Member Login
Search

LUGPA Policy Update: Senate Passes Health Care Cybersecurity and Resiliency Act

October 2026

At a Glance

  • Senate passage: The Senate passed bipartisan S. 3315, the Health Care Cybersecurity and Resiliency Act, led by Sens. Bill Cassidy (R-LA), Maggie Hassan (D-NH), John Cornyn (R-TX), and Mark Warner (D-VA).
  • New cybersecurity requirements: The bill would direct HHS to update the HIPAA Security Rule with minimum cybersecurity standards, including multifactor authentication, encryption of electronic protected health information, and regular penetration testing.
  • Implementation timeline: Requirements would take effect three years after enactment, giving practices time to prepare.
  • HIPAA enforcement: HHS would establish rules explaining how recognized security practices are considered when assessing penalties, audits, and remedies following security incidents.
  • Additional provisions: The bill would strengthen federal cybersecurity coordination, provide authority for technical assistance and grants, and modify breach reporting requirements. Grant funding would depend on future congressional appropriations.
  • Next steps: The House must still act. Differences between the House and Senate proposals, including provisions addressing medical devices, could affect the final legislation.

Why It Matters for Urology Practices

Cyberattacks and ransomware can disrupt clinical operations, delay access to patient records, and create high costs. The bill could require independent urology practices to strengthen existing cybersecurity programs and make additional investments to meet new federal standards.

The recognition of established security practices in HIPAA enforcement could also benefit practices that document their cybersecurity investments and follow recognized safeguards. However, the ultimate impact will depend on the requirements HHS establishes and the resources available to help practices comply.

Key Provisions

Updated HIPAA Security Standards: HHS would establish minimum cybersecurity requirements for covered entities, business associates, and other nongovernmental healthcare organizations. Requirements would include multifactor authentication, encryption, and penetration testing, with implementation required three years after enactment.

Recognition of Security Practices: HHS would clarify how recognized cybersecurity practices factor into HIPAA penalties, audits, and remedies. This could provide greater regulatory consideration for organizations that maintain documented security programs.

Federal Coordination and Assistance: The bill would strengthen coordination between HHS and the Cybersecurity and Infrastructure Security Agency (CISA), establish a joint incident response plan, and support technical assistance, workforce training, rural cybersecurity guidance, and grant programs. Although grant authority remains, funding would depend on future congressional appropriations.

Breach Reporting: The bill would require breach notices to include the number of individuals affected and establish a working group to examine ways to reduce duplicative federal and state incident reporting.

House Action

The Senate's passage does not send the bill directly to the President. The House must still consider the legislation, and its proposal includes medical device provisions not found in the Senate-passed bill. If the House makes changes, the Senate would need to consider them before the legislation could advance.

LUGPA Perspective

LUGPA supports strengthening healthcare cybersecurity while ensuring new requirements are practical and achievable for independent physician practices. Compliance costs, administrative burdens, implementation flexibility, and access to technical assistance will be important considerations as Congress and HHS move forward.

LUGPA will monitor House action and subsequent rulemaking to assess how the requirements may affect independent urology practices.

Bottom Line

S. 3315 could establish more prescriptive cybersecurity requirements for healthcare organizations, with potential implications for practice operations, compliance costs, and HIPAA enforcement. The legislation still requires House action, and the final impact will depend on its provisions and subsequent HHS regulations.