S3315Reported by Committee

Health Care Cybersecurity and Resiliency Act of 2026

Share:
Introduced
In Committee
3
Passed One Chamber
4
Passed Both
5
Signed into Law
119th
Congress
2025-12-02
Introduced
3
Cosponsors
S
ⓘ
Type

Sponsor

Bill Cassidy
Bill Cassidy
Republican · LA · Senator
Votes with party: 74.4% (812 recorded votes)
Top industries funding sponsor:
  • Climate & Environment$8,471k

Full profile: /officials/C001075

Source: Congress.gov · FEC

Cosponsors (3)

Members who have signed on to support this bill since introduction. Source: Congress.gov.

Latest Action

The most recent step in the bill's legislative path. Committee Activity below shows referrals and reports; the full action-by-action history including floor proceedings lives at Congress.gov →

Placed on Senate Legislative Calendar under General Orders. Calendar No. 365.

2026-03-23

Source: Congress.gov

Committee Activity

Currently in

Previously

Plain-English Summary

Health Care Cybersecurity and Resiliency Act of 2026 This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors. The bill directs the Department of Health and Human Services (HHS) to require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication), more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security, expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel, provide training and best practices to support the expansion of the workforce for health care cybersecurity, provide guidance on cybersecurity readiness to rural entities, and designate one representative to lead oversight and coordination of cybersecurity activities within HHS. Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents. Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).

Plain-English rewrite of the Congressional Research Service summary published on Congress.gov. Cached and reviewed.

Subjects

Health
Full bill text is not yet cached locally.
Open text viewRead on Congress.gov

Related legislation

Bills by the same sponsor or covering overlapping subjects.