Technical corrections only. The two versions of the bill, v2 and v3, are identical in their operative provisions, definitions, and reporting requirements. No substantive policy changes were introduced between the reported and engrossed versions.
Health Care Cybersecurity and Resiliency Act of 2026
- Sponsor
- Sen. Cassidy, Bill [R-LA]
- Committees
- Health, Education, Labor, and Pensions Committee (primary)
- Last action
- Oct 5, 2026
Bottom line
This bill aims to significantly bolster the cybersecurity posture of the U.S. healthcare system through inter-agency coordination, updated regulatory standards, and targeted support for healthcare entities.
What it actually does
This bill mandates enhanced coordination between the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA) to improve cybersecurity in the Healthcare and Public Health Sector. It requires HHS to establish a joint cybersecurity plan with CISA, designate a lead for cybersecurity resilience within HHS, and update HIPAA security regulations to include minimum risk-based cybersecurity practices for covered entities and business associates. The bill also authorizes grants for cybersecurity adoption, mandates workforce training initiatives, and aims to streamline incident reporting requirements.
Proponents argue
Proponents argue that this bill is a critical step to protect sensitive patient data and ensure the continuity of essential healthcare services against increasing cyber threats. They emphasize the need for a unified federal approach, clear standards, and financial assistance, especially for vulnerable rural providers, to prevent catastrophic disruptions and data breaches.
Opponents contend
Opponents might express concerns about the potential for increased regulatory burden and compliance costs on healthcare providers, particularly smaller or rural entities, which could divert resources from patient care. They may also question the effectiveness of new mandates without sufficient funding or flexibility, potentially leading to unintended consequences or a 'one-size-fits-all' approach that doesn't fit diverse healthcare environments.
The bill is moderately complex, requiring careful reading to understand its full implications, but its length is manageable within a reasonable timeframe.
Section 3
HHS and CISA Coordination for Healthcare Cybersecurity
This section requires the Secretary of Health and Human Services (HHS) and the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to coordinate efforts to improve cybersecurity in the Healthcare and Public Health Sector, including through a cooperative agreement. They must make resources available, share cyber threat information, and provide technical assistance to healthcare entities. A joint cybersecurity capability plan for incident response is mandated within one year.
Supporters argue
Supporters argue that unified coordination between HHS and CISA is essential to leverage both agencies' expertise, streamline efforts, and provide a coherent defense strategy for the critical healthcare sector. This prevents fragmented responses and ensures efficient resource allocation.
Critics contend
Critics might argue that adding more layers of coordination could lead to bureaucratic inefficiencies or turf wars between agencies, potentially slowing down critical responses rather than expediting them.
Tradeoffs
Balances the need for comprehensive, coordinated federal action against the risk of bureaucratic overhead and potential delays in implementation.
Section 4
HHS Cybersecurity Leadership and Reporting
This section requires the Secretary of HHS to delegate a representative to lead internal and external cybersecurity resilience activities within HHS for the Healthcare and Public Health Sector. This role excludes HIPAA Security Rule enforcement. The delegated representative must report to Congress on implementation steps, and HHS must submit annual reports on the state of cybersecurity in the sector, including threats, incidents, posture, and recommendations.
Section 5
HHS Internal Cybersecurity Incident Response Plan
This section amends the Cybersecurity Act of 2015 to require the Secretary of HHS to expand and implement the Cyber Annex of the Department's All Hazards Plan within one year. This plan will inform HHS personnel on processes and protocols for preparing for and responding to cybersecurity incidents affecting the Department's information systems. It must include strategies for risk assessment, prevention, detection, damage minimization, data protection, recovery, and information sharing with the Healthcare and Public Health Sector.
Section 7
Incentivizing Recognized Security Practices
This section amends the HITECH Act to allow HHS to consider 'investments' in recognized security practices when determining fines or mitigating remedies for HIPAA violations. It mandates HHS to promulgate regulations within one year to implement this, specifying what practices are recognized, the extent they should be in place, submission requirements, and how they will be considered. HHS must also report annually on its implementation of this provision.
Section 8
Mandatory Minimum Risk-Based Cybersecurity Practices
This section requires HHS to update HIPAA security regulations to mandate non-governmental entities in the Healthcare and Public Health Sector, covered entities, and business associates to adopt minimum risk-based cybersecurity practices. These include multifactor authentication, encryption of protected health information, monitoring (including penetration testing), and other standards based on national cybersecurity frameworks (NIST RMF, CSF, SP 800-53 r5, AI RMF), Health Sector Coordinating Council goals, and CISA performance goals. The new requirements take effect 36 months after enactment, with HHS retaining discretion for extraordinary circumstances.
Section 9
Rural Cybersecurity Guidance and Technical Assistance
This section amends the Cybersecurity Act of 2015 to require HHS to issue guidance within one year to rural entities on best practices for improving cybersecurity readiness. This guidance includes strategies for infrastructure, preparedness, workforce training, mandatory incident reporting, and recommendations like outsourcing IT/CISO functions, participating in regional sharing programs, and migrating to secure cloud platforms. HHS must also provide technical assistance, and the GAO is mandated to study and report on the implementation of these recommendations by rural entities within three years.
Section 10
Cybersecurity Grant Program for Healthcare Entities
This section authorizes HHS to award grants to eligible entities (Federally qualified health centers, Indian Health Service facilities, nonprofit hospitals, rural health clinics, and nonprofit partners) for adopting and implementing cybersecurity best practices. Funds can be used for hiring/training personnel, updating electronic data systems (e.g., cloud migration), joining threat information sharing organizations, contracting with third parties, conducting risk assessments, and developing incident response plans. Grants are for up to 3 years, with priority given to demonstrated need.
Section 11
Healthcare Cybersecurity Workforce Training and Strategic Plan
This section requires HHS, in coordination with CISA, the Office of the National Cyber Director, and private sector experts, to provide training to Healthcare and Public Health Sector entities on cybersecurity risks and mitigation strategies. Within one year, HHS (through HRSA) and CISA must also develop a strategic plan to grow the healthcare cybersecurity workforce. This plan includes recommendations for educational programs, material dissemination, best practices for training, rural-specific recommendations, leveraging AI, public-private collaboration, and alignment with the NICE Workforce Framework.
Section 12
Streamlining Cybersecurity Incident Reporting Working Group
This section requires HHS to convene a working group within one year to examine how to streamline and reduce duplicative reporting for cybersecurity incidents. The group will include representatives from CISA, SEC, ONCD, FBI, FTC, State attorneys general, State health departments, and private sector healthcare entities. The working group will conclude within 18 months, and HHS must submit a report to Congress within one year of its conclusion, identifying streamlining areas, recommending legislative changes, and addressing coordination with State breach notification laws.
Requires covered entities and business associates to include the exact number of individuals affected by a breach in their breach notifications.
Section 6, amending Section 13402(f) of the HITECH Act.
Why it matters:This is standard legislative practice for amending existing statutes, rather not an attempt to obscure.
Case for: Proponents argue this provides critical transparency and data specificity, allowing for better assessment of breach severity and public awareness.
Case against: While generally supported, some entities might find the precise tracking and reporting of this number to be an additional administrative burden, especially for complex or ongoing incidents.
Estimated impact: Low administrative impact on reporting entities, high transparency impact for affected individuals and regulators.
Grants the Secretary of HHS the authority to exercise enforcement discretion for entities experiencing extraordinary circumstances in complying with the new mandatory cybersecurity standards.
Section 8(d)
Why it matters:This is a standard legislative mechanism to provide flexibility in enforcement, not an attempt to obscure.
Case for: Proponents argue this flexibility is essential to prevent undue hardship on entities facing unforeseen challenges, ensuring the standards are applied reasonably and sustainably.
Case against: Critics might argue that broad enforcement discretion could lead to inconsistent application of standards or create loopholes, undermining the goal of establishing a universal baseline of security.
Estimated impact: Potentially significant for entities facing severe financial or operational distress, allowing them a pathway to compliance without immediate punitive action.