PRIA Logo™
119-s-3315119th CongressWALLET

Health Care Cybersecurity and Resiliency Act of 2026

Sponsored By: Senator Cassidy, Bill [R-LA]

Passed Senate

Summary

This bill would push a national upgrade of cybersecurity across the Healthcare and Public Health (HPH) Sector by aligning HHS with CISA and requiring mandatory, risk-based cybersecurity standards and coordinated incident response. It pairs new rules with grants, training, and streamlined reporting to reduce breaches and speed recovery.

Show full summary
  • Health care providers and business associates would have to adopt minimum, risk-based practices such as multifactor authentication, encryption of protected health information, continuous monitoring and penetration testing. Those regulatory requirements would take effect 36 months after enactment and the Secretary could use enforcement discretion for extraordinary circumstances.
  • Rural and safety-net providers like Federally Qualified Health Centers, Indian Health Service facilities, nonprofit hospitals, and rural clinics would get targeted help. The bill creates grants (up to three years) and requires rural-specific guidance within one year to fund staffing, cloud migration, training, and shared IT models.
  • Patients and the sector would see clearer incident reporting and response. The bill expands breach reporting to include the number of people affected, requires a Cyber Annex for HHS incident response, mandates annual sector cybersecurity reports, and forms a working group to cut duplicative reporting.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

4 provisions identified: 3 benefits, 0 costs, 1 mixed.

Nationwide plan and leadership for health cybersecurity

If enacted, HHS and CISA would make a joint plan within 1 year to handle major health cyber incidents. They would share threats quickly, coordinate with states, and offer technical help. HHS would name a leader for cybersecurity and expand its Cyber Annex within 1 year, then update it at least every 2 years. Key cyber terms would be aligned with existing federal definitions upon enactment.

New baseline cyber rules for providers

If enacted, most non‑government health providers and HIPAA business partners would need baseline cybersecurity controls. These would include multifactor authentication, encryption of health data, and ongoing monitoring and penetration testing. The rules would take effect 36 months after enactment and would be based on national NIST and sector frameworks. HHS would set rules within 1 year on which recognized security practices count in audits and fines and would report each year starting in year 2 on cases where they were used. The Secretary could use enforcement discretion for entities with extraordinary circumstances.

Grants and training for health providers

If enacted, HHS would fund grants to help community health centers, Indian Health Service sites, nonprofit hospitals, rural clinics, and certain partner nonprofits improve cybersecurity. Money could pay for staff, training, system upgrades, secure cloud moves, risk testing, and joining threat‑sharing groups. Grants would last up to 3 years, favor high‑need groups, and require baseline measures and a plan to sustain gains. HHS would provide training and create a cybersecurity workforce plan within 1 year. HHS would issue rural guidance within 1 year, offer technical help, and GAO would report in 3 years on rural progress.

Simpler cyber reporting and public updates

If enacted, HHS would convene a group within 1 year to cut duplicate cyber incident reporting and align with state rules. The group would finish within 18 months and HHS would send Congress recommendations within 1 year after. HHS would also send Congress an annual report on health sector cyber threats, incidents, and actions starting within 1 year. Breach reports would need to state how many people were affected starting upon enactment.

Sponsors & CoSponsors

Sponsor

Cassidy, Bill [R-LA]

LA • R

Cosponsors

  • Sen. Hyde-Smith, Cindy [R-MS]

    MS • R

    Sponsored 9/30/2026

  • Sen. King, Angus S., Jr. [I-ME]

    ME • I

    Sponsored 9/30/2026

  • Sen. Hassan, Margaret Wood [D-NH]

    NH • D

    Sponsored 12/2/2025

  • Sen. Cornyn, John [R-TX]

    TX • R

    Sponsored 12/2/2025

  • Sen. Warner, Mark R. [D-VA]

    VA • D

    Sponsored 12/2/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation