S 3315
Passed a chamber
Requires the Secretary of Health and Human Services and the Cybersecurity and Infrastructure Security Agency to coordinate on cybersecurity for health care and public health organizations, and directs HHS to adopt minimum cybersecurity standards for covered entities.
Official title: Health Care Cybersecurity and Resiliency Act of 2026
Timeline each lane is a chamber; dates pull from congress.gov actions
House
Received
05-OCT-2026
Senate
Introduced
02-DEC-2025
Referred
02-DEC-2025
Approved by committee
26-FEB-2026
Reported
23-MAR-2026
On the calendar
23-MAR-2026
Passed
30-SEP-2026
- Requires HHS and CISA to create a joint cybersecurity capability plan for responding to significant incidents affecting the health sector within 1 year
- Directs HHS to update HIPAA security regulations to require minimum risk-based practices such as multifactor authentication and encryption, effective 36 months after enactment
- Authorizes HHS grants of up to 3 years to Federally qualified health centers, rural health clinics, nonprofit hospitals, and Indian Health Service facilities to adopt cybersecurity practices
- Requires HHS to convene a working group on reducing duplicative cybersecurity incident reporting
Covers an older version. The newest CRS summary describes the bill as of "Reported to Senate" (23-MAR-2026); the text has changed since (Engrossed in Senate, 30-SEP-2026).
CRS is the Library of Congress's nonpartisan research office. Read it on congress.govHealth
■ 2 R■ 2 D■ 1 I
2 Republicans
2 Democrats
1 Independent