Healthcare.gov gets stronger locks—but only if you can reach them
H.R. 9515 — MFA Act · Filed by Glenn Grothman (R-WI) · 3 cosponsors · Introduced Jun 29, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the federal healthcare.gov website to use multi-factor authentication (MFA)—a second verification method like a text code or fingerprint—when people enroll in health plans or access their enrollment information. The requirement takes effect one year after passage, with exceptions for people without broadband or cellular service or who cannot use MFA for other reasons the Secretary specifies.
Why we flagged it
The bill's sole operative mechanism is a security requirement—mandating MFA on a federal health-insurance portal. It is a straightforward cybersecurity measure, not a subsidy, deregulation, or appropriation.
What the text implies
- The Secretary's discretion to define additional exceptions ("reasons specified by the Secretary") creates regulatory flexibility but also potential for inconsistent application across demographic groups if not carefully administered.
- MFA requirement may create a temporary enrollment barrier during the transition period (1 year) if implementation is rushed or user education is inadequate, potentially reducing plan enrollment among less tech-savvy populations.
- The bill does not address what happens to existing accounts or whether legacy enrollees must re-authenticate; implementation details will determine whether this is a one-time friction or ongoing burden.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Multi-factor authentication materially reduces the risk of account takeover, identity theft, and fraudulent enrollment or subsidy claims on healthcare.gov—a high-value target because it contains tax-filing status, income, and insurance subsidy data. The bill includes a meaningful exception for people without broadband/cellular access, preventing a digital divide harm. The security gain outweighs any minor friction from the second authentication step.
Who stands to gain
- cybersecurity software and authentication service providers (MFA platform vendors)
Named in the bill
Department of Health and Human Services (HHS), Centers for Medicare & Medicaid Services (CMS), healthcare.gov, Patient Protection and Affordable Care Act (ACA), Section 1311(c)
Where it stands
3 cosponsors: 3 Republicans.
- Jun 29, 2026 — Introduced · Congress.gov: “Introduced in House”
- Jun 29, 2026 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (1,653 characters) on Aug 12, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Healthcare.gov gets stronger locks—but only if you can reach them” QuorumCivic. https://share.quorumcivic.app/bill/119/hr9515 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.