The U.S. Senate has passed S. 3315, the Health Care Cybersecurity and Resiliency Act of 2026, by unanimous consent. The bill would direct the Department of Health and Human Services (HHS) to update the HIPAA security regulations to require minimum cybersecurity practices, including multifactor authentication, encryption of protected health information (PHI), and monitoring that includes penetration testing. The engrossed text published by the Government Publishing Office records that it "Passed the Senate September 30, 2026." Passage by unanimous consent means there was no recorded roll-call vote.
The bill is not law. It now goes to the House, and The Record reported that Republican and Democratic House leaders did not respond to requests for comment. If enacted, the new security requirements would apply to HIPAA covered entities, their business associates, and non-governmental entities in the Healthcare and Public Health (HPH) sector.
Sen. Bill Cassidy (R-La.) is the sponsor, and The Record reported that Sens. Maggie Hassan (D-N.H.), Mark Warner (D-Va.) and Angus King (I-Maine) backed the bill. The Record tied the vote to the 2024 Change Healthcare ransomware attack, which it said exposed sensitive health information of 190 million people. "Cyberattacks can shut down hospitals and expose patients' private medical records," Cassidy said, as quoted by The Record. In a statement quoted by The Record, Warner said: "I'm proud to have helped pass this critical legislation through the Senate, and I urge the House to act quickly."
How the bill got here
- February 26, 2026 (Senate HELP Committee): The Health, Education, Labor and Pensions Committee advanced the bill 22-1. CyberScoop reported that Sen. Rand Paul (R-Ky.) cast the only vote against it. Opening that session, Cassidy said: "Last year there were more than 730 cyber breaches affecting over 270 million Americans."
- September 30, 2026 (full Senate): Passed by unanimous consent, according to the engrossed text.
- Next: House consideration.
What the bill requires
The engrossed text has 12 sections. Most concern how HHS organizes its own cybersecurity work and coordinates with other agencies. Section 8 is the part that would change obligations for hospitals, health plans and their vendors.
Section 8: Required cybersecurity standards
Section 8 directs HHS to update the HIPAA security regulations so that covered entities, business associates and non-governmental HPH-sector entities must adopt "minimum risk-based cybersecurity practices," including:
- multifactor authentication, or a successor technology
- encryption of protected health information, or a successor technology
- monitoring, including penetration testing, to maintain the protections of information systems
- other minimum standards reflected in national cybersecurity frameworks
The practices are to be based on NIST frameworks (including the Risk Management Framework, the Cybersecurity Framework, SP 800-53 Rev. 5 and the AI Risk Management Framework), the Health Sector Coordinating Council's cybersecurity performance goals, and CISA's health care-specific performance goals. The updated rules would take effect 36 months after enactment, and HHS could exercise enforcement discretion for entities facing "extraordinary circumstances." HHS, not Congress, would write the detailed requirements.
Section 7: Recognized security practices
Within one year of enactment, HHS would have to issue regulations on the "recognized security practices" it may weigh when setting HIPAA fines, the documentation entities must submit, and how those practices affect fines, early favorable termination of audits and mitigating remedies.
Section 6: Breach notices must include a count
The bill amends section 13402(f) of the HITECH Act so that breach notifications to individuals must state "the number of individuals affected by the breach."
Government coordination and planning
- Section 3 requires HHS and the Cybersecurity and Infrastructure Security Agency (CISA) to coordinate and, within one year, establish a joint plan for responding to significant cybersecurity incidents affecting the sector.
- Section 4 has the HHS Secretary delegate a single representative to lead oversight and coordination of the department's sector cybersecurity activities, explicitly excluding enforcement of the HIPAA Security Rule. In its February report on the committee version, CyberScoop said the bill would designate HHS's Administration for Strategic Preparedness and Response (ASPR) as the Sector Risk Management Agency for health care; the Senate-passed text does not name ASPR.
- Section 5 requires HHS, within one year, to expand and implement the Cyber Annex of its All Hazards Plan to cover incidents involving the department's own information systems, reviewing it at least every two years and after significant incidents.
- Section 12 convenes a working group within one year to reduce duplicative cyber incident reporting. Members would include CISA, the SEC, the Office of the National Cyber Director, the FBI, the FTC, state attorneys general, state health departments and private-sector health care entities.
Support for under-resourced providers
- Section 9 directs HHS to issue rural cybersecurity readiness guidance within one year and to provide technical assistance, followed by a GAO review within three years.
- Section 10 authorizes grants of up to three years. Eligible recipients are federally qualified health centers, Indian Health Service facilities, nonprofit hospitals, rural health clinics, and nonprofits that partner with or coordinate referrals with them.
- Section 11 requires cybersecurity training for HPH-sector entities and a workforce strategic plan within one year.
Who has concerns
The American Hospital Association supports the bill, particularly its grant funding, but wants clarity on whether the rules will extend to third-party vendors, The Record reported. "We believe third parties handling health information should be held to the same privacy and security standards" as covered entities and business associates, the AHA said, according to The Record. The AHA also said most PHI breaches reported to the HHS Office for Civil Rights came from hacking incidents targeting non-hospital providers, including third-party service and software providers.
What It Means for Defenders
What changed is that one chamber has approved a statutory mandate; nothing binds covered entities until the House passes the bill, the President signs it, and HHS completes rulemaking. For hospitals, health plans and business associates, the useful work now is a gap assessment against the controls Congress named:
- MFA coverage. List every access path to PHI systems, including remote access, VPN, email, EHR portals, admin consoles and vendor support accounts, and prioritize those that still accept a password alone.
- Encryption map. Document where PHI is stored and how it moves, including backups, laptops, file shares, cloud storage and transfers to business associates, recording whether each is encrypted at rest and in transit.
- Testing cadence. If penetration testing is occasional or external-only, set a regular schedule that includes internal networks and clinical systems, and track findings to closure.
- Vendor terms. Given the AHA's open question about third parties, review business associate agreements for MFA, encryption and breach-notification requirements now rather than waiting for HHS to settle vendor scope.
- Affected-person counts. Make sure logging and data inventories can produce a defensible count of affected individuals, since breach notices would have to include one.
Smaller and rural providers have a separate interest: if the bill is enacted, the grant program and rural guidance would be the main sources of federal help.
