Should the Senate require private health care entities to adopt minimum cybersecurity practices?
Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315)
Health care groups would have to follow minimum cybersecurity practices, and patients would be told how many people were affected when their health information is breached.
- Requires private health care-related entities to adopt minimum cybersecurity practices, such as multifactor authentication
- Requires providers and plans to include the number of people affected in breach notices
- Directs HHS to provide training and best practices to grow the health care cybersecurity workforce