Sponsors (3)
The bill strengthens account security and reduces fraud for healthcare.gov users and taxpayers, but at the cost of new access barriers for rural, low-income, elderly, and disabled applicants and additional implementation expenses for state and federal exchange operators.
People enrolling on healthcare.gov (uninsured individuals, Medicaid beneficiaries, seniors, retirees, people with disabilities) will have stronger account security and reduced risk of unauthorized access, identity theft, and fraudulent enrollments, protecting personal data and reducing consumer harm.
Exchanges and the federal marketplace will improve their cybersecurity posture, potentially lowering incident response costs and reducing improper plan payments and administrative burdens for state and local governments and taxpayers.
Rural and low-income applicants who lack reliable broadband or cellular access may face delays or inability to enroll online, and if exemption processes are poorly designed they may be forced onto slower phone or in-person channels, increasing wait times and enrollment barriers.
Seniors and people with certain disabilities may struggle to use possession- or inherence-based authentication (tokens or biometrics), creating access burdens even where exemptions exist.
State and local Exchanges and the federal site will incur implementation and ongoing operational costs to deploy and support MFA, which could require additional funding or divert resources from other services.
Based on analysis of 2 sections of legislative text.
Requires multi‑factor authentication for users of Healthcare.gov to enroll in Marketplace plans or access personalized enrollment information, with exemptions for those without broadband/cellular or otherwise unable to use MFA.
Official title: To amend the Patient Protection and Affordable Care Act to require the use of multi-factor authentication to access certain information through healthcare.gov.
Introduced June 29, 2026 by Glenn Grothman · Last progress June 29, 2026
Requires the federal government to require multi-factor authentication (MFA) for people who use Healthcare.gov (or a successor site) to enroll in a qualified health plan or to access personalized enrollment information. The Secretary must issue a rule or guidance within 1 year of enactment, and the requirement applies to plan years beginning on or after 1 year after enactment; limited exemptions cover people without broadband/cellular access or otherwise unable to use MFA for Secretary‑specified reasons. Defines MFA as verification using two or more factors from the categories of knowledge (something you know), possession (something you have), or inherence (something you are).