Health Care Cybersecurity and Resiliency Act of 2026

The Health Care Cybersecurity and Resiliency Act of 2025 requires the Department of Health and Human Services (HHS) to develop a cybersecurity incident response plan within one year, including strategies for risk assessment, prevention, detection, and recovery. It mandates new cybersecurity standards for healthcare entities, such as multifactor authentication for systems holding protected health information, encryption requirements, and mandatory audit protocols. The bill also updates breach reporting rules to require public disclosure of corrective actions and security practices considered during investigations, while creating grants to help rural healthcare providers adopt cybersecurity best practices. Additionally, it establishes training programs for healthcare cybersecurity staff and requires HHS to issue guidance on recognizing security practices that may reduce fines for covered entities. These provisions directly affect hospitals, clinics, and health organizations handling protected health information.