S. 3315

Health Care Cybersecurity and Resiliency Act of 2026

Sponsor: Bill Cassidy

5 cosponsors
Follow this bill

Official summary

Written by the Congressional Research Service.

Health Care Cybersecurity and Resiliency Act of 2026

This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.

The bill directs the Department of Health and Human Services (HHS) to

  • require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
  • more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
  • expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
  • provide training and best practices to support the expansion of the workforce for health care cybersecurity, 
  • provide guidance on cybersecurity readiness to rural entities, and
  • designate one representative to lead oversight and coordination of cybersecurity activities within HHS.

Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.

Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach). 

Text of the bill

Expand all
Sec. 7. Enhancing recognition of security practices Changed · Sep 30

Where this section came from

  1. Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
  2. Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
What changed in the text

… 1 unchanged passage …

(b) Guidance Regulation . Not later than 1 year after the date of enactment of this Act, the Secretary shall issue promulgate guidance regulations on implementing the implementation of section 13412 of the HITECH Act (42 U.S.C. 17941), which shall include— (1) recognized security practices (as defined in subsection (b)(1) of such section) that the Secretary may consider when determining fines under such section; (2) the extent to which such recognized security practices should be in place for consideration by the Secretary; and (3) procedural requirements or information that shall be submitted by a covered entity or business associate to the Secretary for consideration; and ( as 4) how the Secretary will take into account such terms recognized are security defined practices when determining fines, earlier favorable termination of audits, or mitigating remedies that would otherwise be agreed to in section any 13400 agreement with respect to resolving potential violations of the part HITECH 160 Act and (42 subparts U.S. A and C . 17921)) of to part 164 of title 45, Code of Federal Regulations (or successor regulations) (commonly known as the Secretary HIPAA for Security consideration Rule) between the covered entity or business associate and the Department of Health and Human Services . (c) Annual report. Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Secretary shall include in the annual report required under section 13424(a) of the HITECH Act (42 U.S.C. 17953(a)) information on implementation of section 13412 of such Act (42 U.S.C. 17941), including an accounting of every case in which the Secretary considered recognized security practices (as defined in subsection (b)(1) of such section) when effectuating audits and assessing fines under such section.

(a) Recognized security practices. Section 13412(b)(1) of the HITECH Act (42 U.S.C. 17941(b)(1)) is amended, in the first sentence, by inserting , investments, after other programs.

(b) Regulation. Not later than 1 year after the date of enactment of this Act, the Secretary shall promulgate regulations implementing section 13412 of the HITECH Act (42 U.S.C. 17941), which shall include—

(1) recognized security practices that the Secretary may consider when determining fines under such section;

(2) the extent to which such recognized security practices should be in place for consideration by the Secretary;

(3) procedural requirements or information that shall be submitted by a covered entity or business associate to the Secretary for consideration; and

(4) how the Secretary will take into account such recognized security practices when determining fines, earlier favorable termination of audits, or mitigating remedies that would otherwise be agreed to in any agreement with respect to resolving potential violations of part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or successor regulations) (commonly known as the HIPAA Security Rule) between the covered entity or business associate and the Department of Health and Human Services.

(c) Annual report. Not later than 2 years after the date of enactment of this Act, and annually thereafter, the Secretary shall include in the annual report required under section 13424(a) of the HITECH Act (42 U.S.C. 17953(a)) information on implementation of section 13412 of such Act (42 U.S.C. 17941), including an accounting of every case in which the Secretary considered recognized security practices when effectuating audits and assessing fines under such section.