S. 3315

Health Care Cybersecurity and Resiliency Act of 2026

Sponsor: Bill Cassidy

5 cosponsors
Follow this bill

Official summary

Written by the Congressional Research Service.

Health Care Cybersecurity and Resiliency Act of 2026

This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.

The bill directs the Department of Health and Human Services (HHS) to

  • require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
  • more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
  • expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
  • provide training and best practices to support the expansion of the workforce for health care cybersecurity, 
  • provide guidance on cybersecurity readiness to rural entities, and
  • designate one representative to lead oversight and coordination of cybersecurity activities within HHS.

Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.

Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach). 

Text of the bill

Expand all
Sec. 9. Guidance on rural cybersecurity readiness Changed · Sep 30

Where this section came from

  1. Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
  2. Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
What changed in the text

… 3 unchanged passages …

(A) Definition of rural. In this paragraph, the term rural has the meaning given such term by the Health Federal Resources Office and of Services Rural Administration Health Policy . (B) Guidance on rural cybersecurity readiness. Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2025 2026 , the Secretary shall issue guidance to rural entities on best practices to improve cyber cybersecurity readiness, including strategies— (i) to improve cyber cybersecurity infrastructure, including any technical safeguards to mitigate cybersecurity risk;

(ii) to integrate best practices issued by the Secretary to improve cybersecurity preparedness;

(iii) to improve employee workforce preparation to mitigate any cybersecurity risks, including existing public-private programs to support educational initiatives; and (iv) to implement policies to facilitate mandatory cybersecurity incident reporting requirements under law ; and (v) to explore and recommend best practices, including— (I) outsourcing information technology and chief information security officer functions to third parties on a part-time basis; (II) participating in regional rural health care information technology management sharing programs; and (III) migrating data to secure cloud-based platforms . (C) Technical assistance. The Secretary shall provide technical assistance to rural entities to implement the recommendations included in the guidance under subparagraph (B). (D) GAO study and report. (i) In general. Not later than 3 years after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2025 2026 , the Comptroller General of the United States shall conduct a study , and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report that describes the results of , a on study to examine how rural entities have implemented the recommendations included in the guidance under subparagraph (B). (ii) Requirements Contents . The study under clause (i) shall assess—

… 1 unchanged passage …

(II) steps to further support cyber cybersecurity resilience for rural entities;

(III) areas to improve coordination between Federal agencies, including for the purposes of required cyber reporting; and

(IV) any opportunities to support public-private collaboration in the area of cyber cybersecurity readiness.

]

Section 405(d) of the Cybersecurity Act of 2015 (6 U.S.C. 1533(d)) (as amended by section 5(2)) is amended by adding at the end the following:

Text this section adds to the law

(5) Rural cybersecurity guidance

(A) Definition of rural. In this paragraph, the term rural has the meaning given such term by the Federal Office of Rural Health Policy.

(B) Guidance on rural cybersecurity readiness. Not later than 1 year after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2026, the Secretary shall issue guidance to rural entities on best practices to improve cybersecurity readiness, including strategies—

(i) to improve cybersecurity infrastructure, including any technical safeguards to mitigate cybersecurity risk;

(ii) to integrate best practices issued by the Secretary to improve cybersecurity preparedness;

(iii) to improve workforce preparation to mitigate any cybersecurity risks, including existing public-private programs to support educational initiatives;

(iv) to implement policies to facilitate mandatory cybersecurity incident reporting requirements under law; and

(v) to explore and recommend best practices, including—

(I) outsourcing information technology and chief information security officer functions to third parties on a part-time basis;

(II) participating in regional rural health care information technology management sharing programs; and

(III) migrating data to secure cloud-based platforms.

(C) Technical assistance. The Secretary shall provide technical assistance to rural entities to implement the recommendations included in the guidance under subparagraph (B).

(D) GAO study and report

(i) In general. Not later than 3 years after the date of enactment of the Health Care Cybersecurity and Resiliency Act of 2026, the Comptroller General of the United States shall conduct a study, and submit to the Committee on Health, Education, Labor, and Pensions of the Senate and the Committee on Energy and Commerce of the House of Representatives a report, on how rural entities have implemented the recommendations included in the guidance under subparagraph (B).

(ii) Contents. The study under clause (i) shall assess—

(I) how rural entities have implemented any technical safeguards and any challenges faced by such rural entities in areas for which safeguards were not implemented;

(II) steps to further support cybersecurity resilience for rural entities;

(III) areas to improve coordination between Federal agencies, including for the purposes of required cyber reporting; and

(IV) any opportunities to support public-private collaboration in the area of cybersecurity readiness.