Insurance, Health, Accident

Plain English Breakdown

The bill summary does not provide specific details on enforcement or penalties for non-compliance.

Healthcare Cybersecurity Notification Act

This bill requires healthcare providers to inform health insurance companies as soon as possible if they experience a cyber-attack.

What This Bill Does

• Requires healthcare providers, groups, practices, clinics, facilities, or other entities under contract with health insurance entities to notify these insurers as soon as practicable upon experiencing a cyber-attack.

Who It Names or Affects

• Healthcare providers and related entities that are contracted with health insurance companies
• Health insurance companies that have contracts with healthcare providers

Terms To Know

cyber-attack

An attempt by hackers to damage or disrupt computer systems and networks.

healthcare provider

A person, group, facility, or other entity that provides medical care or related services.

Limits and Unknowns

• The bill does not specify the consequences for failing to report a cyber-attack.
• It is unclear how quickly 'as soon as practicable' means in the context of reporting a cyber-attack.

Official Summary Text

Abstract summarizes the bill.

Current Bill Text

HOUSE BILL 511
By Terry

SENATE BILL 555
By Reeves

SB0555
001872
- 1 -

AN ACT to amend Tennessee Code Annotated, Title 33;
Title 56; Title 63; Title 68, Chapter 11 and Title 71,
relative to health insurance.

BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF TENNESSEE:
SECTION 1. Tennessee Code Annotated, Title 56, Chapter 7, Part 10, is amended by
adding the following as a new section:
A healthcare provider, healthcare group, practice, or clinic, healthcare facility, or
other entity contracted with one (1) or more health insurance entities for reimbursement
of submitted claims for the provision of health care or healthcare-related goods or
services, shall provide notice to each such health insurance entity as soon as practicable
if the healthcare provider, healthcare group, practice, or clinic, healthcare facility, or
other entity is the subject of a cyber-attack.
SECTION 2. This act takes effect upon becoming a law, the public welfare requiring it.