This bill creates a coordinated effort between the Department of Health and Human Services and the federal Cybersecurity and Infrastructure Security Agency to strengthen protections against cyber attacks in hospitals, clinics, and other health care organizations. Right now, health care systems are frequent targets for hackers, and this bill aims to make them more resilient and better prepared to respond when attacks happen.

The bill requires health care organizations to implement specific security measures, including multifactor authentication (like using your phone to verify logins), encryption of patient data, and regular security testing. It also mandates that health care providers report breaches more transparently, with public information about what happened and what corrective actions were taken. The bill gives the government one year to update its rules to reflect these new requirements and provides reasonable time for health care organizations to comply.

To help health care providers actually implement these protections, the bill creates a grant program offering federal funding for smaller hospitals, rural clinics, and community health centers to hire cybersecurity experts, upgrade outdated computer systems, and join information-sharing networks where they can learn about emerging threats. The bill also funds training programs and workforce development to help health care workers understand cybersecurity risks. Special attention is given to rural areas, which often struggle with limited resources and outdated technology, through targeted guidance and a study to track how well these recommendations are being adopted.

Health Care Cybersecurity and Resiliency Act of 2026

Cassidy, Bill

Health Care Cybersecurity and Resiliency Act of 2026This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.The bill directs the Department of Health and Human Services (HHS) to<ul><li> require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),</li><li>more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,</li><li>expand and update biennially a specified plan that details cybersecurity protocols&nbsp;for&nbsp;HHS personnel,</li><li>provide training and best practices to support the expansion of the workforce for health care cybersecurity,&nbsp;</li><li>provide guidance on cybersecurity readiness to rural entities, and</li><li>designate one representative to lead oversight and coordination of cybersecurity activities within HHS.</li></ul>Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).&nbsp;