Congress Considers New Cybersecurity Legislation Adjunct To HIPAA

In the wake of Change Healthcare's February 2024 ransomware attack, which affected the protected health information (PHI) of at least 100 million individuals — the largest breach of PHI in history — the federal government's regulation of cybersecurity through HIPAA (Health Insurance Portability and Accountability Act) has come under intense scrutiny. In response, a bipartisan bill has been introduced to Congress that details a new law that stands beside HIPAA called the Health Infrastructure Security and Accountability Act (HISAA), which would create significant new security requirements for HIPAA-covered entities and business associates, especially those that governmental authorities consider to be important to US national security.