S3315119th CongressWALLET

Health Care Cybersecurity and Resiliency Act of 2025

Sponsored By: Senator Bill Cassidy

Introduced

Summary

Stronger cybersecurity standards for the health sector. This bill directs the Department of Health and Human Services and the Cybersecurity and Infrastructure Security Agency to coordinate, set minimum technical standards, improve breach reporting, and fund grants and training to boost resiliency.

Show full summary
  • Families and patients: Systems holding protected health information must use encryption and multifactor authentication. Breach reports must include the number of people affected and the public breach portal will show corrective actions and whether recognized security practices were considered.
  • Health providers and hospitals: HHS will require regular audits and penetration testing and may set other baseline standards with private sector input. Grants can pay for staff training, cloud migration, threat information sharing, and replacing legacy systems. Eligible entities include community health centers, hospitals, Indian Health Service facilities, cancer centers, and rural clinics.
  • Rural providers and workforce: The Secretary must issue rural cybersecurity guidance within one year and the Government Accountability Office will assess implementation within three years. The bill directs a strategic workforce plan via the Health Resources and Services Administration and authorizes grant funding for FY2025–2030.

Bill Overview

Analyzed Economic Effects

5 provisions identified: 5 benefits, 0 costs, 0 mixed.

Grants to boost health cybersecurity

This bill would create an HHS grant program to help public and nonprofit health providers improve cybersecurity. Eligible recipients would include community health centers, IHS facilities, hospitals, cancer centers, rural clinics, academic health centers, and nonprofit referral partners. Grants could pay for hiring and training staff, system upgrades (including cloud migration), reducing legacy systems, joining threat-sharing groups, and contracting cybersecurity services. Grants may last up to 3 years and the bill authorizes "such sums as may be necessary" for FY2025 through FY2030.

New minimum rules for patient data

This bill would direct the HHS Secretary to update HIPAA rules to require baseline cybersecurity practices. Covered entities and business associates would need multifactor authentication for access to systems with protected health information, encryption of PHI, and regular security audits including penetration testing. The Secretary would set effective dates and give reasonable time for compliance. Additional minimum standards would be developed in consultation with private-sector experts based on threat analysis.

Federal health cyber coordination and transparency

This bill would require HHS and CISA to coordinate and share threat indicators, defensive measures, and sector-specific products for the Healthcare and Public Health Sector. The HHS Assistant Secretary for Preparedness and Response would lead department-wide cybersecurity oversight. HHS must develop a department-wide cybersecurity incident response plan within 1 year and send Congress a report 60 days before implementation. The bill would also expand breach reporting to require the number of people affected, add "investments" to recognized security practices, require guidance on those practices within 1 year, update the public breach portal within 1 year, and begin reporting annually on how recognized practices were considered.

Healthcare cyber training and workforce plan

This bill would require HHS, working with CISA and private-sector experts, to provide cybersecurity training to health sector asset owners and operators upon enactment. The HRSA Administrator would develop a strategic plan within 1 year to grow the healthcare cybersecurity workforce. The plan would include recommendations for education programs, training materials, best practices, and public-private collaboration.

Rural health cyber guidance and study

This bill would require the HHS Secretary to issue cyber readiness guidance for rural health entities within 1 year. The guidance would cover infrastructure, adopting Secretary-issued technical standards, staff training, and policies to support incident reporting. The Comptroller General (GAO) would report to Congress within 3 years on how rural providers implemented the guidance, challenges they faced, and steps to strengthen resilience.

Sponsors & CoSponsors

Sponsor

Bill Cassidy

LA • R

Cosponsors

  • Maggie Hassan

    NH • D

    Sponsored 12/2/2025

  • John Cornyn

    TX • R

    Sponsored 12/2/2025

  • Mark Warner

    VA • D

    Sponsored 12/2/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov

Related Bills

Back to Legislation

Take It Personal

Get Your Personalized Policy View

Create a free account to save research, track policy impacts, and unlock your personalized versions of these pages.

Already have an account? Sign in