S. 3315
Health Care Cybersecurity and Resiliency Act of 2026
Sponsor: Bill Cassidy
Official summary
Written by the Congressional Research Service.
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Text of the bill
Where this section came from
-
Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2, 2025
-
Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
(a) In general. The Secretary shall update the
privacy,
security
, and breach notification
regulations under
parts
part
160 and
subparts A and C of part
164 of title 45, Code of Federal Regulations (or any successor regulation
)
),
to require
non-governmental entities in the Healthcare and Public Health Sector and
covered entities and business associates to adopt
the
minimum
following
risk-based
cybersecurity practices
:
, including—
(1)
Multifactor
multifactor
authentication, or a successor technology
,
;
for
(2)
access
encryption
to
of
any information systems that may include
protected health information
.
,
(2)
or
Safeguards
a
to
successor
encrypt
technology;
protected health information.
(3)
Requirements
requirements
to conduct
audits
monitoring
, including penetration testing, to maintain the protections of information systems
.
; and
(4)
Other
other
minimum cybersecurity standards, as
determined
reflected
by
in
the
national
Secretary,
cybersecurity
in
frameworks.
consultation
(b)
with
Requirements.
private
The
sector
minimum
entities,
risk-based cybersecurity practices adopted pursuant to subsection (a) shall be
based on
—
landscape
(1)
analysis
national cybersecurity frameworks, as appropriate, such as— (A) the National Institute
of
emerging
Standards
and
existing
Technology
cybersecurity
Risk
vulnerabilities
Management
and
Framework
consensus-based
(or
best
a
practices.
successor framework);
(
b
B
)
Effective
the
dates.
National
The
Institute
Secretary
of
shall
Standards
specify
and
in
Technology
the
Cybersecurity
regulations
Framework (or a successor framework); (C)
the
effective
National
date
Institute of Standards and Technology SP 800–53 r5 Security and Privacy Controls
for
each
Information Systems and Organizations (or a successor special publication), with relevant components
of the
new
National
requirements
Institute
under
of Standards and Technology Privacy Framework; or (D)
the
National Institute of Standards and Technology Artificial Intelligence Risk Management Framework; (2) the Health Sector Coordinating Council Cybersecurity Healthcare and Public Health Cybersecurity Performance Goals; and (3) the health care-specific cybersecurity performance goals of the Cybersecurity and Infrastructure Security Agency. (c) Effective dates. The
regulations updated in accordance with subsection (a
).
),
Each
including
such
each
effective
new
date
requirement established,
shall
provide
take
reasonable
effect
time
on
for
the
entities
date
subject
that
to
is 36 months after
the
requirement
date
to
of
come
enactment
into
of
compliance
this Act
.
(d) Enforcement. The Secretary may exercise enforcement discretion for entities experiencing extraordinary circumstances in complying with the requirements of subsection (a).
(a) In general. The Secretary shall update the security regulations under part 160 and subparts A and C of part 164 of title 45, Code of Federal Regulations (or any successor regulation), to require non-governmental entities in the Healthcare and Public Health Sector and covered entities and business associates to adopt minimum risk-based cybersecurity practices, including—
(1) multifactor authentication, or a successor technology;
(2) encryption of protected health information, or a successor technology;
(3) requirements to conduct monitoring, including penetration testing, to maintain the protections of information systems; and
(4) other minimum cybersecurity standards, as reflected in national cybersecurity frameworks.
(b) Requirements. The minimum risk-based cybersecurity practices adopted pursuant to subsection (a) shall be based on—
(1) national cybersecurity frameworks, as appropriate, such as—
(A) the National Institute of Standards and Technology Risk Management Framework (or a successor framework);
(B) the National Institute of Standards and Technology Cybersecurity Framework (or a successor framework);
(C) the National Institute of Standards and Technology SP 800–53 r5 Security and Privacy Controls for Information Systems and Organizations (or a successor special publication), with relevant components of the National Institute of Standards and Technology Privacy Framework; or
(D) the National Institute of Standards and Technology Artificial Intelligence Risk Management Framework;
(2) the Health Sector Coordinating Council Cybersecurity Healthcare and Public Health Cybersecurity Performance Goals; and
(3) the health care-specific cybersecurity performance goals of the Cybersecurity and Infrastructure Security Agency.
(c) Effective dates. The regulations updated in accordance with subsection (a), including each new requirement established, shall take effect on the date that is 36 months after the date of enactment of this Act.
(d) Enforcement. The Secretary may exercise enforcement discretion for entities experiencing extraordinary circumstances in complying with the requirements of subsection (a).