Federal News
Senate Advances Health Care Cybersecurity Reform
March 12, 2026
The Senate Health, Education, Labor, and Pensions (HELP) Committee has advanced the bipartisan Health Care Cybersecurity and Resiliency Act of 2026, signaling imminent mandatory cybersecurity requirements for HIPAA-regulated entities. Concurrently, the HHS Office for Civil Rights (OCR) is reviewing extensive public comments on proposed HIPAA Security Rule updates aimed at strengthening healthcare cybersecurity protections. These developments indicate a significant shift toward enhanced regulatory oversight, including stricter breach reporting, mandatory implementation of multifactor authentication, encryption, penetration testing, and alignment with national frameworks such as NIST. The legislation also proposes a grant program to support underserved healthcare providers, reflecting a comprehensive approach to cybersecurity resilience in the health sector.
- Why this matters: Procurement professionals should anticipate increased demand for cybersecurity solutions and services that comply with forthcoming mandatory standards impacting HIPAA-regulated entities.
- Organizations involved in healthcare IT and cybersecurity should prepare for tighter compliance requirements and potential grant opportunities supporting cybersecurity infrastructure investments.
- The evolving regulatory landscape underscores the importance of aligning procurement strategies with national cybersecurity frameworks and anticipating enhanced breach reporting obligations.
- Vendors and contractors should consider how these changes affect contract requirements, risk management, and service delivery models in healthcare cybersecurity.
Cyber defense should not be reduced to a costly checklist that delays preparedness, action, and response. We will streamline cyber regulations to reduce compliance burdens, address liability, and better align regulators and industry globally.
— White House Cyber Strategy Document
If passed, the Health Care Cybersecurity and Resiliency Act of 2026 would require HIPAA-regulated entities to make significant investments in cybersecurity infrastructure, including implementing multifactor authentication, encryption, penetration testing, and alignment with national frameworks such as NIST.
— Rajeev Raghavan, Partner at Crowell & Moring LLP
It's a very simple business problem. There's just not enough money in order for folks to do the necessary things.
— Dave Bailey, Vice President, Clearwater
Agencies
Senate Health, Education, Labor, and Pensions Committee, U.S. Department of Health and Human Services, HHS Office for Civil Rights, White House
Locations
Sources
- OCR director defends HIPAA updates: "The cost of doing nothing is very high" | TechTarget · TechTarget · Mar 12
- Senate Advances Bipartisan Health Care Cybersecurity Reform | Crowell & Moring LLP · Crowell & Moring LLP · Mar 11