REQUIREMENTS FOR INFORMATION SECURITY FOR MEDICARE ADMINISTRATIVE CONTRACTORS.

SEC. 912. REQUIREMENTS FOR INFORMATION SECURITY FOR MEDICARE ADMINISTRATIVE CONTRACTORS.(a) In General.—Section 1874A, as added by section 911(a)(1), is amended by adding at the end the following new subsection:“(e) Requirements for Information Security.—“(1) Development of information security program.—A medicare administrative contractor that performs the functions referred to in subparagraphs (A) and (B) of subsection (a)(4) (relating to determining and making payments) shall implement a contractor-wide information security program to provide information security for the operation and assets of the contractor with respect to such functions under this title. An information security program under this paragraph shall meet the requirements for information security programs imposed on Federal agencies under paragraphs (1) through (8) of section 3544(b) of title 44, United States Code (other than the requirements under paragraphs (2)(D)(i), (5)(A), and (5)(B) of such section).“(2) Independent audits.—“(A) Performance of annual evaluations.—Each year a medicare administrative contractor that performs the functions referred to in subparagraphs (A) and (B) of subsection (a)(4) (relating to determining and making payments) shall undergo an evaluation of the information security of the contractor with respect to such functions under this title. The evaluation shall—“(i) be performed by an entity that meets such requirements for independence as the Inspector General of the Department of Health and Human Services may establish; and“(ii) test the effectiveness of information security control techniques of an appropriate subset of the contractor’s information systems (as defined in section 3502(8) of title 44, United States Code) relating to such functions under this title and an assessment of compliance with the requirements of this subsection and related information security policies, procedures, standards and guidelines, including policies and procedures as may be prescribed by the Director of the Office of Management and Budget and applicable information security standards promulgated under section 11331 of title 40, United States Code.“(B) Deadline for initial evaluation.—“(i) New contractors.—In the case of a medicare administrative contractor covered by this subsection that has not previously performed the functions referred to in subparagraphs (A) and (B) of subsection (a)(4) (relating to determining and making payments) as a fiscal intermediary or carrier under section 1816 or 1842, the first independent evaluation conducted pursuant to subparagraph (A) shall be completed prior to commencing such functions.“(ii) Other contractors.—In the case of a medicare administrative contractor covered by this subsection that is not described in clause (i), the first independent evaluation conducted pursuant to subparagraph (A) shall be completed within 1 year 117 STAT. 2388 after the date the contractor commences functions referred to in clause (i) under this section.“(C) Reports on evaluations.—“(i) To the department of health and human services.—The results of independent evaluations under subparagraph (A) shall be submitted promptly to the Inspector General of the Department of Health and Human Services and to the Secretary.“(ii) To congress.—The Inspector General of the Department of Health and Human Services shall submit to Congress annual reports on the results of such evaluations, including assessments of the scope and sufficiency of such evaluations.“(iii) Agency reporting.—The Secretary shall address the results of such evaluations in reports required under section 3544(c) of title 44, United States Code.”.(b) Application of Requirements to Fiscal Intermediaries and Carriers.—(1) In general.—The provisions of section 1874A(e)(2) of the Social Security Act (other than subparagraph (B)), as added by subsection (a), shall apply to each fiscal intermediary under section 1816 of the Social Security Act (42 U.S.C. 1395h) and each carrier under section 1842 of such Act (42 U.S.C. 1395u) in the same manner as they apply to medicare administrative contractors under such provisions.(2) Deadline for initial evaluation.—In the case of such a fiscal intermediary or carrier with an agreement or contract under such respective section in effect as of the date of the enactment of this Act, the first evaluation under section 1874A(e)(2)(A) of the Social Security Act (as added by subsection (a)), pursuant to paragraph (1), shall be completed (and a report on the evaluation submitted to the Secretary) by not later than 1 year after such date.