Senate passes bipartisan Health Care Cybersecurity and Resilience Act

Healthcare IT News

Senate passes bipartisan Health Care Cybersecurity and Resilience Act

First introduced in the HELP Committee in 2025, the bill would require healthcare organizations to meet some core cyber hygiene best practices while also offering guidance and assistance for providers.

By Mike Miliard, Executive Editor

The United States Senate announced this past week that bipartisan Health Care Cybersecurity and Resiliency Act of 2026 (S.3315) has passed by unanimous consent.

WHY IT MATTERS

The bill, first introduced in 2025 by physician Sen. Bill Cassidy, R-Louisiana, chair of the Senate Health, Education, Labor and Pensions Committee, is meant to shore up the cybersecurity preparedness of hospitals and health systems - with a special focus on small and rural providers - by requiring that they adhere to certain table-stakes best practices, such as multifactor authentication and encryption of ePHI.

The legislation also contains expanded requirements - and offers potential new resources - for public health agencies and other healthcare organizations.

The bill was co-sponsored by Sens. Maggie Hassan, D-New Hampshire; John Cornyn, R-Texas; and Mark Warner, D-Virginia, along with Sens. Cindy Hyde-Smith, R-MS; and Angus King, I-Maine.

Under the Health Care Cybersecurity and Resilience Act, the U.S. Department of Health and Human Services requires "private healthcare-related entities" to implement and develop some minimum cybersecurity capabilities, such as penetration testing and ongoing cyber monitoring. It calls on healthcare organizations to align with the standards of widely used cybersecurity frameworks, such as the one developed by NIST.

It also has provisions pertaining to "mitigating penalties relating to violations of health information privacy and security," and requires the development of specified plans, to be updated every other year, that detail other specific cybersecurity protocols for HHS.

The bill would help healthcare organizations by offering funding - it doesn't specify just how much - for training and support to help develop best practices while expanding the cybersecurity workforce. It would also provide for tailored information security guidance focused on rural providers.

It would designate a single point person to lead oversight and coordination of cybersecurity activities within HHS. It also instructs that HHS must coordinate with the Cybersecurity and Infrastructure Security Agency on bolstering cybersecurity across healthcare - providing resources about HHS or CISA programs and establishing joint coordination and incident-response plans.

THE LARGER TREND

Cassidy has been a vocal proponent of legislation to manage the thorny challenges of privacy and security in healthcare, through co-sponsorship of bipartisan bills, such as 2022's Health Data Use and Privacy Commission Act. (A newer version of that bill just advanced out of the Senate HELP Committee on unanimous vote this past August.)

As the Health Care Cybersecurity and Resilience Act has been percolating in the Senate this year, a different piece of legislation, the Health Infrastructure Security and Accountability Act, has also been making some progress in recent weeks.

Each has a different balance of carrot- and stick-based approaches to getting healthcare organizations to elevate their cybersecurity practices and preparedness.

While the HCCRA offers provisions for training and technical assistance, especially for rural and under-resourced providers, to help ensure they can meet even minimal cyber hygiene benchmarks, HISAA takes an arguably more aggressive approach.

That could involve a series of tiered mandatory standards, third-party auditing - and, potentially, larger fines or Medicare payment reductions that would be levied on larger organizations that fail to do their due diligence. At the same time the bill also offers specific funding assistance to help: $1.3 billion, including $800 million designated specifically for hospitals in rural and underserved urban communities.

ON THE RECORD

"Cyberattacks can shut down hospitals and expose patients' private medical records," Cassidy, said in a statement about HCCRA. "At a time when hostile actors are increasingly using sophisticated tactics to breach health care systems, the Health Care Cybersecurity and Resilience Act will help health care providers strengthen their defenses against cyber threats and protect patients' health data."

"This bipartisan legislation will help hospitals and health care providers, particularly those in rural communities with fewer resources, strengthen their cybersecurity and respond faster to attacks," added Hassan. "I'm pleased to see that the Senate came together to pass this bill, and I'll keep working across the aisle to protect patients and strengthen our health care system."