S. 3315 — Health Care Cybersecurity and Resiliency Act of 2026

This section defines terms used in the Act, including the Agency as the Cybersecurity and Infrastructure Security Agency, covered entities and business associates under section 160.103 of title 45, Code of Federal Regulations, cybersecurity incidents under section 3552 of title 44, United States Code, and the Healthcare and Public Health Sector as identified in National Security Memorandum–22.

This section directs the Secretary of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency to coordinate, including through a cooperative agreement, to improve cybersecurity in the Healthcare and Public Health Sector. It requires them to develop sector-specific products, share cyber threat indicators and defensive measures, and provide technical assistance to covered entities and business associates, and to establish and submit to Congress a joint cybersecurity capability plan within one year of enactment that includes protocols for rapid information sharing and coordination with the sector council and state coordinators.

This section directs the Secretary of Health and Human Services to delegate a representative to lead oversight and coordination of cybersecurity resilience activities in the Healthcare and Public Health Sector, including incident preparedness and response with public and private entities, but excluding enforcement of the HIPAA Security Rule. It requires a delegation report to the Senate HELP and House Energy and Commerce Committees within 60 days and annual reports assessing sector threats, incidents, posture, HHS actions, and recommendations.

This section directs the Secretary of Health and Human Services to expand and implement the Cyber Annex of the All Hazards Plan within one year after enactment of the Health Care Cybersecurity and Resiliency Act of 2026. The plan must address cybersecurity incidents involving HHS information systems and include strategies to assess risks, prevent and detect incidents, minimize damage, protect data, recover expeditiously, and share non-sensitive information with the Healthcare and Public Health Sector; it requires consultation with the Directors of CISA, OMB, and NIST, updates at least every two years and after significant incidents, and a report to specified Senate and House committees 60 days before implementation. It also defines cybersecurity incident and cybersecurity risk.

This section expands the definition of recognized security practices to include investments. It directs the Secretary of Health and Human Services to issue regulations within one year that specify recognized security practices for consideration in HIPAA Security Rule fines and audits, the required duration and documentation of such practices, and the procedures for covered entities and business associates to submit information. It also requires the Secretary to include in the annual HITECH Act report, beginning two years after enactment, an accounting of every case in which recognized security practices were considered when assessing fines or terminating audits.

This section requires the Secretary to update HIPAA security regulations to mandate that non-governmental entities in the Healthcare and Public Health Sector, covered entities, and business associates adopt minimum risk-based cybersecurity practices, including multifactor authentication, encryption of protected health information, and monitoring with penetration testing, based on specified NIST frameworks, Health Sector Coordinating Council goals, and CISA healthcare cybersecurity performance goals. The requirements take effect 36 months after enactment, with enforcement discretion for extraordinary circumstances.

This section directs the Secretary to issue guidance within one year of enactment of the Health Care Cybersecurity and Resiliency Act of 2026 on best practices for rural entities—defined using the Federal Office of Rural Health Policy standard—to improve cybersecurity readiness, including infrastructure safeguards, workforce training, incident reporting, and options such as outsourcing IT functions or migrating to cloud platforms. It also requires the Secretary to provide technical assistance for implementation and directs the Comptroller General to study and report within three years on adoption and related challenges to the Senate HELP and House Energy and Commerce Committees.

This section authorizes the Secretary to award grants for periods of up to 3 years to federally qualified health centers, Indian Health Service facilities, nonprofit hospitals, rural health clinics, and partnering nonprofits to adopt and implement cybersecurity best practices. Eligible uses include hiring cybersecurity experts, training staff, migrating to cloud-based systems, participating in threat information sharing, conducting risk assessments, and developing incident response plans, with priority given to entities demonstrating need.

This section directs the Secretary to train Healthcare and Public Health Sector entities on cybersecurity risks to their information systems and on mitigation methods. It also requires development, within one year of enactment, of a strategic plan to expand the cybersecurity workforce for health care entities that covers educational programs, materials, rural facilities, artificial intelligence applications, public-private partnerships, and alignment with the National Initiative for Cybersecurity Education Workforce Framework.

This section directs the Secretary to convene a working group within 1 year of enactment, including representatives from the Cybersecurity and Infrastructure Security Agency, Securities and Exchange Commission, Office of the National Cyber Director, Federal Bureau of Investigation, Federal Trade Commission, state attorneys general, state health departments, and private sector health care entities, to examine ways to streamline and reduce duplicative cybersecurity incident reporting. The working group must conclude within 18 months of its first meeting, after which the Secretary has 1 year to submit a report to the Senate HELP Committee and House Energy and Commerce Committee identifying streamlining opportunities, making recommendations to Congress, and addressing coordination with state breach notification laws.