The gist

Forces hospitals, clinics, and health insurers to adopt stricter cybersecurity standards to protect patient records from hackers and ransomware attacks.

Who wins, who loses

• Wins: patients whose medical data gets stolen; rural hospitals eligible for new federal cybersecurity grants.
• Loses: small health providers facing new compliance costs; hackers who target outdated hospital systems.

What it does

• Requires multifactor authentication, data encryption, and penetration testing audits for all entities handling protected health information.
• Creates grants (2025-2030) for hospitals, community health centers, and Indian Health Service facilities to upgrade systems.
• HHS must build a cyber incident response plan within 1 year, coordinating with Cybersecurity and Infrastructure Security Agency (CISA).
• Updates the breach reporting portal to show corrective actions and number of patients affected.

Why should I care?

Hospital hacks have leaked millions of patient records and even shut down emergency rooms. Supporters say mandatory standards are overdue since healthcare is the most-attacked sector. Critics argue small rural clinics can't afford compliance without bigger grants, and federal mandates duplicate state rules. Where do you land? Vote below and use "Tell Your Rep" to make sure your voice reaches Congress.