118 S4054 IS: Health Care Cybersecurity Improvement Act of 2024 U.S. Senate 2024-03-22 text/xml EN Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.

II118th CONGRESS2d SessionS. 4054IN THE SENATE OF THE UNITED STATESMarch 22, 2024Mr. Warner introduced the following bill; which was read twice and referred to the Committee on FinanceA BILLTo require entities to meet minimum cybersecurity standards to be eligible for Medicare accelerated and advance payment programs if the reason for the need for such payments is due to a cybersecurity incident.

1.

Short title

This Act may be cited as the Health Care Cybersecurity Improvement Act of 2024.

2.

Modification of the Medicare hospital accelerated payment program

Section 1815(e)(3) of the Social Security Act (42 U.S.C. 1395g(e)(3)) is amended—(1)by inserting (A) after (3);(2)by inserting subparagraph (B) and after Subject to; and(3)by adding at the end the following new subparagraph:(B)Beginning on the date that is 2 years after the date of enactment of the Health Care Cybersecurity Improvement Act of 2024, if the Secretary determines that a cybersecurity incident led to the disruptions of the operations of such hospital’s intermediary or the unusual circumstances to such hospital’s operation that resulted in such significant cash flow problems, accelerated payments shall not be made to such hospital under subparagraph (A) unless—(i)such hospital meets minimum cybersecurity standards, as determined by the Secretary; and (ii)in the case of operations of such hospital's intermediary, such intermediary meets minimum cybersecurity standards, as determined by the Secretary..

3.

Modification of the Medicare Part B advance payment program

Beginning on the date that is 2 years after the date of enactment of this Act, in the event of a cybersecurity incident, as determined by the Secretary of Health and Human Services, leading to the making of payments pursuant to the program described in section 421.214 of title 42, Code of Federal Regulations (or any successor regulation), such payments shall not be made to a provider of services or supplier unless—(1)such provider of services or supplier meets minimum cybersecurity standards, as determined by the Secretary; and(2)in the case of such provider's or supplier’s intermediary being the target of such incident, such intermediary meets minimum cybersecurity standards, as determined by the Secretary.