Health care firms would need multifactor logins and encryption under HIPAA update

What does this do?

The bill directs HHS to update the HIPAA Security Rule so health care companies and their business partners use basic protections: multifactor logins, encryption of patient records, and regular security testing. The rules would take effect three years after the bill becomes law, though HHS could ease enforcement for groups facing extraordinary circumstances. HHS and CISA would also share threat information, and HHS would name one person to lead its cybersecurity efforts, write an incident response plan and send Congress yearly reports.

Who does it affect?

Hospitals, clinics, insurers and the vendors that handle health data would have to meet the new standards. Community health centers, Indian Health Service facilities, nonprofit hospitals and rural health clinics could receive grants.

Why does it matter?

Covered organizations would face new security requirements, and HHS would have to weigh a company's good security habits when setting fines or settlements. Breach reports would also have to state how many people were affected.

What does it cost, and who pays?

• Grants of up to three years
• For staff, upgrades, risk assessments
• Grant total not specified