# 119-s-3315: Health Care Cybersecurity and Resiliency Act of 2026

119-s-3315, Health Care Cybersecurity and Resiliency Act of 2026, is a 119th Congress bill sponsored by Sen. Cassidy, Bill [R-LA] (R-LA); status passed_senate; PRIA reads it as touching household money (as of 2026-10-08).

- Canonical: https://policyrisk.com/legislation/119-s-3315
- As of: 2026-10-08
- Plain-text twin of the page above; the HTML and this file carry the same facts.

## Facts
- Bill: 119-s-3315
- Congress: 119
- Title: Health Care Cybersecurity and Resiliency Act of 2026
- Status: passed_senate
- Introduced: 2025-12-02
- Sponsor: Sen. Cassidy, Bill [R-LA] (R-LA)
- Cosponsors: 5
- Policy area: Health
- Touches household money: yes
- Last recorded action: 2026-10-08

## Summary

**This bill would push a national upgrade of cybersecurity across the Healthcare and Public Health (HPH) Sector by aligning HHS with CISA and requiring** mandatory, risk-based cybersecurity standards and coordinated incident response. It pairs new rules with grants, training, and streamlined reporting to reduce breaches and speed recovery. - Health care providers and business associates would have to adopt minimum, risk-based practices such as multifactor authentication, encryption of protected health information, continuous monitoring and penetration testing. Those regulatory requirements would take effect 36 months after enactment and the Secretary could use enforcement discretion for extraordinary circumstances. - Rural and safety-net providers like Federally Qualified Health Centers, Indian Health Service facilities, nonprofit hospitals, and rural clinics would get targeted help. The bill creates grants (up to three years) and requires rural-specific guidance within one year to fund staffing, cloud migration, training, and shared IT models. - Patients and the sector would see clearer incident reporting and response. The bill expands breach reporting to include the number of people affected, requires a Cyber Annex for HHS incident response, mandates annual sector cybersecurity reports, and forms a working group to cut duplicative reporting.

## Cosponsors (5)

- Sen. Hyde-Smith, Cindy [R-MS] (R-MS), 2026-09-30T00:00:00.000Z
- Sen. King, Angus S., Jr. [I-ME] (I-ME), 2026-09-30T00:00:00.000Z
- Sen. Hassan, Margaret Wood [D-NH] (D-NH), 2025-12-02T00:00:00.000Z
- Sen. Cornyn, John [R-TX] (R-TX), 2025-12-02T00:00:00.000Z
- Sen. Warner, Mark R. [D-VA] (D-VA), 2025-12-02T00:00:00.000Z

## Provisions PRIA read

- Nationwide plan and leadership for health cybersecurity: benefit, high. If enacted, HHS and CISA would make a joint plan within 1 year to handle major health cyber incidents. They would share threats quickly, coordinate with states, and offer technical help. HHS would name a leader for cybersecurity and expand its Cyber Annex within 1 year, then update it at least ever…
- Grants and training for health providers: benefit, medium. If enacted, HHS would fund grants to help community health centers, Indian Health Service sites, nonprofit hospitals, rural clinics, and certain partner nonprofits improve cybersecurity. Money could pay for staff, training, system upgrades, secure cloud moves, risk testing, and joining threat‑shari…
- Simpler cyber reporting and public updates: benefit, medium. If enacted, HHS would convene a group within 1 year to cut duplicate cyber incident reporting and align with state rules. The group would finish within 18 months and HHS would send Congress recommendations within 1 year after. HHS would also send Congress an annual report on health sector cyber thr…
- New baseline cyber rules for providers: mixed, high. If enacted, most non‑government health providers and HIPAA business partners would need baseline cybersecurity controls. These would include multifactor authentication, encryption of health data, and ongoing monitoring and penetration testing. The rules would take effect 36 months after enactment a…

## Related bills

- 119-s-1071: National Defense Authorization Act for Fiscal Year 2026
- 119-s-4744: Take Care of America’s Veterans Act
- 119-s-1748: Kids Online Safety Act
- 119-s-1241: Sanctioning Russia Act of 2025
- 119-s-410: Love Lives On Act of 2025
- 119-s-1816: Improving Seniors’ Timely Access to Care Act of 2025

## Sources
- [119-s-3315 on Congress.gov](https://www.congress.gov/bill/119th-congress/senate-bill/3315)

## Related
- [119-s-1071: National Defense Authorization Act for Fiscal Year 2026](https://policyrisk.com/legislation/119-s-1071)
- [119-s-4744: Take Care of America’s Veterans Act](https://policyrisk.com/legislation/119-s-4744)
- [119-s-1748: Kids Online Safety Act](https://policyrisk.com/legislation/119-s-1748)
- [119-s-1241: Sanctioning Russia Act of 2025](https://policyrisk.com/legislation/119-s-1241)
- [119-s-410: Love Lives On Act of 2025](https://policyrisk.com/legislation/119-s-410)
- [119-s-1816: Improving Seniors’ Timely Access to Care Act of 2025](https://policyrisk.com/legislation/119-s-1816)
- [All bills in Congress](https://policyrisk.com/legislation)

Source: PRIA, https://policyrisk.com/legislation/119-s-3315 (as of 2026-10-08).