MFA Act

119th Congress Introduced by Jodey Arrington and 2 co-sponsors

The bill would require multi-factor authentication for accessing information through healthcare.gov to strengthen security and reduce unauthorized access.

Introduced in House

Overview

HR 9515, introduced in the 119th Congress, would amend the Public Health Act known as the Patient Protection and Affordable Care Act (ACA) to require multi-factor authentication (MFA) for accessing certain information through healthcare.gov. The bill has three listed sponsors (co-sponsors: Jodey Arrington, Glenn Grothman, and Randy Fine) and was referred to the House Committee on Energy and Commerce on June 29, 2026.

Key Provisions

Amendment to the ACA/related health information provisions: The bill would insert a requirement that individuals accessing specified information through healthcare.gov must use MFA as part of the authentication process.

Scope of MFA: While the exact MFA methods are not detailed in the summary, MFA generally requires two or more verification factors (something the user knows, has, or is) beyond a standard username/password.

Implementation standards: The bill would presumably establish timelines or compliance expectations for healthcare.gov to implement MFA across eligible user access points, with possible guidance for federal IT operations and security standards.

Compliance and enforcement: The measure would likely include provisions related to compliance monitoring, potential penalties or remedies for noncompliance, and applicability to the relevant federal information systems.

Affected Entities

Primary: Individuals and entities accessing information through healthcare.gov, including the consumer-facing portal used for ACA-related services and information.

Federal program administrators: Agencies and contractors responsible for healthcare.gov operations and IT security would implement MFA requirements.

Procedural and Timeline Aspects

Introduction and referral: Introduced in the House and referred to the Committee on Energy and Commerce on June 29, 2026.

Next steps: Committee review could lead to markup, amendments, and potential floor consideration. If advanced, it would move through the standard House passage process and potentially to the Senate.

Implementation timeline: The summary provided does not specify a concrete deadline; typical legislation would set a phased timeline or compliance target date if enacted, but that detail is not included here.

Potential Impacts and Considerations

Security benefits: MFA can significantly reduce risk of account takeovers and unauthorized data access for healthcare.gov users.

User experience: MFA requirements may add steps for users, potentially affecting login friction and accessibility considerations.

IT investment: Federal IT systems would incur costs and operational changes to implement MFA across relevant access points.

Privacy and accessibility: Any MFA rollout should consider accessibility needs (e.g., users with disabilities) and privacy protections for authentication data.

Summary

HR 9515 seeks to strengthen the security of information accessible through healthcare.gov by mandating multi-factor authentication for user access. It targets improved protection against unauthorized access to ACA-related information and would require federal IT systems administering healthcare.gov to implement MFA in accordance with established security standards, subject to future legislative or regulatory details during committee and floor action.

Bill