S. 3315

Health Care Cybersecurity and Resiliency Act of 2026

Sponsor: Bill Cassidy

5 cosponsors
Follow this bill

Official summary

Written by the Congressional Research Service.

Health Care Cybersecurity and Resiliency Act of 2026

This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.

The bill directs the Department of Health and Human Services (HHS) to

  • require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
  • more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
  • expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
  • provide training and best practices to support the expansion of the workforce for health care cybersecurity, 
  • provide guidance on cybersecurity readiness to rural entities, and
  • designate one representative to lead oversight and coordination of cybersecurity activities within HHS.

Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.

Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach). 

Text of the bill

Expand all
Sec. 3. Department coordination with the Agency Changed · Sep 30

Where this section came from

  1. Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
  2. Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
What changed in the text

… 2 unchanged passages …

(1) In general. The Secretary shall coordinate with the Director to make resources available to entities that are receiving information shared through programs managed by the Director or the Secretary, including Information Sharing and Analysis Organizations, information sector sharing coordinating and analysis centers councils , and non-Federal entities.

(2) Scope. The coordination under paragraph (1) shall include—

(A) developing products specific to the needs of Healthcare and Public Health Sector entities; and (B) sharing information relating to cyber threat indicators and appropriate defensive measures , including automating cyber threat information sharing, in a manner that adequately protects against unauthorized access or disclosure; and (C) providing technical assistance to covered entities and business associates to improve cybersecurity preparedness . (c) Joint cybersecurity planning. (1) In general. Not later than 1 year after the date of enactment of this Act, the Secretary and the Director shall establish a joint cybersecurity capability plan to coordinate responses to significant cybersecurity incidents affecting the Healthcare and Public Health Sector. (2) Elements. The joint cybersecurity capability plan established under paragraph (1) shall include— (A) protocols for rapid information sharing during sector-wide cybersecurity incidents; (B) coordination mechanisms with the sector coordinating council for the Healthcare and Public Health Sector; and (C) coordination with Cybersecurity State Coordinators for incidents affecting multiple States. (3) Submission to Congress. (A) In general. Not later than 1 year after the date of enactment of this Act, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives the final joint cybersecurity capability plan prepared under paragraph (1) and a description of how such plan implements the elements required under paragraph (2). (B) Updates. If the Secretary and the Director update the joint cybersecurity capability plan required under this subsection, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives such updated plan and a description of how such plan implements the elements required under paragraph (2).

(a) In general. The Secretary and the Director shall coordinate, including by entering into a cooperative agreement, as appropriate, to improve cybersecurity in the Healthcare and Public Health Sector.

(b) Assistance

(1) In general. The Secretary shall coordinate with the Director to make resources available to entities that are receiving information shared through programs managed by the Director or the Secretary, including Information Sharing and Analysis Organizations, sector coordinating councils, and non-Federal entities.

(2) Scope. The coordination under paragraph (1) shall include—

(A) developing products specific to the needs of Healthcare and Public Health Sector entities;

(B) sharing information relating to cyber threat indicators and appropriate defensive measures, including automating cyber threat information sharing, in a manner that adequately protects against unauthorized access or disclosure; and

(C) providing technical assistance to covered entities and business associates to improve cybersecurity preparedness.

(c) Joint cybersecurity planning

(1) In general. Not later than 1 year after the date of enactment of this Act, the Secretary and the Director shall establish a joint cybersecurity capability plan to coordinate responses to significant cybersecurity incidents affecting the Healthcare and Public Health Sector.

(2) Elements. The joint cybersecurity capability plan established under paragraph (1) shall include—

(A) protocols for rapid information sharing during sector-wide cybersecurity incidents;

(B) coordination mechanisms with the sector coordinating council for the Healthcare and Public Health Sector; and

(C) coordination with Cybersecurity State Coordinators for incidents affecting multiple States.

(3) Submission to Congress

(A) In general. Not later than 1 year after the date of enactment of this Act, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives the final joint cybersecurity capability plan prepared under paragraph (1) and a description of how such plan implements the elements required under paragraph (2).

(B) Updates. If the Secretary and the Director update the joint cybersecurity capability plan required under this subsection, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives such updated plan and a description of how such plan implements the elements required under paragraph (2).