S. 3315

Health Care Cybersecurity and Resiliency Act of 2026

Sponsor: Bill Cassidy

5 cosponsors
Follow this bill

Official summary

Written by the Congressional Research Service.

Health Care Cybersecurity and Resiliency Act of 2026

This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.

The bill directs the Department of Health and Human Services (HHS) to

  • require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
  • more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
  • expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
  • provide training and best practices to support the expansion of the workforce for health care cybersecurity, 
  • provide guidance on cybersecurity readiness to rural entities, and
  • designate one representative to lead oversight and coordination of cybersecurity activities within HHS.

Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.

Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach). 

Text of the bill

Expand all
Sec. 12. Cybersecurity incident reporting coordination working group Added Mar 23

Where this section came from

Not in the first version (Introduced in Senate, Dec 2).

  1. Mar 23, 2026 · Reported to Senate Marked up by Senate Committee on Health, Education, Labor, and Pensions, Feb 26 Reported by Senate Committee on Health, Education, Labor, and Pensions, Mar 23 Committee members' individual votes aren't in our records.
What is a markup?

A markup is a committee meeting where members go through a bill and vote on changes before sending it to the full chamber.

(a) Working group

(1) In general. Not later than 1 year after the date of enactment of this Act, the Secretary shall convene a working group to examine how to streamline and reduce duplicative reporting for cybersecurity incidents.

(2) Membership. The working group described in paragraph (1) shall include representatives of—

(A) the Cybersecurity and Infrastructure Security Agency;

(B) the Securities and Exchange Commission;

(C) the Office of the National Cyber Director;

(D) the Federal Bureau of Investigation;

(E) the Federal Trade Commission;

(F) State attorneys general;

(G) State health departments; and

(H) private sector health care entities.

(3) Conclusion. The working group shall conclude not later than 18 months after the date of the first meeting of the working group.

(b) Report. Not later than 1 year after the conclusion of the working group under subsection (a)(3), the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that—

(1) identifies areas the working group has identified to streamline and reduce duplicative reporting;

(2) includes recommendations to Congress on further streamlining such reporting; and

(3) addresses coordination with State breach notification laws.