Legislative status and committee path
S 3315, the Health Care Cybersecurity and Resiliency Act of 2026, is currently active in the Senate. The bill was introduced on December 2, 2025, by Senator Bill Cassidy (R-LA) and was subsequently referred to the Senate Committee on Health, Education, Labor, and Pensions.
On February 26, 2026, the committee ordered the bill to be reported favorably with an amendment in the nature of a substitute. Following this, the bill was officially reported to the Senate on March 23, 2026, and placed on the Senate Legislative Calendar under General Orders (Calendar No. 365). As of the most recent records, there has been no floor vote on the legislation.
Proposed changes to health care cybersecurity
The bill seeks to establish a more robust framework for preventing and responding to cyber threats within the health care and public health sectors. Key provisions include:
Mandatory Practices: The Department of Health and Human Services (HHS) would be directed to require private health care entities to adopt minimum cybersecurity standards, such as multifactor authentication.
Regulatory Oversight: The bill requires HHS to clarify standards for mitigating penalties related to violations of health information privacy and security.
HHS Coordination: The legislation mandates the designation of an HHS representative to oversee and coordinate cybersecurity activities. Additionally, HHS must biennially update a cybersecurity protocol plan for its personnel.
Workforce and Rural Support: The bill directs HHS to provide training and best practices to expand the health care cybersecurity workforce and offer specific guidance to rural entities regarding cybersecurity readiness.
Interagency Collaboration: HHS and the Cybersecurity and Infrastructure Security Agency (CISA) are required to coordinate on health care cybersecurity, including the establishment of a joint capability plan for responding to significant incidents.
Notification Requirements: Health care providers and plans would be required to include the number of individuals affected when notifying parties of unauthorized access to their data.
Research and data context
The following information provides context regarding the bill’s scope and the environment in which it was introduced:
CBO Estimate: The Congressional Budget Office released a cost estimate for S 3315 on April 20, 2026, based on the version ordered reported by the Senate Committee on Health, Education, Labor, and Pensions.
Sponsorship: The bill is sponsored by Senator Bill Cassidy (R-LA) and has three bipartisan cosponsors: Senators John Cornyn (R-TX), Margaret Wood Hassan (D-NH), and Mark R. Warner (D-VA).
Sector Impact: LawLinter analysis indicates the bill intersects with several sectors, most notably technology and data privacy (676 evidence matches) and healthcare (522 evidence matches). Other sectors with identified matches include defense, energy, education, and labor.
Lobbying Disclosure: One lobbying filing from the first quarter of 2026 mentions the bill’s general policy area. It is important to note that lobbying records are provided for disclosure purposes and do not indicate direct influence or causation regarding the bill's development.
Federal Spending Context: While the bill does not authorize specific new spending, LawLinter records link the bill to historical federal award data for the Department of Health and Human Services, totaling approximately $146 billion across 569 sampled awards. These records represent historical agency funding and are not proof of spending caused by this specific legislation.
Legislative records
The bill record currently includes:
Two versions of the bill text.
One official summary.
One linked amendment (119/samdt/5819).
Twenty-six sections analyzed for regulatory and statutory impact, with significant references to 42 U.S.C. 17941 and 6 U.S.C. 650.
