The Senate passed the measure by unanimous consent. Breach notices would also have to state the total number of people affected.

 

What happened

The Senate passed the Health Care Cybersecurity and Resiliency Act of 2026 by unanimous consent, The Record reported. The bill, S. 3315, directs the Department of Health and Human Services to require private healthcare entities to adopt minimum cybersecurity standards, including multifactor authentication. Multifactor authentication means signing in with something beyond a password, such as a code or a security key. Senator Bill Cassidy, a Louisiana Republican, introduced the bill. Senators Maggie Hassan of New Hampshire, Mark Warner of Virginia, and Angus King of Maine backed it. The House has not yet acted.

 

Going deeper

The bill covers more than the minimum standards. HHS would expand its cybersecurity plan for its own staff and update it every two years. It would provide training and best practices to grow the healthcare cybersecurity workforce. Rural providers would get guidance on cyber readiness. One HHS official would be designated to lead and coordinate the department's cybersecurity work. HHS would also work with CISA to share cybersecurity information with healthcare organizations. The two agencies would build a joint plan for responding to major incidents. The bill was introduced after the ransomware attack on Change Healthcare, which exposed the health information of 190 million people.

 

What was said

"Cyberattacks can shut down hospitals and expose patients' private medical records," Cassidy said, quoted by The Record. Warner called on the House to "act quickly." The American Hospital Association, which represents nearly 5,000 hospitals and health systems, supported the bill and welcomed its grant funding. It asked for more clarity on whether the rules would cover third-party vendors. "We believe third parties handling health information should be held to the same privacy and security standards as covered entities and business associates," the association said.

 

In the know

Breach notices would change too. Under the bill, healthcare organizations would have to state the total number of people affected when notifying individuals that their health information was accessed. Notices don't always include that figure today. iRhythm, which began notifying patients this month about a June breach, has filed counts with individual states. Those show 298,647 people in Texas and 69,526 in South Carolina. The company hasn't published a national total, BankInfoSecurity reported. A patient reading a letter under the proposed rule would see the full scope of the incident they were caught up in.

 

The big picture

The vendor question the hospital association raised is where much of the recent damage has come from. Third parties were involved in 32% of healthcare breaches in Verizon's latest data, according to its 2026 healthcare snapshot. Verizon said a single flaw in widely used business software contributed to that figure, affecting several healthcare organizations at once. Recent vendor breaches include Aesto, which reported more than 9.5 million people affected, and CareCloud at 3.7 million. Whether the bill's standards reach vendors directly, or only through the hospitals and plans that hire them, will decide how much of that exposure it actually covers. Covered entities can act now without waiting for the House, by checking whether their vendor contracts already require multifactor authentication.

 

FAQs

What happens after Senate passage?

The House has to pass the same text before it can go to the President. House leaders from both parties didn't respond to The Record's requests for comment.

 

Would the standards apply to small practices?

The bill says private healthcare-related entities. How HHS defines and applies that in practice would be set during implementation.

 

What does a joint HHS and CISA response plan do?

It sets out how the two agencies coordinate during a major incident, including who shares information with healthcare organizations and when.

 

Does the bill change HIPAA?

Not directly. It directs HHS to set standards and add a requirement to breach notices. Existing HIPAA obligations stay in place.

 

Why does the total number of affected people matter in a notice?

It tells each person how large the incident was. That helps them judge the risk and makes it easier to compare what they've been told with what the organization reports to regulators.