of voluntary guidance
Since 2015, federal policy on health care cybersecurity has been to advise, publish, and wait. The Cybersecurity Act of 2015 created a task group that published Health Industry Cybersecurity Practices in December 2018 and updated them in 2023. In December 2023, HHS released a strategy that promised voluntary performance goals first and enforceable standards later. The voluntary Cybersecurity Performance Goals arrived in January 2024. In June 2024, the White House announced that Microsoft and Google would give rural hospitals free or discounted security tools. The enforceable half of the plan, a $1.3 billion Medicare program in the fiscal 2025 budget request, went nowhere in Congress after the American Hospital Association urged lawmakers to reject it. And a HIPAA Security Rule update that HHS proposed in January 2025 has been pushed to July 2027.
Over that decade, large breaches rose from 270 in 2015 to 804 in 2025, and the share caused by hacking went from 49% in 2019 to over 80% this year.
The free tools show why guidance is not enough. By December 2025, more than a third of rural hospitals had joined Microsoft’s program. Of the first 375 assessed, 29% kept administrator accounts separate from ordinary user accounts. A year into the program, fewer than half of the hospitals assessed received a passing grade on fundamentals such as vulnerability scanning, patching, and network segmentation.
In 2016, I interviewed 22 organizations that had suffered a breach and found the same two causes everywhere: The sector adopted information technology too late and too fast, and it had no economic reason to protect data. In 2008, just 9.4% of hospitals had even a basic electronic record; by 2014, 96.9% had a certified system, while security staffing and budgets stayed at the levels of the paper era. A patient whose records are exposed cannot switch insurers and rarely switches hospitals, so a breach costs the organization little revenue. After exposing 80 million records in 2015, Anthem told investors the incident would not change its financial outlook. Free tools and best-practice guides do not change that arithmetic. The arithmetic is the same a decade later: UnitedHealth grew revenue by $14 billion in 2024, the year of the Change Healthcare attack, and its stock rose on its first earnings report after it.
What happened the last time HHS imposed real accountability
There is one clean test of whether accountability changes behavior in this sector. The 2013 HIPAA Omnibus Rule extended HIPAA’s requirements, and its civil and criminal penalties, to business associates: the claims processors, benefit managers, and software vendors that handle patient data without treating patients. Before 2013, they had neither market incentives nor legal liability to protect it.
In a 2018 study, Ram Gopal and I compared breaches among business associates with breaches among covered entities, which the rule left unchanged, using Office for Civil Rights data from October 2009 through August 2017. Once enforcement began in 2015, breaches among business associates fell immediately by 14.4 per quarter, while breaches among providers kept rising, from an average of 44.6 per quarter before the rule to 69.1 after. We estimated that the rule prevented 180 breaches that would otherwise have exposed the records of up to 17.8 million people. The effect has likely weakened since, as the penalty caps stayed fixed while patient data concentrated in ever-larger vendors. But the core finding, that liability changes behavior where guidance does not, keeps replicating. A quasi-experimental study of four major cybersecurity policy interventions found that only one, New York’s financial services cybersecurity regulation, which pairs enforcement penalties with an annual compliance certification signed by a senior officer, was followed by a measurable drop in breaches; the guidance-heavy regimes showed no detectable effect. The result is older than cybersecurity policy: States that adopted data breach disclosure laws cut identity theft by about 6% relative to states that had not.
The rule worked because it changed liability, not because it offered training. Business associates had revenue to protect and penalties to fear, and they invested.
Penalties have always been the weak link for everyone else. In 2015, I pointed out that the maximum annual HIPAA fine of $1.5 million was what Anthem earned in an hour and 15 minutes. Today’s inflation-adjusted cap is $2,190,294 per violation category per year. UnitedHealth put the cost of the Change Healthcare attack at $3.09 billion. The Office for Civil Rights’ largest possible fine for one category of violation is less than a tenth of 1% of that.
What the 3 bills actually do
Only H.R. 9908 is voluntary, and only H.R. 9908 has no money. The other two both mandate, though they differ in three ways. First, who writes the standard: Congress naming technologies or HHS setting outcome standards refreshed every two years. Here I agree with Greg Garcia of the Health Sector Coordinating Council, who told the subcommittee that a statute prescribing “multifactor authentication” and “encryption” will not age well, and the Senate bill’s “or a successor technology” clause shows its drafters know it. Second, enforcement: the existing HIPAA penalty structure with a wider safe harbor, or audits, public attestations, penalty floors without caps, and personal liability for executives who misstate compliance. Third, money: an authorization that appropriators may never fund, or payments from the Medicare trust fund that do not wait for an appropriations bill.
The 2013 evidence favors the second design: Liability that reaches the entity and penalties that bite are what moved business associates. The first design is the current HIPAA Security Rule with three named controls added, close to the proposed rule Congress has watched slip to 2027.
Rural hospitals feel the difference first
Whichever design Congress picks, rural hospitals hit its deadline with the least room. Chartis reports that 41.2% of 2,081 rural hospitals analyzed operate at a loss, 417 are vulnerable to closure, and critical access hospitals hold a median of 98 days of cash. There are 1,388 critical-access hospitals. The council’s 2025 interviews with 42 executives at resource-constrained providers in 31 states found them “only marginally prepared.”
The cost of the basics is smaller than the debate suggests. Microsoft estimates that an independent 50-bed rural hospital needs $30,000 to $40,000 to close its most serious vulnerabilities, and that doing so at the roughly 1,000 independent rural hospitals would cost $40 million to $45 million. That buys no security officer or monitoring, but it shows the essentials are cheap next to the money on the table. Warner and Wyden’s Health Infrastructure Security and Accountability Act would allocate $800 million for about 2,000 high-need hospitals, or $400,000 each, 10 times Microsoft’s estimate and enough to pay a managed security provider to run a critical access hospital’s defenses for years.
HHS estimated that its proposed HIPAA rule would cost regulated entities about $9 billion in the first year, with no money attached. The House draft takes the same shape if appropriators never fund its grants: the same controls, a 36-month clock, and no check.
The American Hospital Association says hospitals should not face mandates “as if they were at fault” for crimes against them; it supports the rural training bill and asks for funding instead. The evidence cuts against both extremes. Free tools without accountability left most participating rural hospitals failing fundamentals. Accountability without money is a closure policy for hospitals with 98 days of cash.
Sequencing decides which a rural hospital gets. The Health Infrastructure Security and Accountability Act would pay in fiscal 2029 and 2030 and start cutting Medicare payments in fiscal 2031, with hardship exemptions of up to five years. The House draft’s 36-month clock runs whether or not its grants are ever appropriated.
What Congress should pass
The subcommittee’s hearing record is open, and a markup this fall is plausible. It should produce one bill that does five things.
Take Warner and Wyden’s accountability architecture: standards written by HHS and refreshed every two years, annual attestations signed by the executives who own the risk, independent audits, and penalty floors with the annual caps removed. Drop the technology names from the statute, as the Health Care Cybersecurity and Resiliency Act does. The 2013 omnibus rule is the best evidence we have on what changes behavior in this sector, and its mechanism was liability, not a list of controls.
Keep the money mandatory, and let it arrive before the deadline, as Warner and Wyden’s bill does. The House draft should adopt the same rule: For hospitals eligible for its grants, the 36-month clock should start when the grants are appropriated, not when the bill is signed.
Spend the rural money on shared defenses rather than 1,388 separate security departments. At $400,000 per hospital, the $800 million can fund managed security providers and regional monitoring for critical access hospitals, which Garcia asked the subcommittee for and Microsoft’s figures say is affordable.
Keep business associates and clearinghouses inside the standard. Change Healthcare is a clearinghouse. The largest measured drop in breaches in this sector came from putting liability on business associates, and the Health Infrastructure Security and Accountability Act’s enhanced tier for systemically important entities aims at the firms whose failure takes down a third of the system at once.
Fix the breach portal. Section 6 of the Health Care Cybersecurity and Resiliency Act would make the Office for Civil Rights’ public portal show the corrective action taken after each breach and whether recognized security practices were considered. I asked the office to do this in 2016. A decade of listing victims without lessons has taught the sector nothing. The Rural Hospital Cybersecurity Enhancement Act’s workforce strategy and training materials belong in the same bill; on their own, with Section 5 forbidding new funds, they are a report.
Voluntary policy had its decade: 270 large breaches in 2015, 804 in 2025, and 496 as of the end of August 2026. The choice in front of the subcommittee is not mandates or money. It is whether Congress passes both together or settles for the one bill that costs nothing and changes nothing.
The Brookings Institution is committed to quality, independence, and impact.We are supported by a diverse array of funders. In line with our values and policies, each Brookings publication represents the sole views of its author(s).
——————————————————-
Click Here For The Original Source.
