Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
S. 5218, the Health Infrastructure Security and Accountability Act of 2024, proposed minimum federal cybersecurity standards for health care organizations, stronger requirements for some systemically important entities, more oversight and financial assistance for hospitals. It did not become law: Congress.gov lists it as introduced and referred to the Senate Finance Committee, not enacted. For patients and health care businesses, its significance is the policy direction it represents—not a new compliance mandate currently imposed by this bill.
Why lawmakers proposed the bill
The proposal followed the February 2024 ransomware attack on Change Healthcare, a UnitedHealth-owned payment-processing company. The disruption affected claims, payments, eligibility checks and other transactions relied on by health care organizations across the country. It showed how an attack on one highly connected intermediary could interrupt operations well beyond that company, affecting provider cash flow and the systems used to coordinate care.
The incident also focused attention on basic security weaknesses. UnitedHealth executives said attackers used stolen credentials to access a server that did not have multifactor authentication. The company later confirmed it had paid a ransom to the ALPHV/BlackCat criminal group. Coverage of the proposal and its Change Healthcare backdrop described the episode as a reason supporters believed voluntary guidance had not produced consistent protections.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsThe policy issue is broader than whether patient records are stolen. A cyberattack can affect whether a hospital can access systems, whether a pharmacy can process prescriptions or whether a provider can get paid. In a sector that depends on interconnected vendors and payment networks, one organization’s security failure can create operational problems for others.
#1 Best Overall
What S. 5218 was—and what happened to it
Sen. Ron Wyden introduced S. 5218 on September 25, 2024, with Sen. Mark Warner as its only listed cosponsor. It was read twice and referred to the Senate Finance Committee. Congress.gov lists its status as “Introduced.” It was not enacted, so the bill itself created no binding nationwide cybersecurity standards, funding program or penalties.
The proposal would have directed the Department of Health and Human Services (HHS) to establish minimum and enhanced cybersecurity requirements for organizations within the HIPAA framework. Its introduced text is a proposed framework for HHS rulemaking, not a ready-to-use checklist that organizations can treat as current law. The detailed requirements would have depended in part on implementing regulations. See the bill text and introduced bill PDF.
Who would have been covered?
The proposal centered on HIPAA covered entities and business associates. That includes health care providers, health plans and health care clearinghouses, as well as business associates that handle protected health information on their behalf. A technology company serving health care would not automatically face identical obligations simply because it works in the sector; coverage would turn on the applicable statutory definitions and the organization’s role.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThis makes vendors part of the security picture rather than a side issue. A provider may rely on outside companies for electronic records, billing, hosting, remote support or claims processing. The proposal’s HIPAA-based approach would have put obligations on covered business associates too, though the exact requirements would have depended on HHS rules.
Proposed security standards and oversight
The bill contemplated a baseline for covered entities and business associates, with enhanced requirements for organizations HHS deemed systemically important or important to national security. Its framework addressed areas such as access controls, multifactor authentication, encryption, vulnerability management, risk management, security testing, incident response, recovery and business continuity. The bill authorized HHS to develop the detailed standards; it did not spell out every technical implementation choice in a single universal checklist.
That distinction matters. A mandate can require meaningful security outcomes while leaving regulators to specify how controls apply to different organizations and technologies. But the rulemaking would have had to answer difficult questions: Which national insurers, health systems, clearinghouses or intermediaries qualify for enhanced requirements? How would smaller organizations be treated? How transparent would designation decisions be, and could an organization challenge one? The introduced bill alone did not settle those implementation questions.
Reporting and testing duties also should not be conflated. A breach notification under existing rules is different from a routine compliance audit, an independent cybersecurity assessment, a penetration test or a report about a significant operational incident. According to coverage of the bill, HHS would have had to audit at least 20 regulated entities each year, with an emphasis on systemically important organizations. That would not mean every health care organization was audited annually.
Recommended Free Tools
The proposal also contemplated recurring assessments and incident reporting. The practical design would matter: audits can identify weak controls, but findings help only if organizations can remediate them and regulators can follow up. Reporting rules also need to distinguish a significant operational cyber incident from a breach of information subject to separate notification obligations.
Rank #3
Executive accountability and penalties
The bill would have required annual executive certification of an organization’s compliance with applicable standards. It also proposed stronger civil penalties for noncompliance, including changes to limits under existing HIPAA enforcement mechanisms. Penalties would target failures to meet required standards, not merely the fact that an attacker succeeded. Their effect would depend on how HHS applied them, including proportionality and enforcement discretion.
The introduced text included a potential penalty of up to $1 million and up to 10 years in prison for specified knowing or willful false submissions or omissions involving required documentation. That language should not be read as automatic criminal liability for a CEO whenever a health care organization suffers a breach. The proposed criminal provisions concerned particular certification or reporting conduct; they did not make an attack itself a crime by the executive. The scope would depend on the final enacted language and any implementing rules—which never followed from S. 5218 because it did not pass.
Annual certification could focus boards and senior leaders on cybersecurity, but it could also encourage defensive paperwork or overly cautious legal review if requirements were unclear. A workable regime would need to promote accurate reporting and remediation, not just polished attestations.
Proposed hospital funding and small-provider relief
S. 5218 paired new obligations with proposed assistance. It included $800 million in upfront investment payments for rural and urban safety-net hospitals and $500 million for other hospitals, for a proposed total of $1.3 billion. It also contemplated Medicare assistance and accelerated or advance payments after certain cybersecurity incidents, subject to security requirements. These were proposed benefits, not funds available under an enacted law.
The funding reflected a central trade-off. Hospitals need money and skilled staff to improve identity security, backups, monitoring and recovery. A mandate without implementation support could put smaller or financially strained providers at a disadvantage. At the same time, tying assistance to security requirements can bring reporting and administrative burdens to organizations with few dedicated cybersecurity staff.
The proposal gave HHS discretion to waive annual independent cyber stress tests for small providers in appropriate circumstances. That is not the same as a blanket exemption from cybersecurity standards. A waiver from a particular testing requirement, a temporary hardship accommodation and relief from an underlying security obligation are different things.
How it would have changed the HIPAA landscape
HIPAA already requires covered entities and business associates to maintain administrative, physical and technical safeguards for electronic protected health information. The proposed legislation would have moved toward more prescriptive minimum practices and proactive oversight within that existing framework; it would not have replaced HIPAA privacy or breach-notification rules.
- Privacy rules govern uses and disclosures of protected health information.
- Security rules govern safeguards for electronic protected health information.
- S. 5218’s focus was stronger cybersecurity standards, oversight, reporting and resilience.
Even a new federal security mandate would not automatically eliminate separate obligations under state privacy and breach-notification laws, Medicare or Medicaid requirements, or other applicable rules. Organizations need to evaluate their full legal and contractual environment rather than treating one standard as a substitute for all others.
Best Value
The case for standards—and the concerns
Supporters argued that health care is critical infrastructure and that system availability can affect patient safety. Organizations have very different resources, while risks often travel through shared vendors and interconnected systems. On that view, a minimum baseline can address weaknesses that voluntary guidance has not corrected consistently and can make resilience a shared obligation rather than an optional investment.
The strongest objections concern whether rules can be both enforceable and realistic:
- Cost and staffing: Smaller hospitals and medical practices may lack the people and budget for round-the-clock monitoring, security engineering, segmentation, independent assessments and incident-response support.
- Different operating environments: A national health system, rural hospital and small practice do not have the same infrastructure or risk profile. A rigid checklist could reward documentation more than risk reduction.
- Legacy equipment and vendors: Hospitals may rely on medical devices, software or operating systems that are difficult to update or replace, along with third-party remote access they cannot fully control.
- Enforcement capacity: Audits and reports require trained staff at HHS as well as within the organizations being regulated. If oversight is under-resourced, requirements may be inconsistently applied.
- Reporting incentives: If organizations fear that reporting an incident will trigger disproportionate penalties, they may become less forthcoming. Clear rules, proportional enforcement and incentives for prompt cooperation would matter.
What health care organizations can do now
S. 5218 is not a current legal checklist. Still, its themes overlap with practical resilience measures organizations can evaluate under their existing obligations and risk profiles:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Strengthen identity controls: Use multifactor authentication for remote access, privileged accounts and vendor connections; review who has access and remove unnecessary privileges.
- Protect recovery capability: Keep backups isolated from production systems and test whether data and services can actually be restored.
- Limit the spread of an intrusion: Segment critical networks where feasible, including systems supporting clinical care, and plan how operations can continue during downtime.
- Manage vulnerabilities and devices: Maintain an inventory of medical devices and software, track unsupported systems, and prioritize patching or compensating controls for high-risk exposures.
- Review suppliers: Understand third-party access, incident-notification commitments, security evidence, subcontractors and continuity plans in business-associate and vendor relationships.
- Exercise response and recovery: Practice ransomware scenarios with clinical, operational, legal and communications teams—not only IT—and test downtime procedures.
- Give leaders useful visibility: Report material risks, incidents, recovery objectives and unresolved findings to executives and boards in terms that support decisions and accountability.
For a small practice with shared IT and no dedicated security team, foundational controls—identity, secure backups, endpoint protection, patching, vendor access and tested recovery—are generally more actionable starting points than buying a collection of overlapping tools. For business associates, customers may increasingly ask for evidence of MFA, vulnerability management, incident response and recovery readiness even when a particular proposal has not become law.
Related proposals came later, but are separate bills
Health care cybersecurity remained a legislative issue after S. 5218. Separate measures introduced in the 119th Congress included S. 1851, the Healthcare Cybersecurity Act of 2025, introduced May 21, 2025; H.R. 3841, the Healthcare Cybersecurity Act of 2025, introduced June 9, 2025; and S. 3315, the Health Care Cybersecurity and Resiliency Act of 2025, introduced December 2, 2025. They are distinct proposals, not evidence that S. 5218 became law or was formally replaced by them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
