S. 3315 — Health Care Cybersecurity and Resiliency Act of 2026

This section defines terms used in the Act, including (1) Agency (i.e., Cybersecurity and Infrastructure Security Agency); (2) cybersecurity incident (as defined in 44 U.S.C. 3552); (3) Cybersecurity State Coordinator (as appointed under 6 U.S.C. 665c(a)); (4) Director (i.e., Director of the Agency); (5) Healthcare and Public Health Sector (as identified in Presidential Policy Directive 21); (6) Information Sharing and Analysis Organization (as defined in 6 U.S.C. 650); (7) information system (as defined in 6 U.S.C. 1501); and (8) Secretary (i.e., Secretary of Health and Human Services).

This section directs the Secretary and the Director to coordinate, including by entering into a cooperative agreement as appropriate, to improve cybersecurity in the healthcare and public health sector. It further requires the Secretary to coordinate with the Director to make resources available to entities receiving shared information through programs managed by either official—including information sharing and analysis organizations (ISAOs), information sharing and analysis centers (ISACs), and non-federal entities—by (1) developing products specific to healthcare and public health sector entities and (2) sharing cyber threat indicators and appropriate defensive measures.

This section establishes oversight of cybersecurity activities within the Department of Health and Human Services (HHS). The HHS Secretary, acting through the Assistant Secretary for Preparedness and Response and in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) Director pursuant to the Homeland Security Act of 2002, must lead coordination to support cybersecurity resiliency in the Healthcare and Public Health Sector—including communication with public and private entities on incident preparedness and response—consistent with applicable law and Presidential Policy Directive 21 (February 12, 2013).

This section amends Section 405 of the Cybersecurity Act of 2015 (6 U.S.C. 1533) as follows: (1) in subsection (a), inserts definitions of "cybersecurity incident" (cross-referencing the term "incident" in 44 U.S.C. 3552) and "cybersecurity risk" (cross-referencing 6 U.S.C. 650) as new paragraphs (4) and (5), respectively, redesignates former paragraphs (4) through (7) as paragraphs (6) through (9), and makes conforming changes to former paragraph (4); and (2) in subsection (d), requires the Secretary of Health and Human Services to develop and implement, not later than one year after enactment, a cybersecurity incident response plan for department information systems that addresses risk assessment, prevention, detection, damage minimization, data protection, and recovery, developed in consultation with the directors of the Cybersecurity and Infrastructure Security Agency, Office of Management and Budget, and National Institute of Standards and Technology and relevant experts, with a report describing the plan due to specified congressional committees 60 days before implementation.

This section directs the Secretary of Health and Human Services to update, not later than one year after enactment, regulations for the HIPAA breach reporting portal (i.e., the public website displaying information on breaches of unsecured protected health information affecting more than 500 individuals) to require public display of additional breach information, including (1) any corrective action taken against the covered entity that notified of the breach, (2) whether and to what extent recognized security practices were considered in the breach investigation, and (3) such other breach information as the Secretary requires.

This section amends the recognized security practices provision of the HITECH Act (42 U.S.C. 17941(b)(1)) to include investments, in addition to policies, procedures, and other programs, as factors the Secretary of HHS may consider to reduce civil monetary penalties for HIPAA violations. The section further directs the Secretary to issue guidance within one year of enactment on implementing such practices—including examples of practices considered for fines, required extent of implementation, and submission procedures for covered entities and business associates—and to include annual reporting on implementation and cases considered, beginning two years after enactment, in the existing HIPAA breach report to Congress. (As background, recognized security practices, such as those aligned with NIST cybersecurity frameworks, allow entities demonstrating proactive security measures prior to a breach to receive reduced penalties.)

This section directs the Secretary of Health and Human Services to update HIPAA privacy, security, and breach notification regulations (45 C.F.R. pts. 160 and 164) to require covered entities (i.e., health plans, providers, and clearinghouses) and business associates to adopt specified cybersecurity practices for systems handling protected health information (PHI), including (1) multifactor authentication or successor technology for system access; (2) safeguards to encrypt PHI; (3) audits including penetration testing; and (4) other minimum standards determined by the Secretary in consultation with the private sector based on cybersecurity vulnerabilities and best practices. The Secretary must specify effective dates for each requirement, providing reasonable time for compliance.

This section directs the Secretary of Health and Human Services (HHS) to issue, not later than one year after enactment, guidance to rural entities (as defined by the Health Resources and Services Administration) on best practices to improve cybersecurity readiness, including strategies to enhance cyber infrastructure with technical safeguards, integrate HHS cybersecurity best practices, bolster employee preparation through public-private educational programs, and facilitate compliance with mandatory cybersecurity incident reporting requirements. It further requires the Comptroller General of the United States to conduct a study on rural entities' implementation of this guidance and submit a report to the Senate Committee on Health, Education, Labor, and Pensions and the House Committee on Energy and Commerce not later than three years after enactment, assessing implementation of safeguards and related challenges, steps to support cyber resilience, opportunities to improve federal agency coordination on cyber reporting, and public-private collaboration prospects.

This section establishes a grant program under the Public Health Service Act authorizing the HHS Secretary to award grants to eligible entities—including public or nonprofit health centers (including Federally Qualified Health Centers), Indian Health Service facilities, hospitals, cancer centers, rural health clinics, academic health centers, and partnering nonprofits—for adopting cybersecurity best practices. Grant funds may be used to hire and train personnel, update electronic data systems (such as cloud migration), join cybersecurity threat information-sharing organizations, reduce legacy systems, or contract with third parties; grants are for up to three years, require applications with baseline measures and benchmarks for outcome evaluation, and are authorized at such sums as necessary for FY2025 through FY2030.

This section directs the Secretary of Health and Human Services (HHS), in coordination with Cybersecurity State Coordinators of the Cybersecurity and Infrastructure Security Agency (CISA) and private sector health care experts as appropriate, to provide training to Healthcare and Public Health Sector asset owners and operators on cybersecurity risks to sector information systems and ways to mitigate those risks. (As background, the Healthcare and Public Health Sector is one of 16 U.S. critical infrastructure sectors responsible for medical care delivery, public health services, and related systems.) The section further requires HHS, acting through the Health Resources and Services Administration (HRSA) Administrator and in coordination with CISA, to develop by one year after enactment a strategic plan to grow the cybersecurity workforce for health care entities, including (1) recommendations for existing educational programs to support cybersecurity training, (2) dissemination and development of educational materials on improving cybersecurity resilience, (3) development of best practices to train the health care workforce on cybersecurity, and (4) opportunities for public-private collaboration to strengthen the cybersecurity workforce.