Healthcare cybersecurity bill that lapsed in 2024 clears the Senate by unanimous consent
Senators passed the Health Care Cybersecurity and Resilience Act by unanimous consent after the 2024 version died with its term. If the House agrees, healthcare's security rules get updated, with federal grants and training attached.
The Watch · Security desk
What happened
- Senators Cassidy, Hassan, Cornyn and Warner sponsor the bill and reintroduced it in December 2025.
- The bill provides grants and training for attack prevention and response, adds support for rural clinics, updates existing rules toward best practices and requires an HHS incident response plan.
- It names ASPR the healthcare Sector Risk Management Agency and builds a direct pipeline for CISA to send the sector tailored threat intelligence.
- SecurityWeek counts more than 730 healthcare breaches affecting over 270 million Americans last year, at an average cost of $10 million per breach.
Why it matters
- What it costs cost If federal funding and technical assistance fall behind the new requirements, providers absorb the compliance cost themselves, the strain SecurityWeek reports the security industry is warning about.
- What's now possible capability A provider hit in a multi-state outage like Ascension's would know which federal agency leads the response and where CISA intelligence comes from.
- Who has to decide decision Hospital security leaders can plan toward HHS-driven rule updates built on best practices, but with no grant size or compliance date in the record, any budget set now is an estimate.
Next story · Security · Oct 7
MonsterCloud's owner is charged with passing off purchased ransomware keys as proprietary decryptionConfirmed10 publishers
For a hospital security team, nothing changes until the House acts on the bill [2]. The incidents behind it go back a decade. Anthem's 2015 breach compromised personal information and health records for 78.8 million customers and cost more than $115 million [6]. The 2024 cases hit operations. Ransomware at Ascension disrupted clinical operations and electronic health records across 11 states [7]. The Change Healthcare attack is believed to have exposed data on more than 190 million people, and it delayed care and electronic prescribing [8].
SecurityWeek names ransomware with double extortion, and increasingly pure data extortion, as the main criminal tool against the sector [18]. In its account, hospitals are stuck between government advice not to pay and their duty to patients, and attackers expect them to pay [19]. Cassidy built his case on the care delays. "Cyberattacks on our healthcare sector not only put patients' sensitive health data at risk but can delay life-saving care," he said [4].
Cornyn focused on coordination and rural providers. "This legislation would strengthen interagency coordination and improve security practices for rural providers, ensuring Texans' health care is not delayed or compromised by cyberattacks," Cornyn said [5].
The cost side is less settled. SecurityWeek calls the act a new compliance requirement on healthcare, one that needs full compliance from both the government and the sector [12]. The publication describes the bill as an attempt to provide central guidance across the existing cybersecurity frameworks [13]. It reports that the sector generally welcomes the bill. It also reports cautions from the security industry, not named in the report, that results will depend on how consistently the law is enforced [11]. Taken at face value, SecurityWeek's breach count and average cost [14] put last year's healthcare breach losses above $7.3 billion [16]. The report does not give the size of the grants [15].
What to watch
- House committee or floor action on the bill before the current congressional term ends; the 2024 version lapsed at its term's end.
- Appropriations that put a dollar figure on the grants, training and rural clinic support.
- The text of the regulation updates, which would set what covered entities must implement and by when.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives50
- Confidence65
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The US Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent.
- [2]
Having passed the Senate, the act now heads to the US House of Representatives for consideration.
- [3]
The bill was first introduced in 2024 but failed to pass before the end of that congressional term.
- [4]
"Cyberattacks on our healthcare sector not only put patients' sensitive health data at risk but can delay life-saving care."
- [5]
"This legislation would strengthen interagency coordination and improve security practices for rural providers, ensuring Texans' health care is not delayed or compromised by cyberattacks."
- [6]
The 2015 Anthem breach compromised the personal information and health records of 78.8 million customers and cost more than $115 million.
- [7]
The 2024 ransomware attack against Ascension disrupted clinical operations and electronic health records across 11 US states.
- [8]
The 2024 Change Healthcare attack is believed to have exposed the data of over 190 million people while causing significant delays in care and electronic prescribing.
- [9]
Key elements of the act include grants to improve cyberattack prevention and response and training in best cybersecurity practices; improved support for rural health clinics; better coordination between HHS and CISA; updates to current regulations to ensure use of best cybersecurity practices; and a requirement for the HHS Secretary to develop and implement a cybersecurity incident response plan.
- [10]
The act formalizes inter-agency coordination by establishing the Administration for Strategic Preparedness and Response (ASPR) as the clear Sector Risk Management Agency and building a direct pipeline for CISA to provide tailored, actionable threat intelligence.
- [11]
The act is generally welcomed by the healthcare sector, but the security industry cautions that success will depend on how consistently it is enforced, and there are concerns about the financial strain of compliance if federal funding or technical assistance fails to keep pace with regulatory requirements.
- [12]
SecurityWeek describes the act as a new compliance requirement on healthcare that requires full compliance from both the government and the healthcare sector.
- [13]
The act attempts to provide central cybersecurity guidance across the various existing frameworks.
- [14]
More than 730 cyber breaches affected over 270 million Americans last year, costing an average of $10 million per breach.
- [15]
The reported summary of the act lists its provisions without a grant amount, a compliance deadline or a House schedule.
- [16]
On SecurityWeek's figures, last year's healthcare breach losses exceeded $7.3 billion.
- [17]
The bill was introduced by Senators Bill Cassidy, Maggie Hassan, Jon Cornyn and Mark Warner, and was reintroduced in December 2025.
- [18]
Ransomware coupled with double extortion, and increasingly pure data extortion, is the criminal weapon of choice against healthcare.
- [19]
The healthcare sector is caught between government advice not to pay ransoms and its requirement to protect patients; criminals expect it to pay rather than risk patient health.
Sources
2 independent publishers whose own reporting we read for this story.
- securityweek.comSenate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity
2 articles · October 5, 2026
- therecord.mediaSenate passes healthcare cybersecurity bill after 190 million impacted by Change Healthcare breach
1 article · October 7, 2026
Topics and entities
Entities
- Health Care Cybersecurity and Resilience Act
- Change Healthcare
- Administration for Strategic Preparedness and Response
- Bill Cassidy
- Mark Warner
- US Department of Health and Human Services
- American Hospital Association
- Maggie Hassan
- CISA
- John Cornyn