Healthcare.gov must use two-step login to stop account theft.

What it does

The bill requires healthcare.gov to use multi-factor authentication. People must verify their identity twice when they sign up for health plans or check enrollment. They might use a text code, fingerprint, or another method. The rule starts one year after the bill passes. People without internet or cell service get an exception.

Who it affects

People who use healthcare.gov to enroll in health plans are affected. The website holds tax data, income, and subsidy information. It is a target for theft and fraud.

One thing to notice

The Secretary can create other exceptions beyond lack of broadband or cell service. The bill does not say what those exceptions are. The bill does not say what happens to people already enrolled.

From the analysis of the bill text, linked under Primary records below.

Where it stands

3 cosponsors: 3 Republicans.

• Jun 29, 2026 — Introduced · Congress.gov: “Introduced in House”
• Jun 29, 2026 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Words to know

• multi-factor authentication — A second way to prove you are you, like a text code or fingerprint.
• enrollment — The act of signing up for a health plan.
• subsidy — Money the government gives to help pay for health insurance.
• Secretary — The head of a government department, in this case health and human services.