Senate passes bipartisan bill setting cybersecurity rules for health care
The Senate passed the Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315) by unanimous consent on September 30, 2026. The bipartisan bill, sponsored by Sens. Bill Cassidy, Maggie Hassan, John Cornyn and Mark Warner, would require HHS and the Cybersecurity and Infrastructure Security Agency to coordinate on responding to health sector cyberattacks, require private health care entities to adopt baseline cybersecurity practices such as multifactor authentication aligned with NIST frameworks, fund cybersecurity grants including for rural clinics, and add a requirement to disclose the number of people affected in breach notifications. The bill now goes to the House of Representatives.
Why it's notable: If it becomes law, the bill would set new minimum cybersecurity practices and incident-response obligations for hospitals and clinics at a time when ransomware and data breaches are already costly and disruptive for health systems, though it still needs House passage and a presidential signature.