S. 3315
Health Care Cybersecurity and Resiliency Act of 2026
Sponsor: Bill Cassidy
Official summary
Written by the Congressional Research Service.
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Text of the bill
Where this section came from
-
Dec 2, 2025 · Introduced in Senate Referred to Senate Committee on Health, Education, Labor, and Pensions, Dec 2
-
Sep 30, 2026 · Engrossed in Senate S.Amdt. 5819: In the nature of a substitute. Official page ›
Part P of title III of the Public Health Service Act
(
42 U.S.C. 280g et seq.) is amended by adding at the end the following: [Inserted into the law: 399V–8. Grants. (
a) In general. The Secretary may award grants to eligible entities for the adoption and
use
implementation
of cybersecurity best practices. (b) Eligible entity. To be eligible to receive a grant under subsection (a
)
),
an entity shall be— (1) a
public or nonprofit private health center (including a
Federally qualified health center (as defined in section 1861(aa)(4) of the Social Security Act
));
(42 U.S.C. 1395x(aa)(4)));
(2) a health facility operated by or pursuant to a contract with the Indian Health Service;
(3) a
nonprofit
hospital; (4) a
cancer
rural
center;
health clinic
(
5)
as
a
defined
rural
in
health
section
clinic;
1861
(
6
aa)(2
)
an
of
academic
the
health
Social
center;
Security Act (42 U.S.C. 1395x(aa)(2)));
or (
7
5
) a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs (1) through (
6
4
). (c) Use of funds. In adopting and
using
implementing
cybersecurity best practices pursuant to a grant under subsection (a), an eligible entity may use grant funds— (1) to hire
individuals with demonstrated cybersecurity expertise
and train personnel in such cybersecurity best practices; (2) to update electronic data systems, such as by migrating to cloud
-
based platforms;
(3) to join and participate in health cybersecurity threat information sharing organizations;
(4) to
reduce
contract with third parties to assist
the
use
eligible
of
entity
legacy
in
systems;
carrying
and
out the activities described in this subsection;
(5) to
contract
conduct
with
cybersecurity
third
risk
parties
assessments
to
and
assist
vulnerability
with
assessments;
the
and
activities
(6)
described
to
in
develop
paragraphs
or
(1)
improve
through
cybersecurity
(5).
incident response plans.
(d) Grant period.
The
A
Secretary may award a
grant
awarded
under this section
shall be
for a period of not more than 3 years. (e)
Priority. In awarding grants under this section, the Secretary may give consideration to the demonstrated need of eligible entities. (f)
Application. An eligible entity seeking a grant under subsection (a) shall submit to the Secretary an application at such time, in such manner, and containing such information as the Secretary may require
,
including
,
—
at
(1)
a
minimum a
description of how the eligible entity will establish baseline measures and benchmarks that meet the Secretary’s requirements to evaluate
program
performance
outcomes
.
; and
(
f
2
)
Authorization
a
of
strategic
appropriations.
plan
There
for
are
how,
authorized
after
to
the
be
end
appropriated
of
to
the
carry
grant
out
period,
this
the
section
eligible
such
entity
sums
will
as
sustain
may
the
be
activities
necessary
funded
for
under
each
the
of
grant
fiscal
and
years
continue
2025
to
through
adopt
2030.
cybersecurity
]
best practices.
(a) In general. The Secretary may award grants to eligible entities for the adoption and implementation of cybersecurity best practices.
(b) Eligible entity. To be eligible to receive a grant under subsection (a), an entity shall be—
(1) a Federally qualified health center (as defined in section 1861(aa)(4) of the Social Security Act (42 U.S.C. 1395x(aa)(4)));
(2) a health facility operated by or pursuant to a contract with the Indian Health Service;
(3) a nonprofit hospital;
(4) a rural health clinic (as defined in section 1861(aa)(2) of the Social Security Act (42 U.S.C. 1395x(aa)(2))); or
(5) a nonprofit entity that enters into a partnership or coordinates referrals with an entity described in any of paragraphs (1) through (4).
(c) Use of funds. In adopting and implementing cybersecurity best practices pursuant to a grant under subsection (a), an eligible entity may use grant funds—
(1) to hire individuals with demonstrated cybersecurity expertise and train personnel in such cybersecurity best practices;
(2) to update electronic data systems, such as by migrating to cloud-based platforms;
(3) to join and participate in health cybersecurity threat information sharing organizations;
(4) to contract with third parties to assist the eligible entity in carrying out the activities described in this subsection;
(5) to conduct cybersecurity risk assessments and vulnerability assessments; and
(6) to develop or improve cybersecurity incident response plans.
(d) Grant period. A grant awarded under this section shall be for a period of not more than 3 years.
(e) Priority. In awarding grants under this section, the Secretary may give consideration to the demonstrated need of eligible entities.
(f) Application. An eligible entity seeking a grant under subsection (a) shall submit to the Secretary an application at such time, in such manner, and containing such information as the Secretary may require, including—
(1) a description of how the eligible entity will establish baseline measures and benchmarks that meet the Secretary’s requirements to evaluate performance outcomes; and
(2) a strategic plan for how, after the end of the grant period, the eligible entity will sustain the activities funded under the grant and continue to adopt cybersecurity best practices.