S. 3315

Health Care Cybersecurity and Resiliency Act of 2026

Sponsor: Bill Cassidy

5 cosponsors
Follow this bill

Official summary

Written by the Congressional Research Service.

Health Care Cybersecurity and Resiliency Act of 2026

This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.

The bill directs the Department of Health and Human Services (HHS) to

  • require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
  • more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
  • expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
  • provide training and best practices to support the expansion of the workforce for health care cybersecurity, 
  • provide guidance on cybersecurity readiness to rural entities, and
  • designate one representative to lead oversight and coordination of cybersecurity activities within HHS.

Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.

Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach). 

Text of the bill

Expand all
Sec. 11. Healthcare cybersecurity workforce Changed · Sep 30

Where this section came from

  1. Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
  2. Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
What changed in the text

(a) Training for healthcare experts. The Secretary, in coordination with the Cybersecurity State Coordinators of the Agency , the Office of the National Cyber Director, and private sector health care experts, as appropriate, shall provide training to Healthcare and Public Health Sector asset entities owners and operators on—

… 2 unchanged passages …

(b) Cross-Agency Strategic educational tools plan .

… 1 unchanged passage …

(2) Inclusions Contents . The strategic plan under paragraph (1) shall include—

… 2 unchanged passages …

(C) development of best practices to train the health care workforce on cybersecurity best practices; and (D) development of recommendations specific to rural facilities; (E) development of best practices to leverage artificial intelligence to support cybersecurity preparedness; (F) opportunities for public-private collaboration to strengthen the cybersecurity workforce ; and (G) alignment with the National Initiative for Cybersecurity Education Workforce Framework .

(a) Training for healthcare experts. The Secretary, in coordination with the Cybersecurity State Coordinators of the Agency, the Office of the National Cyber Director, and private sector health care experts, as appropriate, shall provide training to Healthcare and Public Health Sector entities on—

(1) cybersecurity risks to information systems within the Healthcare and Public Health Sector; and

(2) ways to mitigate the risks to information systems in the Healthcare and Public Health Sector.

(b) Strategic plan

(1) In general. Not later than 1 year after the date of enactment of this Act, the Secretary, acting through the Administrator of the Health Resources and Services Administration, in coordination with the Agency, shall develop a strategic plan to support growing the cybersecurity workforce for health care entities.

(2) Contents. The strategic plan under paragraph (1) shall include—

(A) recommendations for existing educational programs that can be used to support cybersecurity training;

(B) dissemination and development of educational materials on how to improve cybersecurity resilience;

(C) development of best practices to train the health care workforce on cybersecurity best practices;

(D) development of recommendations specific to rural facilities;

(E) development of best practices to leverage artificial intelligence to support cybersecurity preparedness;

(F) opportunities for public-private collaboration to strengthen the cybersecurity workforce; and

(G) alignment with the National Initiative for Cybersecurity Education Workforce Framework.