User fee to support data security oversight and enforcement activities

Section 1173(d) of the Social Security Act (42 U.S.C. 1320d–2(d)), as amended by section 102, is amended by adding at the end the following new paragraph: (7) User fee to support data security oversight and enforcement activities (A) In general Each covered entity and business associate shall pay the fee established by the Secretary under subparagraph (B). (B) Authorization The Secretary is authorized to charge a fee to each covered entity and business associate that is equal to the pro rata share of the entity or associate (equal to the ratio, as estimated by the Secretary, of the revenue of the entity or associate for the preceding fiscal year to national health expenditures, as determined by the Secretary, for the preceding fiscal year) of the aggregate amount of fees which the Secretary is directed to collect in a fiscal year. Any amounts collected shall be available without further appropriation to the Secretary for the purpose of carrying out oversight and enforcement activities under this subsection. (C) Limitation In any fiscal year (beginning with fiscal year 2028) the fees collected by the Secretary under subparagraph (B) shall not exceed the lesser of— (i) the estimated costs to be incurred by the Secretary in the fiscal year in carrying out oversight and enforcement activities under this subsection; or (ii) (I) in fiscal year 2028, $40,000,000; (II) in fiscal year 2029, $50,000,000; and (III) in fiscal year 2030 or a subsequent fiscal year, the amount determined under this clause for the preceding fiscal year, increased by the percentage increase in the consumer price index for all urban consumers (all items; United States city average) over the previous year..