Skip to main content
S. 3315 119th Congress Senate

Health Care Cybersecurity and Resiliency Act of 2026

Official title: A bill to require the Secretary of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency to coordinate to improve … Show full official titleShow less

Official title: A bill to require the Secretary of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency to coordinate to improve cybersecurity in the health care and public health sectors, and for other purposes.

Introduced: December 2, 2025 Introduced by: Bill Cassidy Republican · Louisiana See on congress.gov
Health Administrative law and regulatory proceduresComputer security and identity theftComputers and information technologyCongressional oversight
More subjectsShow fewer subjects
Department of Health and Human ServicesEmployment and training programsGovernment information and archivesGovernment studies and investigationsHealth programs administration and fundingPublic-private cooperationRural conditions and development
Sign in to write a letter Sign in to watch
 Everywhere this bill has been 12 steps
Introduced
In committee
Reported out
Passed House
Passed Senate
To President
Became law
Oct 5, 2026
Held at the desk.
Oct 5, 2026
Received in the House.
Sep 30, 2026
Passed Senate with an amendment by Unanimous Consent.
Sep 30, 2026
Passed/agreed to in Senate: Passed Senate with an amendment by Unanimous Consent.
Sep 30, 2026
Passed Senate with an amendment by Unanimous Consent. (text: CR S5234-5236)
Sep 30, 2026
The committee substitute withdrawn by Unanimous Consent.
Sep 30, 2026
Measure laid before Senate by unanimous consent. (consideration: CR S5231-5236)
Mar 23, 2026
Committee on Health, Education, Labor, and Pensions. Reported by Senator Cassidy with an amendment in the nature of a substitute. Without written report.
Mar 23, 2026
Placed on Senate Legislative Calendar under General Orders. Calendar No. 365.
Feb 26, 2026
Committee on Health, Education, Labor, and Pensions. Ordered to be reported with an amendment in the nature of a substitute favorably.
Dec 2, 2025
Introduced in Senate
Dec 2, 2025
Read twice and referred to the Committee on Health, Education, Labor, and Pensions.
 Amendments to this bill 1

Amendments propose changes to this bill. Members vote on amendments separately before the final bill vote. An agreed amendment becomes part of the bill; a failed amendment does not.

1 agreed to

AmendmentSponsorPurposeStatusLatest action
SAMDT 5,819 Cassidy, Bill In the nature of a substitute. Agreed to Sep 30, 2026
 Ask about this bill AI · grounded in the bill text

Have a question about what this bill does? Ask in plain English; the answer is drawn from the bill's actual text and official record, and it'll tell you when something isn't in the text rather than guess.

AI answers can be imperfect; always confirm against the full bill text.

What's happening now October 5, 2026

Held at the desk.

 Plain-English summary Congressional Research Service

Health Care Cybersecurity and Resiliency Act of 2026

This bill expands federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors.

The bill directs the Department of Health and Human Services (HHS) to

  • require private health care-related entities to adopt minimum cybersecurity practices (e.g., multifactor authentication),
  • more specifically identify the standards for mitigating penalties relating to violations of health information privacy and security,
  • expand and update biennially a specified plan that details cybersecurity protocols for HHS personnel,
  • provide training and best practices to support the expansion of the workforce for health care cybersecurity, 
  • provide guidance on cybersecurity readiness to rural entities, and
  • designate one representative to lead oversight and coordination of cybersecurity activities within HHS.

Also, HHS and the Cybersecurity and Infrastructure Security Agency (CISA) must coordinate to improve health care cybersecurity, including by (1) providing resources for entities receiving information from HHS or CISA programs, and (2) establishing a joint cybersecurity capability plan to coordinate responses to significant incidents.

Additionally, the bill requires health care providers and plans to include the number of individuals affected when notifying individuals of unauthorized access to health information (i.e., a breach). 

 Bill text 3 versions

Source documents hosted by congress.gov.

 Committees of jurisdiction 1
 Lobbying activity 32

Registered lobbyists who named this bill in their disclosure filings. Source: federal Lobbying Disclosure Act filings.

Bodies those filers lobbied

A filing lists the bills it worked on and the parts of government it contacted in separate sections, so these are the bodies those filers named anywhere in the filing, not a per-bill breakdown.

See all 32 filings →
 Cosponsors 5
All 5 Democratic 2 Republican 2 Independent 1
R
Hyde-Smith, Cindy
Mississippi · Sep 30, 2026
 I
King, Angus S., Jr.
Maine · Sep 30, 2026
 R
Cornyn, John
Texas · Dec 2, 2025
 D
Hassan, Margaret Wood
New Hampshire · Dec 2, 2025
 D
Warner, Mark R.
Virginia · Dec 2, 2025
Cite this page click to expand
APA
U.S. Congress. (2026). S. 3315: Health Care Cybersecurity and Resiliency Act of 2026. 119th Congress. Open America. https://openamerica.io/bill/119-S-3315/
MLA
"S. 3315: Health Care Cybersecurity and Resiliency Act of 2026." 119th Congress, 2026, Open America, https://openamerica.io/bill/119-S-3315/.
Bluebook (legal)
S. 3315, 119th Cong. (2026), https://openamerica.io/bill/119-S-3315/.
Markdown link
[S. 3315: Health Care Cybersecurity and Resiliency Act of 2026](https://openamerica.io/bill/119-S-3315/)
Report a problem