Loading story…
The U.S. Senate passed the bipartisan Health Care Cybersecurity and Resilience Act by unanimous consent, sending it to the House of Representatives for consideration. The legislation would strengthen healthcare providers’ defenses and protect patient information through grants, workforce training, support for rural providers, and updated security requirements. It would also require an HHS cybersecurity incident response plan, clarify sector leadership through the Administration for Strategic Preparedness and Response, and enable tailored threat intelligence from CISA.
The measure follows more than 730 reported healthcare cyber breaches in 2025 that affected over 270 million Americans, with an average cost of $10 million per breach, according to SecurityWeek. Healthcare organizations broadly welcome the legislation, but concerns remain about consistent enforcement and whether federal funding and technical assistance would adequately support compliance. For healthcare security leaders, the bill signals potential changes to security obligations and federal support, but those provisions remain subject to further legislative action.
See the reporting duties and controls this puts on the clock.
9 events from the most recent confirmed update back to the earliest known activity.
Senators Mark Warner and Ron Wyden reintroduced the Health Infrastructure Security and Accountability Act in September 2026 to strengthen and enforce healthcare cybersecurity requirements. The separate legislation was originally introduced in 2024.
The Health Care Cybersecurity and Resilience Act was reintroduced following its failure to pass in the previous congressional term. The legislation seeks to strengthen healthcare cybersecurity and resilience.
A cyberattack against healthcare data company Aesto at the end of 2025 leaked sensitive information belonging to more than 9.5 million people. Aesto informed federal regulators of the incident.
The bipartisan Health Care Cybersecurity and Resilience Act was first introduced in Congress. It did not pass before that congressional term ended.
The Change Healthcare attack caused significant delays in care and electronic prescribing. It is believed to have exposed data belonging to more than 190 million people.
A ransomware attack against Ascension disrupted clinical operations and electronic health records across 11 US states.
The Anthem breach compromised personal information and health records belonging to 78.8 million customers. The reported cost exceeded $115 million.
Finalization of the proposed HIPAA Security Rule update has been delayed until at least July 2027. The Trump Administration has not decided whether to publish the updated rule as a final rule.
The Senate passed the bipartisan Health Care Cybersecurity and Resilience Act by unanimous consent, sending it to the House for consideration. The bill proposes grants, training, rural-provider assistance, updated security requirements, and stronger coordination between HHS and CISA.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
decipher.sc
Open sourcetherecord.media
Open sourcehipaajournal.com
Open sourcesecurityweek.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Senate Health, Education, and Labor (HELP) Committee advanced the bipartisan **Health Care Cybersecurity and Resiliency Act**, legislation aimed at revamping cybersecurity practices at the Department of Health and Human Services (**HHS**). The bill would require the HHS Secretary to develop a comprehensive **cybersecurity incident response plan** and submit it to Congress for review, and it would direct HHS to coordinate with **CISA** on oversight of cybersecurity across the public health and healthcare sectors. Additional provisions include developing cybersecurity guidance for **rural healthcare providers** and initiatives to improve **cybersecurity literacy** across the healthcare workforce. Lawmakers cited the **2024 Change Healthcare** incident as a key catalyst, arguing it demonstrated the sector’s exposure to ransomware and other cyber threats and the systemic risk created by concentrated third-party dependencies. The measure would also designate HHS’ *Administration for Strategic Preparedness and Response* (**ASPR**) as the **Sector Risk Management Agency** for the Healthcare and Public Health sectors. CyberScoop reported the bill passed committee on a **22–1** vote, with Sen. Rand Paul as the lone dissenter, and sponsors including Sen. Bill Cassidy along with Sens. Maggie Hassan, Mark Warner, and John Cornyn.
Jun 29, 2026
The House Energy and Commerce Subcommittee on Health examined the **Healthcare Cybersecurity and Resiliency Act of 2026** and the **Rural Hospital Cybersecurity Enhancement Act** as healthcare breaches remain elevated. By August 30, 496 large breaches had been reported to HHS OCR, exposing more than 74.6 million individuals’ protected health information; hacking and other IT incidents accounted for 426 of those incidents. The bills seek to improve healthcare cyber workforce capacity, funding, federal coordination, patient-data protection, and operational resilience, particularly for rural and resource-constrained providers. Healthcare and Public Health Sector Coordinating Council Cybersecurity Working Group Executive Director Greg Garcia endorsed the legislation with revisions, urging grants, training, community support, safe-harbor protections, and funding to replace unsecurable end-of-life medical devices. He also called for stronger HHS cybersecurity leadership and formal HSCC participation in HHS and CISA policy, threat-sharing, and incident-response efforts. Garcia opposed legislatively prescribed controls, including specific MFA and encryption requirements, and recommended a risk-based framework rather than the proposed prescriptive HIPAA Security Rule update.
Sep 16, 2026
The US Senate Health, Education, Labor, and Pensions (**HELP**) Committee advanced the bipartisan **Health Care Cybersecurity and Resiliency Act** by a 22–1 vote, proposing new baseline cybersecurity requirements for HIPAA-regulated entities. Reported measures include **multifactor authentication**, **data encryption**, **penetration testing**, and **regular security audits**, alongside changes to breach reporting such as requiring entities to report the number of individuals affected and directing HHS to publish post-breach corrective actions and recognized security practices used by the impacted organization. In parallel, HHS’ Office of the National Coordinator for Health IT (**ONC**) proposed reducing health IT certification criteria—cutting from 60 to 34 and modifying seven others—including criteria tied to **privacy and security controls**. Healthcare industry groups (including **CHIME** and the **American Hospital Association**) warned that removing longstanding certification requirements would shift privacy and security compliance burden from health IT developers (e.g., EHR and patient engagement tool vendors) to healthcare providers, potentially weakening standardized security expectations across certified health IT products.
Jun 29, 2026