S. 3315
Health Care Cybersecurity and Resiliency Act of 2026
Sponsor: Bill Cassidy
Official summary
Written by the Congressional Research Service.
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Text of the bill
Where this section came from
-
Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
-
Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
… 3 unchanged passages …
(i) in the paragraph heading, by inserting information system; after
Federal
federal
entity;; and
… 11 unchanged passages …
(A) In general. Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of
2025
2026
, the Secretary shall
develop
expand
and implement
a
the
cybersecurity
Cyber
incident
Annex
response
of
plan
the All Hazards Plan of the Department of Health and Human Services
to inform applicable personnel within the Department of Health and Human Services of processes and protocols to prepare for, and respond to, cybersecurity incidents
. (B) Scope. The plan under subparagraph (A) shall address cybersecurity incidents
involving information
systems
, including hardware, software, databases, and networks, used or maintained by, or on behalf of, the Department
,
.
including
(C) Elements. The plan under subparagraph (A) shall include
strategies—
… 4 unchanged passages …
(v) to protect data;
and
(vi) to recover from any cybersecurity incidents expeditiously
.
; and
(
B
vii
)
to communicate and share non-sensitive information about cybersecurity incidents with entities in the Healthcare and Public Health Sector (as defined in section 2 of the Health Care Cybersecurity and Resiliency Act of 2026). (D)
Consultation. In developing the plan under subparagraph (A), the Secretary shall consult with the Director of the Cybersecurity and Infrastructure Security Agency, the Director of the Office of Management and Budget,
and
the Director of the National Institute of Standards and Technology, and relevant experts, as appropriate. (
C
E
)
Updates. The Secretary shall review and update the plan under subparagraph (A)— (i) not less frequently than once every 2 years; and (ii) after any significant cybersecurity incident affecting the Department of Health and Human Services or a Federal health program. (F)
Report. Not later than 60 days before the date on which the Secretary begins implementing the plan under subparagraph (A), the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Energy and Commerce, the Committee on Oversight and Reform, and the Committee on Homeland Security of the House of Representatives a report that describes such plan.
]
Section 405 of the Cybersecurity Act of 2015 (6 U.S.C. 1533) is amended—
(1) in subsection (a)—
(A) in paragraph (4)—
(i) in the paragraph heading, by inserting information system; after federal entity;; and
(ii) by inserting information system, after Federal entity,;
(B) by redesignating paragraphs (4) through (7) as paragraphs (6) through (9), respectively; and
(C) by inserting after paragraph (3) the following:
(4) Cybersecurity incident. The term cybersecurity incident has the meaning given the term incident in section 3552 of title 44, United States Code.
(5) Cybersecurity risk. The term cybersecurity risk has the meaning given such term in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
; and
(2) in subsection (d), by adding at the end the following:
(4) Plan
(A) In general. Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2026, the Secretary shall expand and implement the Cyber Annex of the All Hazards Plan of the Department of Health and Human Services to inform applicable personnel within the Department of Health and Human Services of processes and protocols to prepare for, and respond to, cybersecurity incidents.
(B) Scope. The plan under subparagraph (A) shall address cybersecurity incidents involving information systems, including hardware, software, databases, and networks, used or maintained by, or on behalf of, the Department.
(C) Elements. The plan under subparagraph (A) shall include strategies—
(i) to assess cybersecurity risks;
(ii) to prevent cybersecurity incidents;
(iii) to detect and identify cybersecurity incidents;
(iv) to minimize damage in the event of a cybersecurity incident;
(v) to protect data;
(vi) to recover from any cybersecurity incidents expeditiously; and
(vii) to communicate and share non-sensitive information about cybersecurity incidents with entities in the Healthcare and Public Health Sector (as defined in section 2 of the Health Care Cybersecurity and Resiliency Act of 2026).
(D) Consultation. In developing the plan under subparagraph (A), the Secretary shall consult with the Director of the Cybersecurity and Infrastructure Security Agency, the Director of the Office of Management and Budget, the Director of the National Institute of Standards and Technology, and relevant experts, as appropriate.
(E) Updates. The Secretary shall review and update the plan under subparagraph (A)—
(i) not less frequently than once every 2 years; and
(ii) after any significant cybersecurity incident affecting the Department of Health and Human Services or a Federal health program.
(F) Report. Not later than 60 days before the date on which the Secretary begins implementing the plan under subparagraph (A), the Secretary shall submit to the Committee on Health, Education, Labor, and Pensions and the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Energy and Commerce, the Committee on Oversight and Reform, and the Committee on Homeland Security of the House of Representatives a report that describes such plan.