Senate Unanimously Passes the Health Care Cybersecurity and Resiliency Act

What Happened

The U.S. Senate unanimously passed the Health Care Cybersecurity and Resiliency Act on October 5, 2026, marking a significant legislative milestone in federal healthcare cybersecurity policy. The Act, which had been under consideration for over a year, received bipartisan support and now advances to the House of Representatives for consideration.

The legislation establishes a comprehensive framework for strengthening cybersecurity across the healthcare sector, which has endured a sustained wave of ransomware attacks, data breaches, and operational disruptions. The Act's passage comes amid heightened scrutiny following several high-profile attacks on hospital systems and health IT vendors that disrupted patient care and compromised millions of health records.

Who Is Affected

The Act applies broadly across the healthcare ecosystem:

• HIPAA-covered entities — hospitals, health systems, physician practices, health plans, and clearinghouses
• Business associates — billing companies, EHR vendors, cloud service providers, and managed security service providers serving healthcare clients
• Health IT vendors — including electronic health record platforms, telehealth providers, and medical device manufacturers with network connectivity
• Rural and safety-net providers — who receive new grant funding opportunities for cybersecurity upgrades

Critically, the Act clarifies enforcement authority and establishes a dedicated healthcare cybersecurity coordination office within the Department of Health and Human Services (HHS) to streamline incident reporting and threat intelligence sharing.

Key Provisions

Mandatory Minimum Security Standards

The Act codifies minimum cybersecurity practices for covered entities, aligning closely with recognized frameworks including NIST CSF and the HIPAA Security Rule. Organizations must implement multi-factor authentication, network segmentation, encryption at rest and in transit, and continuous monitoring.

Accelerated Incident Reporting

Covered entities must notify HHS of significant cybersecurity incidents within 72 hours — down from the current 60-day breach reporting window for PHI breaches exceeding 500 individuals. Ransomware payments must be reported separately, with detailed documentation.

Grant Program for Rural Healthcare

The Act authorizes $800 million over five years for cybersecurity improvement grants to critical access hospitals, rural health clinics, and small physician practices. Eligible expenses include security assessments, technology upgrades, staff training, and incident response retainers.

Third-Party Risk Management Requirements

Business associates face expanded due diligence obligations, including contractual security attestations and annual third-party audits. Covered entities must maintain an inventory of all vendors with access to PHI or network connectivity to clinical systems.

Compliance Implications

The Act builds directly on current HIPAA expectations and is widely viewed as formalizing what HHS OCR has signaled through enforcement actions and guidance. Organizations should anticipate:

• Audit readiness — Expect increased OCR audits focused on security controls, access management, and incident response capabilities
• Business associate agreements — BAAs will require updates to reflect new security attestation and incident notification requirements
• Board-level accountability — The Act encourages governance structures that elevate cybersecurity oversight to boards and executive leadership
• Convergence with state laws — Several states (New York, California, Texas) have enacted or proposed healthcare cybersecurity laws; this federal framework provides a consistent baseline

What Organizations Should Do Now

Although the Act still requires House passage and presidential signature, the trajectory is clear. Healthcare organizations should begin preparation immediately:

1. Conduct a security maturity assessment against NIST CSF or the HHS 405(d) Health Industry Cybersecurity Practices 2. Close critical control gaps — prioritize MFA deployment, network segmentation, backup immutability, and endpoint detection 3. Review and update incident response plans to accommodate the 72-hour reporting threshold 4. Inventory all third-party vendors with PHI access and begin collecting security attestations 5. Document ransomware response policies including payment decision frameworks and reporting procedures 6. Engage legal counsel to prepare updated BAAs and vendor contract language 7. Monitor legislative progress and HHS rulemaking deadlines

The unanimous Senate vote signals strong bipartisan consensus that voluntary cybersecurity guidance has been insufficient. Healthcare organizations that treat this legislation as a compliance roadmap — rather than waiting for final rulemaking — will be better positioned to protect patient data and avoid enforcement exposure.

Organizations should also watch for companion rulemaking from HHS OCR that will define technical specifications and compliance timelines.