The Health Care Cybersecurity and Resiliency Act (S. 3315) passed the U.S. Senate by unanimous consent on September 30, 2026, and it would direct HHS to turn a short list of cybersecurity practices into HIPAA Security Rule requirements for covered entities and business associates. The bill is not law. It still has to clear the House, and any rule HHS writes under it would take effect 36 months after enactment. But the practices it names, multifactor authentication, encryption, and monitoring that includes penetration testing, are the same ones an HHS proposal from January 2025 already points toward, which makes the bill a useful signal of where HIPAA is heading. This article explains what the Senate-passed text actually says, how it compares to the pending HIPAA Security Rule proposal, and what healthcare organizations and their vendors can do now.
What the Health Care Cybersecurity and Resiliency Act Does
Where the Bill Stands
S. 3315 is a bipartisan bill led by Senators Bill Cassidy, Maggie Hassan, John Cornyn, and Mark Warner. The Senate Health, Education, Labor, and Pensions Committee reported it in March 2026, and the full Senate passed an amended version by unanimous consent on September 30, 2026. Unanimous consent means no senator objected, so there was no recorded roll-call vote.
That is a Senate vote only. The bill now goes to the House of Representatives, where whether it receives a vote before the current Congress ends in January 2027 is not assured. Until it is enacted and signed, nothing in it binds any organization. Headlines saying the Senate has required encryption or multifactor authentication are a simplification: the bill directs HHS to write those requirements into the HIPAA Security Rule, and it gives HHS a long runway to do it.
Section 8 Directs HHS to Update the HIPAA Security Rule
The core provision for regulated organizations is Section 8. It tells HHS to update the Security Rule so that covered entities, business associates, and non-governmental entities in the Healthcare and Public Health Sector adopt minimum risk-based cybersecurity practices. Four are named: multifactor authentication or a successor technology; encryption of protected health information or a successor technology; requirements to conduct monitoring, including penetration testing, to maintain the protections of information systems; and other minimum standards reflected in national cybersecurity frameworks.
The bill does not leave the content entirely open. HHS must base the practices on national frameworks such as the NIST Risk Management Framework, the NIST Cybersecurity Framework, NIST SP 800-53 Rev. 5, and the NIST AI Risk Management Framework, along with the Health Sector Coordinating Council’s cybersecurity performance goals and CISA’s healthcare-specific performance goals. The resulting regulations would take effect 36 months after enactment, and HHS could use enforcement discretion for organizations facing extraordinary circumstances. The full text is available on Congress.gov.
Two points deserve attention. First, the text says nothing about how often an organization must test, so the cadence for penetration testing would be set in rulemaking. Second, the bill names a broader group than HIPAA covers today. Non-governmental entities in the Healthcare and Public Health Sector appear alongside covered entities and business associates, and the text does not say how HHS would apply Security Rule requirements to organizations outside HIPAA. Vendors that sell into healthcare without signing business associate agreements should watch how that language develops.
Other Provisions That Change Day-to-Day Compliance
Section 7 would require HHS, within one year of enactment, to issue regulations on how it considers recognized security practices when it determines fines, shortens audits, or negotiates mitigating remedies in resolution agreements. Recognized security practices are a concept already written into the HITECH Act, and the bill adds investments to the programs that can count. The regulations would also have to say to what extent the practices must be in place and what an organization must submit to receive credit for them.
Section 6 adds a small but concrete change: breach notifications to individuals would have to state the number of individuals affected. Section 12 requires HHS to convene a working group within one year to find ways to streamline and reduce duplicative incident reporting, with CISA, the SEC, the FTC, the FBI, state attorneys general, and state health departments at the table. Organizations that report the same incident to several regulators have a stake in that outcome.
Sections 3 through 5 are aimed at government rather than regulated organizations. HHS and CISA must build a joint plan for responding to sector-wide incidents, HHS must name a lead for cybersecurity coordination, and HHS must expand its own incident response plan.
Grants and Rural Guidance Without Funding
Section 10 lets HHS award grants of up to three years to federally qualified health centers, Indian Health Service facilities, nonprofit hospitals, rural health clinics, and nonprofits that partner with them. Funds could be used to hire and train cybersecurity staff, update systems, join threat information sharing organizations, contract with third parties, conduct risk and vulnerability assessments, and develop incident response plans. The word that matters is may: the Senate-passed text authorizes the grants but does not authorize an amount, so the money would depend on appropriations.
Section 9 directs HHS to issue guidance for rural entities within one year, and one of the strategies it must explore is outsourcing information technology and chief information security officer functions to third parties on a part-time basis. For small organizations, that is a recognition that a full-time security leader is not always realistic. A Virtual CISO is one way to hold that accountability at the scale an organization needs.
How the Health Care Cybersecurity and Resiliency Act Compares to the HIPAA Security Rule Proposal
The Same Controls With Different Levels of Detail
HHS published a proposed update to the HIPAA Security Rule on January 6, 2025. It covers much of the same ground as Section 8, with specifics the bill leaves out, and HHS’s own fact sheet lists them. The two are easiest to compare side by side.
| Practice | Senate bill (S. 3315) | HHS proposed rule (January 2025) |
|---|---|---|
| Multifactor authentication | Required, or a successor technology | Required, with limited exceptions |
| Encryption of ePHI | Required, or a successor technology | At rest and in transit, with limited exceptions |
| Testing | Monitoring, including penetration testing; cadence left to HHS | Vulnerability scanning every 6 months; penetration testing every 12 months |
| Compliance audit | Not named | At least every 12 months |
| Timing | 36 months after enactment, once HHS updates the rule | No date set; final rule not expected before July 2027 and not certain |
The table shows convergence on controls and divergence on detail. Both name the same core safeguards, but only the proposal sets cadences, and the proposal has stalled: reporting on HHS’s rulemaking schedule places a final rule no earlier than July 2027 and notes it may never be finalized. The bill matters because it would put the requirement in statute. If the House passes it, HHS would be directed to act whether or not the 2025 proposal is ever finalized. If the House does not, the proposal remains the only path, and its future is uncertain.
The Current Rule Already Expects Most of This
None of this means organizations can wait. The current Security Rule is flexible: it treats encryption as an addressable specification and does not name multifactor authentication. But it is not optional on risk. It requires an accurate and thorough risk analysis, and OCR has made failures to perform one the centerpiece of its enforcement since launching its Risk Analysis Initiative in October 2024. An organization that cannot explain why it did not deploy multifactor authentication or encryption on a system holding ePHI has a documentation problem today, whatever Congress does next. Elevate’s guide to the HIPAA security risk assessment covers what a defensible analysis contains.
What Healthcare Organizations and Business Associates Should Do Now
The named practices give a concrete starting point. Five steps follow from the text, in the order they are likely to take time.
Find Where Multifactor Authentication Is Missing or Bypassable
Start with an inventory of every system that stores, transmits, or accesses ePHI, then mark where multifactor authentication is absent, optional, or can be bypassed through legacy protocols, shared accounts, or service credentials. Remote access, administrator accounts, and email are the usual first gaps. The inventory doubles as input to the risk analysis, so the work is not duplicated.
Confirm Encryption at Rest and in Transit End to End
Check encryption on databases, backups, laptops, mobile devices, and the connections between systems, including vendor integrations. A control that is documented but not enforced across every ePHI system is a gap an assessor will find. Where encryption is not used, record the risk-based reason and the alternative, because the current rule still expects that decision to be documented.
Set a Testing Cadence Before One Is Prescribed
Section 8 names penetration testing, and the HHS proposal would require scans every six months and tests every twelve. Organizations that already test on a risk-based schedule can show it was their own judgment; those that do not can start with an annual penetration test and a recurring vulnerability scan. Elevate’s penetration testing practice has delivered 500+ penetration tests, and Vulnerability Management as a Service covers the scanning layer. A test scoped to the systems that hold ePHI is more useful to a HIPAA risk analysis than a generic one.
Anchor the Risk Analysis to a Recognized Framework and Document It
Section 8 and Section 7 both point to national frameworks, and recognized security practices already carry weight in how HHS treats fines and audits under the HITECH Act. Mapping the risk analysis to the NIST Cybersecurity Framework gives an organization a framework to cite, and recording which practices were in place, and since when, builds the evidence the Section 7 regulations would ask for. Elevate’s NIST CSF work and its HIPAA compliance service cover both.
Update Breach Notification Templates and Review Vendor Oversight
If Section 6 becomes law, notifications to individuals will need to state the number of people affected, so update templates and the procedures that feed them. Separately, review how business associates and vendors are assessed. The HHS proposal would require business associates to verify their technical safeguards at least once every twelve months, and a vendor with strong controls and documentation is easier to defend than one with a signed agreement and nothing else. If you want to see where your program stands against the practices Section 8 names, book a call with an Elevate advisor.
Conclusion
The Health Care Cybersecurity and Resiliency Act is not law, and its most important rule would not take effect for at least three years after enactment. What it offers is a clearer picture of where HIPAA is heading: multifactor authentication, encryption, and monitoring that includes penetration testing as minimum requirements, anchored to NIST frameworks and healthcare performance goals. The HHS proposal from January 2025 points the same way, and the two together suggest that these controls are moving from good practice to baseline.
The practical response does not depend on the House. The current Security Rule already expects documented, risk-based decisions on these controls, and OCR enforces the risk analysis requirement today. Organizations that know where multifactor authentication and encryption are missing, test on a defined cadence, and can show which recognized practices they had in place will be ready whichever path the rulemaking takes.
There is no official HIPAA certification, and HHS enforces the rule. Elevate Consult prepares healthcare organizations and their vendors for audits and OCR reviews, from the risk analysis through penetration testing. Book a call with an Elevate advisor to review where your program stands.
Key Takeaways
The Senate-passed bill signals where HIPAA is heading, and most of the work can start now.
- The bill is not law yet. The Senate passed it on September 30, 2026; the House must still act, and any rule would take effect 36 months after enactment.
- The bill directs HHS, it does not write the rules. Section 8 tells HHS to update the Security Rule with multifactor authentication, encryption, and monitoring that includes penetration testing.
- The testing cadence is open. The bill names no frequency; the 2025 HHS proposal suggests every 6 and 12 months but is not final.
- Recognized security practices gain weight. Section 7 would require regulations within one year on how they affect fines, audits, and remedies.
- The grants have no funding amount. Section 10 authorizes grants, but the Senate-passed text sets no appropriation.
- Start with the risk analysis. The current rule already expects documented, risk-based decisions on these controls.
Frequently Asked Questions
What is the Health Care Cybersecurity and Resiliency Act?
The Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315) is a bipartisan Senate bill led by Senators Bill Cassidy, Maggie Hassan, John Cornyn, and Mark Warner. It directs HHS to update the HIPAA Security Rule to require covered entities, business associates, and other non-governmental entities in the Healthcare and Public Health Sector to adopt minimum cybersecurity practices, including multifactor authentication, encryption of protected health information, and monitoring that includes penetration testing. It also creates a grant program, requires guidance for rural providers, and directs HHS and CISA to coordinate on sector-wide incident response. The Senate passed it by unanimous consent on September 30, 2026.
Is the Health Care Cybersecurity and Resiliency Act law?
No. The Senate passed the bill on September 30, 2026, but it must still pass the House of Representatives and be signed by the President before it becomes law. If enacted, HHS would have to update the HIPAA Security Rule, and the text says the updated regulations take effect 36 months after enactment. Whether the House acts before the current Congress ends in January 2027 is uncertain, so organizations should treat the bill as a signal, not a deadline.
What cybersecurity requirements would the bill add to HIPAA?
Section 8 names four categories of minimum risk-based practices for HHS to require: multifactor authentication or a successor technology, encryption of protected health information or a successor technology, requirements to conduct monitoring including penetration testing, and other minimum standards reflected in national cybersecurity frameworks. HHS must base them on frameworks such as the NIST Cybersecurity Framework and NIST SP 800-53 Rev. 5, and on healthcare performance goals from the Health Sector Coordinating Council and CISA. The bill does not set how often testing must occur, so HHS would decide that in rulemaking. HHS could also use enforcement discretion for organizations facing extraordinary circumstances.
How is the bill different from HHS’s proposed HIPAA Security Rule update?
Both name multifactor authentication, encryption, and testing, but they differ in detail and status. The HHS proposal published in January 2025 would require encryption at rest and in transit, vulnerability scanning every six months, penetration testing every 12 months, and an annual compliance audit, but it is not final and a final rule is not expected before July 2027. The bill sets no cadence and leaves the details to HHS, but it would put the requirement in statute with a 36-month effective date. If the bill is enacted, HHS would be directed to update the rule whether or not the 2025 proposal is finalized.
Does the bill provide funding for small or rural providers?
It authorizes grants but not an amount. Section 10 allows HHS to award grants of up to three years to federally qualified health centers, Indian Health Service facilities, nonprofit hospitals, rural health clinics, and nonprofits that partner with them. Funds could go to cybersecurity staff and training, system updates, risk and vulnerability assessments, and incident response plans. The Senate-passed text does not authorize a funding amount, so any money would depend on appropriations. Section 9 also requires HHS to issue guidance for rural entities, including strategies such as part-time outsourcing of IT and chief information security officer functions.