LUGPA Policy Update - Warner, Wyden Reintroduce Health Care Cybersecurity Legislation

October 2026

At a Glance

What Happened:
Sens. Mark Warner (D-VA) and Ron Wyden (D-OR) reintroduced the Health Infrastructure Security and Accountability Act, which aims to strengthen cybersecurity requirements across the health care sector. The bill would require HHS to establish and enforce minimum cybersecurity standards for health care providers, health plans, clearinghouses, and business associates.

Why It Matters:
Independent urology practices increasingly rely on electronic health records, electronic prescribing, billing systems, health information exchanges, and other technology to deliver and manage care. New federal cybersecurity requirements could help protect patient information and reduce disruptions from cyberattacks, but could also create additional compliance, testing, auditing, and financial requirements for practices.

Key Provisions

The legislation would:

• Establish and regularly update minimum federal cybersecurity standards for covered health care entities and business associates.
• Require covered entities to maintain continuity plans for responding to technology failures and cyber incidents.
• Require annual cybersecurity testing and independent security audits.
• Increase penalties for entities that fail to meet cybersecurity requirements and strengthen HHS oversight.
• Establish heightened requirements for systemically important entities and entities critical to national security.
• Provide $1.3 billion in funding to help hospitals strengthen cybersecurity, including $800 million for rural and underserved urban hospitals.

Why It Matters for LUGPA Members

Cybersecurity is increasingly a patient-care issue. A significant cyberattack can disrupt scheduling, prescribing, billing, referrals, clinical records, and other essential functions. The 2024 Change Healthcare cyberattack demonstrated how an incident affecting a major health care technology vendor can have consequences throughout the provider community.

For independent practices, however, new cybersecurity mandates must account for differences in size and resources. Practices may face costs associated with annual testing, independent audits, technology upgrades, continuity planning, and ongoing compliance. Business associates and technology vendors could also face new requirements that may affect the products and services available to physician practices.

The bill's funding is directed toward hospitals, including rural and underserved hospitals, rather than physician practices generally. LUGPA members could therefore face new requirements without necessarily having access to the same federal resources available to hospitals.

LUGPA Takeaways

• Protecting patient data and maintaining continuity of care are important priorities for independent practices.
• Federal cybersecurity standards should be risk-based, scalable, and appropriate for practices of different sizes and resources.
• New requirements should recognize the significant cybersecurity role played by third-party vendors and business associates.
• Policymakers should consider financial and administrative burdens on physician practices when establishing new cybersecurity requirements.
• Federal support for cybersecurity should extend beyond hospitals to independent physician practices and other community-based providers that maintain sensitive patient information and provide essential care.

LUGPA Position

LUGPA supports efforts to strengthen cybersecurity and protect patient information while ensuring that new federal requirements are practical, scalable, and achievable for independent physician practices. As Congress considers cybersecurity legislation, LUGPA will continue to advocate for policies that protect patients and maintain continuity of care without creating disproportionate financial or administrative burdens for community-based practices.