S. 3315 · 119th Congress
Health Care Cybersecurity and Resiliency Act of 2026
Key: what the circles and colors mean
Each circle is a bill. The ring fills as it moves through Congress:
Under the number: the Yea · Nay count of its final (or latest) recorded vote. On a member's page, the small badge is how that member voted: Y Yea / Aye, N Nay / No, P Present, – Not voting.
Gold and violet are only for Yea and Nay; they never mean a party. A member's party is the letter on their photo.
Passed the Senate without a recorded vote. It passed by voice vote or unanimous consent, which don't record how each member voted. Its text can still change before it becomes law.
R
CassidySponsor5 cosponsors · 2 D, 2 R, 1 I
3 signed on when it was introduced; the rest joined later. Cosponsors who withdrew aren't shown.
- Senate Introduced Dec 2, 2025
- Senate Passed Sep 30, 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
What it does: CRS summary · Reported to Senate · Mar 23, 2026
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov
About this bill and sources
Official title: Health Care Cybersecurity and Resiliency Act of 2026
Also known as: Health Care Cybersecurity and Resiliency Act of 2025
Latest action (Oct 5, 2026): Held at the desk.
Policy area: Health · Origin: Senate · Introduced: Dec 2, 2025
Official page on Congress.gov · Bill text (GovInfo) · Status record (XML)
- Senate Introduced Dec 2, 2025
- Senate Passed Sep 30, 2026
No recorded floor vote found.