In the nature of a substitute.

The amendment, titled the Health Care Cybersecurity and Resiliency Act of 2026, aims to replace the existing text of bill S. 3315 to establish a comprehensive framework for improving cybersecurity within the Healthcare and Public Health Sector.

The primary purpose of this amendment is to mandate coordination between the Secretary of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency (CISA). It focuses on protecting health information systems through better planning, stricter security standards, and increased support for the healthcare workforce.

Key Changes and Additions

• Government Coordination: It requires the Secretary and Director to create a joint cybersecurity capability plan to handle significant incidents and coordinate resources and technical assistance for covered entities and business associates.

• Security Standards: The Secretary must update regulations to require non-governmental entities in the sector to adopt minimum risk-based practices, such as multifactor authentication, encryption of protected health information, and penetration testing.

• Support for Rural Entities: The amendment mandates the creation of best practice guidance and technical assistance specifically for rural entities, including suggestions for cloud migration and outsourcing IT functions.

• Financial and Workforce Aid: It authorizes grants for eligible entities (such as nonprofit hospitals, rural health clinics, and Federally qualified health centers) to hire experts, update systems, and conduct risk assessments. It also requires a strategic plan to grow the healthcare cybersecurity workforce.

• Reporting and Accountability:

  • It adds a requirement to report the number of individuals affected by a breach.
  • It establishes a working group to reduce duplicative reporting of cybersecurity incidents.
  • It requires the Secretary to provide annual reports to Congress on the state of cybersecurity in the sector.

• Incentives: The Secretary is tasked with creating regulations on how recognized security practices and investments can be considered to mitigate fines or audits related to the HIPAA Security Rule.