Congress mandates stronger cybersecurity for hospitals and clinics nationwide

What it does

This bill requires the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA) to coordinate on cybersecurity for hospitals, clinics, and public health entities. It mandates HHS to update security rules requiring multifactor authentication, encryption, and penetration testing; establishes grants for rural and nonprofit health facilities to upgrade cybersecurity; creates a workforce development plan; and requires reporting on cybersecurity incidents and breach response protocols.

Why we flagged it

The bill's core function is to impose minimum cybersecurity standards on health-care entities and coordinate federal response to health-sector cyber threats. It is a regulatory and coordination measure, not a subsidy or carve-out, though it includes grant funding as an implementation tool.

What the text implies

• Grants in Section 10 are discretionary (Secretary 'may' award) and lack appropriations language, so funding is contingent on future budget action; entities may not receive promised support.
• Section 8(d) grants HHS 'enforcement discretion' for entities facing 'extraordinary circumstances,' creating potential for uneven compliance and selective enforcement across providers.
• Rural guidance (Section 9) recommends outsourcing cybersecurity functions to third parties, potentially concentrating security risk in a small number of managed-service providers serving rural health systems.
• Section 12 working group on 'streamlining' breach reporting may result in reduced transparency if duplicative reporting is eliminated without ensuring public access to incident data.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

Ordinary citizens benefit from stronger cybersecurity protections for their health data and reduced risk of hospital system failures during cyberattacks. While compliance costs are imposed on health providers, the bill includes grant funding to offset those costs for rural and nonprofit entities, and the public-health benefit of resilient health systems outweighs the compliance burden.

Who stands to gain

• Rural health clinics and federally qualified health centers (grant recipients)
• Nonprofit hospitals (grant recipients)
• Cybersecurity consulting and managed-service providers (hired under grant funds)
• Cloud-based platform vendors (migration incentivized by grants)

Named in the bill

Department of Health and Human Services (HHS), Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), Health Resources and Services Administration (HRSA), Federal Bureau of Investigation (FBI), Federal Trade Commission (FTC), Securities and Exchange Commission (SEC), Office of the National Cyber Director, State attorneys general, State health departments, Federally qualified health centers, Indian Health Service — and 1 more

Where it stands

5 cosponsors: 2 Democrats, 2 Republicans, 1 Independents.

• Dec 2, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• Dec 2, 2025 — Referred to Senate Committee on Health, Education, Labor, and Pensions · Congress.gov: “Read twice and referred to the Committee on Health, Education, Labor, and Pensions”
• Feb 26, 2026 — Reported out of committee · Congress.gov: “Committee on Health, Education, Labor, and Pensions. Ordered to be reported with an amendment in the nature…”
• Sep 30, 2026 — Passed the Senate · Congress.gov: “Passed Senate with an amendment by Unanimous Consent”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

5 lobbying clients named this bill on 5 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $5,791,000 in lobbying spend. A filing names 21 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 78% of bills with at least one filing.

Bill Cassidy, the sponsor, reported $1,329,254 in PAC receipts in the 2026 cycle.

• American Hospital Association — $4,470,000 on 1 filing
• Advanced Medical Technology Assn — $971,000 on 1 filing
• Fdd Action — $290,000 on 1 filing
• Halcyon Tech, Inc. — $40,000 on 1 filing
• Chartercare Health of Ri (forrmerly Known As Chartercare Health Partners) — $20,000 on 1 filing

Lobbying Disclosure Act filings through Jul 23, 2026. A filing shows who paid to lobby on a bill it names, not what changed.