S. 3315
Health Care Cybersecurity and Resiliency Act of 2026
Sponsor: Bill Cassidy
Official summary
Written by the Congressional Research Service.
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Text of the bill
Where this section came from
-
Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
-
Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
Part
(a)
A
In general. The Secretary shall delegate a representative to lead oversight and coordination
of
title
activities
III
within the Department
of
Health and Human Services to support internal and external cybersecurity resilience within
the
Healthcare and
Public Health
Sector, including coordination and communication with other public and private entities related to preparedness for, and responses to, cybersecurity incidents, consistent with applicable provisions of the Public Health
Service Act (42 U.S.C.
241
201
et seq
.)
.),
is
other
amended
applicable
by
laws,
adding
and
at
National
the
Security
end
Memorandum–22
the
(April
following:
30,
[Inserted
2024;
into
relating
the
to
law:
critical
310C.
infrastructure
Oversight
security
of
and
cybersecurity
resilience). Such
activities
. The
shall
Secretary,
not
acting
include
through
implementation
the
or
Assistant
enforcement
Secretary
of
for
part
Preparedness
160
and
Response,
subparts
in
A
coordination
and
with
C
the
of
Director
part 164
of
the
title
Cybersecurity
45,
and
Code
Infrastructure
of
Security
Federal
Agency
Regulations
pursuant
(or
to
successor
section
regulations)
2218
(commonly
of
known as
the
Homeland
HIPAA
Security
Act
Rule).
of
(b)
2002
Reports. (1) Report on delegation. Not later than 60 days after delegating a representative under subsection (a), and any time a new representative is delegated under such subsection
,
the Secretary
shall
lead
submit
oversight
to the Committee on Health, Education, Labor,
and
coordination
Pensions
of
activities
the
within
Senate and
the
Department
Committee
of
on
Health
Energy
and
Human
Commerce
Services
of the House of Representatives a report that describes how such representative will implement steps
to
support
improve internal and external
cybersecurity
resiliency
resilience
within the Healthcare and Public Health Sector
.
(
as
2)
defined
Annual
in
report.
section
Not
2
later than 1 year after the date
of
enactment of this Act, and annually thereafter,
the
Secretary shall submit to the Committee on
Health
,
Care
Education,
Cybersecurity
Labor,
and
Resiliency
Pensions
Act
of
2025),
the
including
Senate
coordination
and
communication
the
with
Committee
other
on
public
Energy
and
private
Commerce
entities
of
related
the
to
House
preparedness
of
for,
Representatives a report on the state of cybersecurity in the Healthcare
and
responses
Public
to
Health Sector
,
including— (A) an assessment of the most significant
cybersecurity
incidents,
threats
consistent
and
with
vulnerabilities
applicable
facing
provisions
the Healthcare and Public Health Sector; (B) a summary
of
this
major
Act,
cybersecurity
other
incidents
applicable
affecting
laws,
the Healthcare
and
Presidential
Public
Policy
Health
Directive
Sector
21
during the preceding year;
(
February
C)
12,
an
2013
assessment of the overall cybersecurity posture of the Healthcare and Public Health Sector
;
relating
(D) a description of actions taken by the Department of Health and Human Services
to
critical
improve
infrastructure
cybersecurity;
security
and (E) recommendations to improve Healthcare
and
resilience).
Public
]
Health Sector cybersecurity.
(a) In general. The Secretary shall delegate a representative to lead oversight and coordination of activities within the Department of Health and Human Services to support internal and external cybersecurity resilience within the Healthcare and Public Health Sector, including coordination and communication with other public and private entities related to preparedness for, and responses to, cybersecurity incidents, consistent with applicable provisions of the Public Health Service Act (42 U.S.C. 201 et seq.), other applicable laws, and National Security Memorandum–22 (April 30, 2024; relating to critical infrastructure security and resilience). Such activities shall not include implementation or enforcement of part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or successor regulations) (commonly known as the HIPAA Security Rule).
(b) Reports
(1) Report on delegation. Not later than 60 days after delegating a representative under subsection (a), and any time a new representative is delegated under such subsection, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that describes how such representative will implement steps to improve internal and external cybersecurity resilience within the Healthcare and Public Health Sector.
(2) Annual report. Not later than 1 year after the date of enactment of this Act, and annually thereafter, the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report on the state of cybersecurity in the Healthcare and Public Health Sector, including—
(A) an assessment of the most significant cybersecurity threats and vulnerabilities facing the Healthcare and Public Health Sector;
(B) a summary of major cybersecurity incidents affecting the Healthcare and Public Health Sector during the preceding year;
(C) an assessment of the overall cybersecurity posture of the Healthcare and Public Health Sector;
(D) a description of actions taken by the Department of Health and Human Services to improve cybersecurity; and
(E) recommendations to improve Healthcare and Public Health Sector cybersecurity.