Security1 publisher2 min readPublished
Healthcare cybersecurity bill that lapsed in 2024 clears the Senate by unanimous consent
Senators passed the Health Care Cybersecurity and Resilience Act by unanimous consent after the 2024 version died with its term. If the House agrees, healthcare's security rules get updated, with federal grants and training attached.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Senators Cassidy, Hassan, Cornyn and Warner sponsor the bill and reintroduced it in December 2025.
- The bill provides grants and training for attack prevention and response, adds support for rural clinics, updates existing rules toward best practices and requires an HHS incident response plan.
- It names ASPR the healthcare Sector Risk Management Agency and builds a direct pipeline for CISA to send the sector tailored threat intelligence.
- SecurityWeek counts more than 730 healthcare breaches affecting over 270 million Americans last year, at an average cost of $10 million per breach.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- cost If federal funding and technical assistance fall behind the new requirements, providers absorb the compliance cost themselves, the strain SecurityWeek reports the security industry is warning about.
- capability A provider hit in a multi-state outage like Ascension's would know which federal agency leads the response and where CISA intelligence comes from.
- decision Hospital security leaders can plan toward HHS-driven rule updates built on best practices, but with no grant size or compliance date in the record, any budget set now is an estimate.
For a hospital security team, nothing changes until the House acts on the bill [4]. The incidents behind it go back a decade. Anthem's 2015 breach compromised personal information and health records for 78.8 million customers and cost more than $115 million [8]. The 2024 cases hit operations. Ransomware at Ascension disrupted clinical operations and electronic health records across 11 states [9]. The Change Healthcare attack is believed to have exposed data on more than 190 million people, and it delayed care and electronic prescribing [10].
SecurityWeek names ransomware with double extortion, and increasingly pure data extortion, as the main criminal tool against the sector [11]. In its account, hospitals are stuck between government advice not to pay and their duty to patients, and attackers expect them to pay [12]. Cassidy built his case on the care delays. "Cyberattacks on our healthcare sector not only put patients' sensitive health data at risk but can delay life-saving care," he said [5].
Cornyn focused on coordination and rural providers. "This legislation would strengthen interagency coordination and improve security practices for rural providers, ensuring Texans' health care is not delayed or compromised by cyberattacks," Cornyn said [6].
The cost side is less settled. SecurityWeek calls the act a new compliance requirement on healthcare, one that needs full compliance from both the government and the sector [16]. The publication describes the bill as an attempt to provide central guidance across the existing cybersecurity frameworks [17]. It reports that the sector generally welcomes the bill. It also reports cautions from the security industry, not named in the report, that results will depend on how consistently the law is enforced [15]. Taken at face value, SecurityWeek's breach count and average cost [7] put last year's healthcare breach losses above $7.3 billion [1]. The report does not give the size of the grants [2].
What to watch
- House committee or floor action on the bill before the current congressional term ends; the 2024 version lapsed at its term's end.
- Appropriations that put a dollar figure on the grants, training and rural clinic support.
- The text of the regulation updates, which would set what covered entities must implement and by when.