Skip to content
Healthcare Cybersecurity Act Advances to House After Senate Approval

Healthcare Cybersecurity Act Advances to House After Senate Approval

First seen 26 Oct 2026, 09:12 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 26, 2026 at 11:12 UTC
  • •The Senate passed the Health Care Cybersecurity Act on September 30, 2026.
  • •The bill mandates cybersecurity practices like multifactor authentication and encryption for healthcare entities.
  • •192.7 million individuals were affected by the Change Healthcare ransomware attack in 2024.

The U.S. Senate passed the Health Care Cybersecurity and Resiliency Act (S. 3315) on September 30, 2026, aiming to update HIPAA Security Rule with mandatory cybersecurity practices for healthcare entities. The bill was introduced in December 2025 following the Change Healthcare ransomware attack, which affected 192.7 million individuals. It mandates minimum risk-based cybersecurity practices, including multifactor authentication and encryption. The bill is not yet law, pending House approval. The changes are intended to enhance protections against increasing cyberattacks on healthcare organizations, which have been on the rise since 2023. The updated requirements will take effect 36 months after the law is enacted. HHS has delayed finalizing the proposed HIPAA Security Rule changes until at least July 2027.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2024-02-01
Change Healthcare ransomware attack
Attackers accessed a remote access portal using stolen credentials, affecting 192.7 million individuals.
Picussecurity
2026-09-30
Senate passes Health Care Cybersecurity Act
The U.S. Senate approved the bill without objections, now awaiting House consideration.
Picussecurity

More articles in this cluster (4)

Following this threat?

Track Change Healthcare in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 3

Common questions

Who must comply with the new HIPAA requirements?
Covered entities, business associates, and non-governmental entities in the healthcare sector must comply.
What are the key cybersecurity practices mandated by the bill?
The bill requires multifactor authentication, encryption of protected health information, and penetration testing.
When will the new requirements take effect?
The updated requirements will take effect 36 months after the law is enacted.