The Health Infrastructure Security and Accountability Act Is Back. This Time, Take It Seriously.
On September 17, 2026, two Democratic Senators reintroduced the Health Infrastructure Security and Accountability Act. Most healthcare executives will file this under "legislation to watch" and move on. That would be a mistake. The Change Healthcare breach proved Congress can no longer look away from healthcare's cybersecurity failures, and this bill reflects that reckoning.
Why HIPAA's Flexibility Has Become a Liability
The healthcare sector has operated under HIPAA's Security Rule since 2005. That rule was built on flexibility, requiring "reasonable and appropriate" safeguards calibrated to organizational size, complexity, and capability. For two decades, that framework gave healthcare organizations tremendous latitude in how they designed security programs. That latitude also produced an industry where two organizations of comparable size and data custodianship can have vastly different security postures and both claim to be "HIPAA-compliant."
The Change Healthcare cyberattack in early 2024 changed the political calculus. A single ransomware incident disrupted pharmacy operations nationwide, delayed patient care, and exposed protected health information for over 100 million individuals, the largest healthcare breach ever reported to HHS. It wasn't a fringe actor that failed. It was a subsidiary of the largest health insurer in the country. Congress noticed. HHS opened a formal OCR investigation into UnitedHealth Group's security practices shortly after.
The reintroduction of HISAA in September 2026 is not a coincidence. It is a direct legislative response to what the Change Healthcare incident made undeniable: voluntary, flexible security standards have not produced a secure healthcare sector.
The Core Problem: Ambiguity as a Shield
I've spent years helping healthcare organizations understand what "reasonable safeguards" actually means in practice, as a CIO at NCQA, as a HITRUST assessor, and now as a consultant taking organizations through SOC 2 examinations. Here is what I've seen consistently: most healthcare organizations treat HIPAA's ambiguity as a shield rather than a floor.
When the Security Rule says "implement reasonable and appropriate technical safeguards," too many organizations interpret that as permission to avoid the hard investments. Multi-factor authentication? Deferred. Endpoint detection and response tooling? Not budgeted. Incident response plans that have actually been tested? Documented but never exercised.
This isn't an indictment of individual CISOs. Many of them know exactly where the gaps are and have been fighting for resources for years. The problem is structural. HIPAA's flexibility enabled boards and finance committees to treat security investment as discretionary. When an auditor cannot point to a specific standard that was violated, there is no forcing function.
OCR enforcement history reflects this. High-profile settlements against Advocate Medical Group, UCLA Health, and Anthem involved failures that were knowable and preventable. Yet for most organizations, the perceived probability of enforcement was low enough to justify the bet.
HISAA changes the bet. Prescriptive minimum standards, mandatory audits, and personal accountability provisions mean the ambiguity that insulated boards and executives from consequence goes away. That is the conversation healthcare leadership isn't ready for.
Strategic Implications: This Bill Creates Personal Exposure
The most significant language in HISAA isn't the technical requirements. It's the accountability provisions.
Under HIPAA, organizational liability has been the primary enforcement lever. Fines flow to covered entities and business associates. Executive accountability has been largely theoretical. HISAA would change that structure by creating personal liability exposure for executives who fail to meet defined standards or who certify compliance they knew to be inaccurate.
I've watched this pattern in other regulated industries. When Sarbanes-Oxley created personal liability for CFOs signing off on financial controls, it didn't just change accounting practices. It changed board-level governance of financial risk. Healthcare is approaching a similar inflection point.
For CISOs, this creates both an opportunity and a risk. The opportunity is straightforward: personal liability at the executive level finally gives security professionals the board-level audience they've been arguing for. When a CEO or CFO understands that their own exposure is on the line, the resource conversation changes.
The risk is equally clear. CISOs who have been operating under HIPAA's flexible framework, reporting clean compliance postures to boards that were never scrutinized against minimum technical standards, will face hard questions when auditors arrive with a checklist rather than a judgment call. The gap between "we've been HIPAA compliant" and "we meet HISAA's minimum standards" may be significant and expensive.
Smart health plan and provider organizations are running gap analyses right now. If yours isn't, that is the first strategic decision to make.
What Healthcare Leaders Should Do Now
Commission a gap analysis against the draft bill's requirements before it becomes law. The specific capabilities most likely to become non-negotiable are multi-factor authentication across all systems with access to PHI, endpoint detection and response tooling, documented and tested incident response plans, and formal third-party vendor risk management programs. You want to know your exposure on your timeline, not the auditor's. The HHS 405(d) Health Industry Cybersecurity Practices (HICP) and NIST CSF 2.0 provide a practical baseline for that analysis.
Brief your board now using accountability framing, not compliance framing. Directors and officers have fiduciary duties that extend to cybersecurity governance. D&O insurance underwriters are increasingly scrutinizing cyber risk disclosures. The board conversation should not start the day the bill passes. The reintroduction itself signals political direction, and boards that understand that context will make better resource allocation decisions.
Assess your third-party vendor risk posture with specificity. Change Healthcare demonstrated that a vendor's failure becomes your breach. HISAA will almost certainly include vendor and business associate accountability provisions that go beyond HIPAA's BAA requirements. Catalog your critical vendors, assess their security postures against defined criteria, and document the risk decisions you've made. "We had a BAA in place" will not be a sufficient answer.
If your security program was built primarily around self-assessments without external validation, close that gap now. Independent audit capability is central to what the bill contemplates. Organizations that have invested in repeatable, externally validated compliance programs, whether through SOC 2, HITRUST, or equivalent frameworks, will have a meaningful head start when prescriptive audit requirements take effect.
The Direction Is Set
The Health Infrastructure Security and Accountability Act may not pass in its current form. Legislation rarely does. But the direction is set. The policy consensus forming around healthcare cybersecurity is the same consensus that produced HIPAA in 1996 and the Meaningful Use mandates in 2009: when the sector fails to self-regulate, Congress creates the floor.
Experience has taught us that the organizations that navigate regulatory inflection points well are the ones that treat a reintroduction as the signal it is, not a reason to wait. For healthcare executives who want to understand their specific exposure and build a program that survives the next audit cycle, whether under HIPAA or something more demanding, MTC Group is doing exactly that work. I'd welcome the conversation.
Sources & Further Reading
HHS OCR Breach Portal, U.S. Department of Health & Human Services, Office for Civil Rights
HIPAA Security Rule, HHS Office for Civil Rights
NIST Cybersecurity Framework 2.0, National Institute of Standards and Technology
Health Industry Cybersecurity Practices (HICP): Managing Threats and Protecting Patients, HHS 405(d) Task Group
Healthcare and Public Health Cybersecurity, Cybersecurity and Infrastructure Security Agency (CISA)
Comments