S. 3315
Health Care Cybersecurity and Resiliency Act of 2026
Sponsor: Bill Cassidy
Official summary
Written by the Congressional Research Service.
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Text of the bill
Where this section came from
-
Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
-
Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
… 2 unchanged passages …
(2)
Business associate. The term business associate has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation). (3) Covered entity. The term covered entity has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation). (4)
Cybersecurity incident. The term cybersecurity incident has the meaning given the term incident in section 3552 of title 44, United States Code. (
3
5
) Cybersecurity State Coordinator. The term Cybersecurity State Coordinator means a Cybersecurity State Coordinator appointed under section 2217(a) of the Homeland Security Act of 2002 (6 U.S.C. 665c(a)). (
4
6
) Director. The term Director means the Director of the Agency. (
5
7
) Healthcare and Public Health Sector. The term Healthcare and Public Health Sector means the Healthcare and Public Health sector, as identified in
Presidential
National
Policy
Security
Directive
Memorandum–22
21
(
February
April
12
30
,
2013
2024
; relating to critical infrastructure security and resilience). (
6
8
) Information Sharing and Analysis Organization. The term Information Sharing and Analysis Organization has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650). (
7
9
) Information system. The term information system has the meaning given such term in section
102
2200
of the
Cybersecurity
Homeland
Information
Security
Sharing
Act of
2015
2002
(6 U.S.C.
1501
650
). (
8
10
)
Recognized security practices. The term recognized security practices has the meaning given such term in section 13412(b)(1) of the HITECH Act (42 U.S.C. 17941(b)(1)). (11)
Secretary. The term Secretary means the Secretary of Health and Human Services.
In this Act:
(1) Agency. The term Agency means the Cybersecurity and Infrastructure Security Agency.
(2) Business associate. The term business associate has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation).
(3) Covered entity. The term covered entity has the meaning given such term in section 160.103 of title 45, Code of Federal Regulations (or a successor regulation).
(4) Cybersecurity incident. The term cybersecurity incident has the meaning given the term incident in section 3552 of title 44, United States Code.
(5) Cybersecurity State Coordinator. The term Cybersecurity State Coordinator means a Cybersecurity State Coordinator appointed under section 2217(a) of the Homeland Security Act of 2002 (6 U.S.C. 665c(a)).
(6) Director. The term Director means the Director of the Agency.
(7) Healthcare and Public Health Sector. The term Healthcare and Public Health Sector means the Healthcare and Public Health sector, as identified in National Security Memorandum–22 (April 30, 2024; relating to critical infrastructure security and resilience).
(8) Information Sharing and Analysis Organization. The term Information Sharing and Analysis Organization has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
(9) Information system. The term information system has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
(10) Recognized security practices. The term recognized security practices has the meaning given such term in section 13412(b)(1) of the HITECH Act (42 U.S.C. 17941(b)(1)).
(11) Secretary. The term Secretary means the Secretary of Health and Human Services.