This bill would set new minimum and enhanced security requirements for covered health entities and business associates, and it would require them to do annual risk analyses, make recovery plans, run stress tests, submit certain documentation, publish some information online, and undergo independent