Senate Passes Health Cyber Bill; House Action Still Needed

The U.S. Senate passed a healthcare cybersecurity bill by unanimous consent on September 30, 2026. It still needs House action before it can become law. The vote creates no new cybersecurity duty for hospitals and starts none of the bill’s enactment-based deadlines.

The Senate-passed text identifies it as the Health Care Cybersecurity and Resiliency Act of 2026, or S. 3315. It would direct the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA) to coordinate resources and prepare for significant incidents affecting healthcare and public health. Its principal planning and reporting deadlines are measured from enactment, which has not occurred.

The Senate vote leaves a decision for the House

Senators Bill Cassidy, Maggie Hassan, John Cornyn and Mark Warner backed the measure. In the Senate health committee’s announcement, Warner said, “I urge the House to act quickly.” The committee also identified Cindy Hyde-Smith and Angus King as cosponsors.

The measure heads to the House for consideration. House approval and enactment remain necessary before the proposed federal duties take effect. For providers, Senate passage signals a possible change in security rules, but it does not itself change the requirements they must meet today.

What HHS and CISA would have to coordinate

The HHS secretary and CISA director would coordinate cybersecurity resources for the healthcare and public-health sector. Their work would include developing material tailored to the sector, sharing threat indicators and defensive measures while protecting against unauthorized disclosure, and offering technical assistance to covered entities and business associates. Those provisions address both preparation before an incident and the exchange of useful information during one.

The agencies would also establish a joint cybersecurity capability plan for significant incidents. It would set protocols for rapid information sharing during sector-wide incidents, provide for coordination with the sector coordinating council, and involve CISA’s state coordinators when an incident affects multiple states. HHS would send the final plan to the relevant Senate and House committees with an explanation of how it meets those requirements.

A separate provision would require the HHS secretary to delegate a representative to lead oversight and coordination of the department’s healthcare cyber-resilience work. The role includes communication with public and private organizations before and during incidents. Implementation and enforcement of the HIPAA Security Rule would remain outside that representative’s assigned activities.

HHS would also expand its Cyber Annex to the All Hazards Plan. That work concerns information systems used by or for the department and would cover risk assessment, prevention, detection, recovery and communication about incidents. The bill calls for consultation with CISA and other federal officials as that plan is developed.

Status and deadlines: what starts when

The proposed schedule has several triggers. The distinction between the Senate vote, enactment and delegation matters because each starts a different clock:

September 30, 2026 — Senate passage: The vote advanced S. 3315 but did not enact it. No deadline measured from enactment began that day.
Within one year after enactment: HHS and CISA would establish their joint capability plan, and HHS would send the final version to Congress. The first annual sector cybersecurity report would also be due, covering significant threats and vulnerabilities, major incidents during the preceding year, the sector’s security posture, HHS actions and recommended improvements.
Within one year after enactment: HHS would expand and implement the Cyber Annex, issue rural cybersecurity guidance, develop a healthcare cybersecurity workforce plan and convene a group to examine duplicative incident-reporting requirements. It would also issue regulations on how recognized security practices are considered in certain enforcement decisions.
Within 60 days after delegation: A report describing the designated representative’s approach to improving cyber resilience would be due to Congress. This clock depends on the delegation, rather than running directly from enactment.
Thirty-six months after enactment: Updated security regulations required by the bill, including each new requirement they establish, would take effect.

The Cyber Annex has another timing condition: its plan description would be due to specified congressional committees at least 60 days before implementation begins. The incident-reporting working group would have 18 months from its first meeting to finish; a further year would be allowed for its recommendations to reach Congress. Without enactment and the later triggering events, these intervals cannot be converted into calendar due dates.

What hospital obligations would look like

The most direct prospective compliance change is a direction for HHS to update security regulations with minimum risk-based cybersecurity practices. The bill names multifactor authentication, encryption of protected health information and monitoring that includes penetration testing. It sets the effective date for the updated regulations and their new requirements at 36 months after enactment, so the Senate vote has not made them immediately enforceable.

The measure would also allow HHS to award grants for cybersecurity best practices to eligible organizations, including nonprofit hospitals, rural health clinics, federally qualified health centers and certain Indian Health Service facilities. Grant awards would be discretionary; eligibility would not guarantee funding. Permitted uses include personnel training, vulnerability assessments and improvements to incident-response plans.

Hospitals and their business associates remain subject to the HIPAA Security Rule’s safeguards for electronic protected health information. The next consequential decision for S. 3315 is in the House. If the bill is enacted, that date will start its federal planning and reporting clocks.