Senator on cyberattack: ‘It was only a matter of time’ 

WASHINGTON – U.S. Sen. Mark Warner, D-Va., a member of the Senate Finance Committee and-chairman of the Senate Cybersecurity Caucus, has introduced legislation that would allow for advance and accelerated payments to health care providers in the event of a cyber incident, as long as they and their vendors meet minimum cybersecurity standards. 

“I’ve been sounding the alarm about cybersecurity in the health care sector for some time,” Warner said. “It was only a matter of time before we saw a major attack that disrupted the ability to care for patients nationwide. The recent hack of Change Healthcare is a reminder that the entire health care industry is vulnerable and needs to step up its game. This legislation would provide some important financial incentives for providers and vendors to do so.” 

The legislation, the “Health Care Cybersecurity Improvement Act of 2024,” would modify the existing Medicare Hospital Accelerated Payment Program and the Medicare Part B Advance Payment Program by: 

• Requiring the secretary to determine if the need for payments results from a cyber incident; 

• If it does, requiring the health care provider receiving the payment to meet minimum cybersecurity standards, as determined by the secretary, to be eligible; and 

• If a provider’s intermediary was the target of the incident, the intermediary must also meet minimum cybersecurity standards, as determined by the secretary, for the provider to receive the payments. 

The provisions would go into effect two years from the date of enactment. 

In 2022, Warner authored “Cybersecurity is Patient Safety,” a policy options paper, outlining current cybersecurity threats facing health care providers and systems and offering for discussion a series of policy solutions to improve cybersecurity across the industry.  Since publishing, Sen. Warner has launched the Health Care Cybersecurity Working Group with a bipartisan group of colleagues to examine and propose potential legislative solutions to strengthen cybersecurity in the health care and public health sector. 

A copy of the bill text is available here. 

CMS on March 9 made available accelerated payments to Part A providers and advance payments to Part B providers experiencing claims disruptions from the Change Healthcare cyberattack.