Health Care Cybersecurity and Resiliency Act of 2026
Latest action · Oct 5, 2026 Held at the desk.
Progress
Where this bill reached, and when. A stage with no date was not reached; one that failed a vote and later carried shows the date it carried.
- IntroducedDec 2, 2025
- Passed SenateSep 30, 2026
- Passed HouseNot reached
- To the PresidentNot reached
- Became lawNot reached
Summary
Health Care Cybersecurity and Resiliency Act of 2026
This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.
The bill directs the Department of Health and Human Services (HHS) to
- require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
- more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
- expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
- provide training and best practices to support the expansion of the workforce for health care cybersecurity,
- provide guidance on cybersecurity readiness to rural entities, and
- designate one representative to lead oversight and coordination of cybersecurity activities within HHS.
Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.
Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach).
Cosponsors 5
Members who signed on, in the order they did. Signatures ran from Dec 2, 2025 to Sep 30, 2026; 3 are original cosponsors, there from the day it was introduced.
| Seat | Cosponsor | Signed on | |
|---|---|---|---|
| R-TX | John Cornyn | Original | Dec 2, 2025 |
| D-NH | Margaret Wood Hassan | Original | Dec 2, 2025 |
| D-VA | Mark R. Warner | Original | Dec 2, 2025 |
| I-ME | Angus S. King Jr. | Sep 30, 2026 | |
| R-MS | Cindy Hyde-Smith | Sep 30, 2026 |
Committees 1
Where it was sent and what each committee and subcommittee did with it, in order.
| Chamber | Committee | What it did |
|---|---|---|
| Senate | Health, Education, Labor, and Pensions Committee | Referred Dec 2, 2025Markup Feb 26, 2026Reported Mar 23, 2026 |
Actions 11
Everything that happened, newest first.
- Oct 5, 2026Received in the House.
- Oct 5, 2026Held at the desk.
- Oct 5, 2026Message on Senate action sent to the House.
- Sep 30, 2026Measure laid before Senate by unanimous consent. (consideration: CR S5231-5236)
- Sep 30, 2026The committee substitute withdrawn by Unanimous Consent.
- Sep 30, 2026Passed/agreed to in Senate: Passed Senate with an amendment by Unanimous Consent. (text: CR S5234-5236)
- Mar 23, 2026Committee on Health, Education, Labor, and Pensions. Reported by Senator Cassidy with an amendment in the nature of a substitute. Without written report.
- Mar 23, 2026Placed on Senate Legislative Calendar under General Orders. Calendar No. 365.
- Feb 26, 2026Committee on Health, Education, Labor, and Pensions. Ordered to be reported with an amendment in the nature of a substitute favorably.
- Dec 2, 2025Introduced in Senate
- Dec 2, 2025Read twice and referred to the Committee on Health, Education, Labor, and Pensions.
In the Congressional Record 2
Days the Record’s own index lists this bill, newest first, with the pages and the members it names. Pages starting H are the House, S the Senate, E Extensions of Remarks.
| Where | In the Record | Members | Date |
|---|---|---|---|
| Senate | Debate and remarks S5231–S5236Text printed S5234–S5236Amendments S5231, S5234 | Bill Cassidy R-LA (amendment) | Sep 30, 2026 |
| Senate | Amendments S2703 | Bill Cassidy R-LA (amendment) | Jun 9, 2026 |
Research
What has been written about this bill: committee reports, cost estimates, the sponsor’s authority statement, printed hearings and the Congressional Research Service’s work.
Congressional Budget Office cost estimate
- Apr 20, 2026S. 3315, Health Care Cybersecurity and Resiliency Act of 2026As ordered reported by the Senate Committee on Health, Education, Labor, and Pensions on February 26, 2026
Amendments 1
Amendments offered to this bill.
| Amendment | Description | Offered by | Status |
|---|---|---|---|
| SA 5819 | In the nature of a substitute. | Bill Cassidy R-LA | Amendment SA 5819 agreed to in Senate by Unanimous Consent. |
Titles 4
Every title it has carried, official and short, at each stage.
- Official Title as Introduced
- A bill to require the Secretary of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency to coordinate to improve cybersecurity in the health care and public health sectors, and for other purposes.
- Short Title(s) as Introduced
- Health Care Cybersecurity and Resiliency Act of 2025
- Short Title(s) as Reported to Senate
- Health Care Cybersecurity and Resiliency Act of 2026
- Short Title(s) as Passed Senate
- Health Care Cybersecurity and Resiliency Act of 2026
Subjects
Assigned by the Library of Congress. Policy area: Health.
- Administrative law and regulatory procedures
- Computer security and identity theft
- Computers and information technology
- Congressional oversight
- Department of Health and Human Services
- Employment and training programs
- Government information and archives
- Government studies and investigations
- Health
- Health programs administration and funding
- Public-private cooperation
- Rural conditions and development
Text 3
Each version as it was printed, newest first.
- Sep 30, 2026Engrossed in Senate
- Mar 23, 2026Reported to Senate
- Dec 2, 2025Introduced in Senate
Everything here is as published by Congress: the summary is the Congressional Research Service's, the action wording is the clerks', and the subjects are the Library of Congress's. How far it got is read from the actions themselves, taking the most recent one of each kind, so a bill that failed a vote and later passed is shown as having passed. Records come from this bill on Congress.gov and govinfo.gov; cost estimates are the Congressional Budget Office's, and the hearings are the printed hearings GovInfo publishes, which can appear months after the hearing.
