Cybersecurity Policy Report, Bill to Update HIPAA Cyber Rules Clears Senate Committee, (Feb 26, 2026)
Bipartisan legislation that would add new cybersecurity requirements to Health Insurance Portability and Accountability Act (HIPAA) regulations and provide cybersecurity grants to health care providers today cleared the Senate Health, Education, Labor & Pensions Committee by a vote of 22-1.
The Health Care Cybersecurity and Resiliency Act (S.B. 3315, 119th Cong. (2025)) was offered by Sen. Bill Cassidy (R., La.), the committee’s ranking member. Co-sponsors include Sens. Mark Warner (D., Va.), John Cornyn (R., Texas), and Maggie Hassan (D., N.H.).
The provisions of the bill were informed by the findings of a health care cybersecurity working group Sen. Cassidy established and responses to his request for information on ways to improve health care data privacy and security (CPR, Sept. 12, 2023).
The bill would designate the Administration for Strategic Preparedness and Response at the Department of Health and Human Services (HHS) as the sector risk management agency for the health care and public health sector in partnership with the Cybersecurity and Infrastructure Security Agency (CISA), according to a fact sheet.
It would direct HHS to require HIPAA-regulated entities to adopt up-to-date cybersecurity practices, including multifactor authentication, encryption, and network penetration testing.
The bill would authorize a cybersecurity grant program for health care providers during fiscal years 2025-2030, but the amounts of the grants are unspecified and would need to be funded by congressional appropriators.
It would require HHS to add new data points to the information publicly available on the data breach reporting portal established by the 2009 Health Information Technology for Economic and Clinical Health (HITECH) Act. Specifically, HHS would have to disclose whether it took corrective action against health care entities that reported data breaches and whether “recognized security practices” were in place prior to a breach, according to the bill’s text.
HHS also would have to develop a cybersecurity incident response plan for the department and collaborate with CISA to provide cybersecurity training and other resources to the health care sector.
“Cyberattacks on our health care system don’t just compromise data—they can disrupt care, delay treatments, and put lives at risk,” Sen. Warner said in a news release.
“I’m encouraged to see this bipartisan legislation advance through committee. It takes important steps to strengthen our cyber defenses, improve coordination across federal agencies, and ensure that providers—especially those in rural and underserved communities—have the tools they need to protect patients and continue delivering care,” he added.
The bill now heads to the full Senate. Similar legislation introduced last year failed to advance (CPR, Nov. 22, 2024).
MainStory: TopStory FederalLegislation DataSecurity DataPrivacy