House Panel Weighs Medicare Payment Reform and Health Care Cybersecurity Legislation

Key Takeaways: 

• The House Energy and Commerce Subcommittee on Health will consider a broad package of health care legislation on September 15, including proposals aimed at restructuring Medicare physician payments, modifying performance-based reimbursement, and strengthening health care cybersecurity.¹
• The bipartisan Patients First Act of 2026 would tie future Medicare physician payment updates to the Medicare Economic Index (MEI), establish a hybrid primary care payment model, and make broader changes to Medicare's physician payment framework.²
• Cybersecurity proposals under consideration would strengthen federal coordination, provide resources to health care organizations, and address cybersecurity workforce challenges facing rural hospitals.¹,³,⁴

Federal lawmakers are weighing a broad package of health care legislation aimed at addressing 2 persistent challenges for the US health system: Medicare provider reimbursement and cybersecurity.

The House Energy and Commerce Subcommittee on Health is scheduled to hold a legislative hearing September 15 titled "Examining Legislative Proposals to Reform Medicare Provider Payment and Bolster Health Care Cybersecurity."¹

The hearing will consider more than a dozen bills spanning Medicare physician payment, claims data, pharmacist services, rural care, kidney disease, and other issues. However, several of the most consequential proposals focus on restructuring how Medicare pays clinicians and strengthening the health care sector's defenses against cyberattacks.¹

For payers, providers, and policymakers, the proposals could influence Medicare reimbursement, value-based payment incentives, provider participation, and the resources health care organizations have available to prepare for cyber threats.

What the Medicare Payment Proposals Would Do

1. Tie Physician Payment Updates More Closely to Practice Costs

The Patients First Act of 2026 (H.R. 9693) represents one of the most comprehensive Medicare physician payment proposals scheduled for discussion.¹,²

Beginning in 2027, the legislation would replace the existing physician payment update framework with updates linked to changes in the MEI, a measure reflecting changes in the costs of operating a medical practice.²

For clinicians who do not qualify for an advanced alternative payment model (APM), the annual update generally would be based on the estimated MEI increase minus 1 percentage point, subject to statutory floors and ceilings. Qualifying APM participants would receive an additional 0.5 percentage point.²

The bill also would require the US Department of Health and Human Services to report annually to Congress on how the updates affect beneficiary access and physician practice consolidation.²

The American Medical Association (AMA), which supports the legislation, argues that tying Medicare payments more closely to inflation would provide greater predictability and reduce reliance on temporary congressional payment adjustments.⁵

2. Test a New Primary Care Payment Model

H.R. 9693 would also establish a hybrid payment model for primary care beginning in 2027 and continuing through 2031.²

Under the model, qualifying primary care clinicians would receive monthly payments for attributed Medicare beneficiaries in place of traditional fee-for-service payments for designated primary care services. Those services would include care management, behavioral health integration, office-based evaluation and management visits—including telehealth—and certain communications through telephone calls, email, and patient portals.²

The monthly payments would be geographically adjusted and risk adjusted, and beneficiaries would not face cost sharing for the monthly payment.²

The proposal reflects a broader policy discussion about whether Medicare should rely less heavily on individual service-based reimbursement and create stronger incentives for longitudinal primary care.

3. Revisit Budget Neutrality and Performance-Based Payment

Other bills scheduled for consideration target specific components of the Medicare Physician Fee Schedule.

The Provider Reimbursement Stability Act of 2026 (H.R. 8163) would modify Medicare's budget-neutrality rules, which require CMS to offset certain increases in physician spending with reductions elsewhere in the fee schedule.⁶

The Medicare Physician Data-driven Performance Payment System Act of 2026 (H.R. 8622), meanwhile, would transform the Merit-based Incentive Payment System (MIPS) into a new Data-driven Performance Payment System.⁷

These proposals reflect congressional interest in both the underlying level of Medicare physician reimbursement and the mechanisms used to determine how payments are distributed among clinicians.

Why Medicare Physician Payment Is Back Before Congress

Medicare physician reimbursement has been the subject of repeated congressional intervention as lawmakers consider how to maintain beneficiary access while controlling program spending.

The Medicare Payment Advisory Commission (MedPAC) has separately recommended improving the accuracy of Medicare's relative payment rates by collecting and using more timely information on the costs of providing clinician services.⁸

MedPAC evaluates physician payment policy based on several factors, including beneficiary access, provider participation, payment adequacy, and Medicare's long-term fiscal sustainability.⁸

That creates an important policy trade-off for Congress: providing clinicians with more predictable reimbursement while ensuring that payment growth reflects the resources required to deliver care and does not unnecessarily increase Medicare spending.

Cybersecurity Legislation Adds a Second Policy Priority

The September 15 hearing will also examine legislation aimed at strengthening cybersecurity across the health care system.¹
Among the proposals is a House version of the Health Care Cybersecurity and Resiliency Act of 2026, alongside the Rural Hospital Cybersecurity Enhancement Act (H.R. 9908).¹

Health Care Cybersecurity and Resiliency Act

The Senate version of the Health Care Cybersecurity and Resiliency Act would establish cybersecurity grants for health care entities, strengthen sharing of cyber threat information, develop cybersecurity training resources, provide guidance to rural organizations, and require federal studies and reports on health sector cybersecurity.³

The Congressional Budget Office (CBO) estimated that implementing the Senate legislation would cost approximately $421 million from 2026 through 2031, assuming appropriations are provided.³

The legislation would also require updated security standards for covered health care entities and business associates, including measures involving multifactor authentication, encryption, system monitoring, and penetration testing. CBO estimated that the resulting private-sector compliance costs would exceed the statutory threshold used to identify significant private-sector mandates.³

That creates another policy balance: improving baseline cybersecurity protections while considering the financial and operational resources providers would need to meet stronger requirements.

Rural Hospital Cybersecurity Enhancement Act

H.R. 9908 would specifically require development of a comprehensive strategy for strengthening the cybersecurity workforce at rural hospitals.⁴

Rural facilities can face particular challenges recruiting cybersecurity professionals and financing information technology upgrades.

The American Hospital Association (AHA) has supported the corresponding Senate legislation, arguing that rural hospitals face unique financial, workforce, and technical constraints when defending against cyberattacks. The organization has also emphasized that cyber incidents can disrupt clinical operations and force hospitals to divert patients or ambulances.⁹

Implications for Managed Care

Although much of the legislation focuses directly on providers, several provisions could carry broader implications for managed care organizations.
Provider network stability: More predictable Medicare reimbursement could affect physician participation, practice finances, and consolidation trends, potentially influencing payer network development.

Value-based payment: Changes to MIPS, APM incentives, and primary care reimbursement could affect how clinicians participating in Medicare balance fee-for-service and value-based arrangements.

Primary care delivery: A hybrid payment model could encourage greater investment in care management, behavioral health integration, telehealth, and other services that are not always easily captured through traditional fee-for-service reimbursement.

Cybersecurity expectations: Stronger federal cybersecurity standards could affect not only providers but also health plans, vendors, business associates, and other organizations that exchange protected health information.

Rural access: Cybersecurity assistance and payment reforms could have particular importance for rural health systems operating with narrower financial and workforce margins.

A Bipartisan but Unfinished Policy Discussion

Many of the bills scheduled for the hearing have sponsors from both political parties. H.R. 9693, for example, was introduced by Reps. John Joyce, MD (R-PA), and Kim Schrier, MD (D-WA), and includes a bipartisan group of cosponsors.² H.R. 8163 was introduced by Reps. Greg Murphy, MD (R-NC), and Brad Schneider (D-IL), while H.R. 9908 was introduced by Rep. Erin Houchin (R-IN) with bipartisan cosponsors.⁴,⁶

Bipartisan sponsorship, however, does not guarantee enactment. The September 15 hearing represents an early stage of the legislative process. The subcommittee could subsequently revise individual proposals, advance legislation for committee consideration, or incorporate provisions into a broader health care package.¹

The Bottom Line

The September 15 House hearing brings together 2 increasingly important health policy questions: how Medicare should pay clinicians and how the federal government should help the health care sector defend itself against cyber threats.

The Medicare proposals seek to move away from repeated short-term payment adjustments by creating more predictable reimbursement, revisiting budget neutrality, and experimenting with alternative approaches to primary care and performance-based payment.¹,²,⁶,⁷

At the same time, the cybersecurity proposals would increase federal coordination and assistance while potentially establishing stronger security expectations for health care organizations.³,⁴

For managed care stakeholders, the significance extends beyond individual bills. The hearing could provide an early indication of where Congress is finding bipartisan agreement on physician reimbursement, value-based care, provider network stability, and cybersecurity—and which policies could ultimately advance as part of a broader health care package.

References

1. House Committee on Energy and Commerce, Subcommittee on Health. Examining Legislative Proposals to Reform Medicare Provider Payment and Bolster Health Care Cybersecurity. Hearing scheduled September 15, 2026. Accessed September 14, 2026. https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=119549
2. Patients First Act of 2026, H.R. 9693, 119th Cong (2026). Introduced July 15, 2026. Accessed September 14, 2026. https://www.govinfo.gov/content/pkg/BILLS-119hr9693ih/pdf/BILLS-119hr9693ih.pdf
3. Congressional Budget Office. S. 3315, Health Care Cybersecurity and Resiliency Act of 2026. Published April 20, 2026. Accessed September 14, 2026. https://www.cbo.gov/publication/62241
4. Rural Hospital Cybersecurity Enhancement Act, H.R. 9908, 119th Cong (2026). Introduced July 23, 2026. Accessed September 14, 2026. https://www.govinfo.gov/app/details/BILLS-119hr9908ih
5. Henry T A. Bill would put an end to yearly patches on Medicare physician pay. AMA. Published September 9, 2026. Accessed September 14, 2026. https://www.ama-assn.org/practice-management/medicare-medicaid/bill-would-put-end-yearly-patches-medicare-physician-pay
6. Provider Reimbursement Stability Act of 2026, H.R. 8163, 119th Cong (2026). Introduced March 30, 2026. Accessed September 14, 2026. https://www.govinfo.gov/app/details/BILLS-119hr8163ih
7. Medicare Physician Data-driven Performance Payment System Act of 2026, H.R. 8622, 119th Cong (2026). Introduced April 30, 2026. Accessed September 14, 2026. https://www.govinfo.gov/app/details/BILLS-119hr8622ih
8. Medicare Payment Advisory Commission. March 2026 Report to the Congress: Medicare Payment Policy. Published March 12, 2026. Accessed September 14, 2026. https://www.medpac.gov/document/march-2026-report-to-the-congress-medicare-payment-policy/
9. American Hospital Association. AHA Support for Rural Hospital Cybersecurity Enhancement Act. Published January 14, 2026. Accessed September 14, 2026. https://www.aha.org/system/files/media/file/2026/01/aha-support-for-senate-rural-hospital-cybersecurity-enhancement-act-letter-1-14-2026.pdf