S. 3315 · Where this bill is now
In the House
Passed the Senate Sep 30, 2026. Received Oct 5, 2026; no House vote yet
What this bill does
In plain words · AI-written from the official summaryStrengthens cybersecurity rules for health care providers
This bill pushes the federal government to set stronger cybersecurity standards across health care. It requires private health care organizations to use modern security practices like multifactor authentication (basically, extra steps to verify you're really you when logging in). The government will also provide training and resources to help the health care workforce build cybersecurity skills, work with rural health care facilities, and coordinate responses when major security breaches happen.
How it affects you
If you receive health care or have health insurance, this affects you because it aims to better protect your medical information from cyber attacks. When there's a breach of your health information, your health care provider or insurance plan would have to tell you exactly how many people were affected, so you know the scope of the problem. Health care workers and rural health care facilities would gain access to better training and guidance to keep your data safer.
Read the official summary (Reported to Senate, Mar 23, 2026)
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
• require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
• more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
• expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
• provide training and best practices to support the expansion of the workforce for health care cybersecurity,
• provide guidance on cybersecurity readiness to rural entities, and
• designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Written by AI (Claude) using only the official summary by the Congressional Research Service, the Library of Congress’s nonpartisan research staff. It can miss nuance, so check the official summary and the bill text for details.
1st SessionS. 3315
AN ACT
Health Care Cybersecurity and Resiliency Act of 2026
Sponsor: Sen. Bill Cassidy (R-LA) · Introduced Dec 2, 2025 · Health · 3 versions of the text
Sources: Congress.gov actions and votes · bill text from GovInfo · latest official action Oct 5, 2026: “Held at the desk.”
Sections
Opens on the most recent version where something changedSections · 7
- Sec. 1Short titleChanged
- Sec. 2DefinitionsChanged
- Sec. 3Department coordination with the AgencyChanged
- Sec. 4Clarifying cybersecurity responsibilities at the Department of Health and Human ServicesChanged
- Sec. 5Cybersecurity incident response planChanged
- Sec. 10Guidance on rural cybersecurity readinessChanged
- Sec. 12Healthcare cybersecurity workforceChanged
2 more sections may have moved or been renamed, but the match wasn’t strong enough to confirm. They are not counted above.