THE US Senate has passed the bipartisan Health Care Cybersecurity and Resilience Act, introduced by Senators Bill Cassidy, Maggie Hassan, Jon Cornyn and Mark Warner. Having cleared the chamber by unanimous consent, the bill now moves to the House of Representatives for consideration. The legislation seeks to bolster the healthcare sector’s resilience to cyber threats, emphasising safeguarding patient data and ensuring continuity of care in the face of attacks such as ransomware.
The measure follows a wider context in which healthcare experienced more than 730 breaches affecting over 270 million people last year, with an average breach cost around $10 million.
Key provisions aim to improve prevention and response capabilities across the sector. The act would provide grants and training on best cybersecurity practices, enhanced support for rural providers, and closer coordination between the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA). It also anticipates updates to regulations to reflect current security practices and directs the HHS Secretary to develop an incident response plan.
A formalised inter-agency structure would designate the Administration for Strategic Preparedness and Response (ASPR) as sector risk management authority, creating a direct channel for tailored threat intelligence from CISA. While welcomed by the healthcare sector, security professionals warn that success hinges on enforcement and adequate funding and technical assistance to avoid imposing an infeasible compliance burden. The bill represents a notable shift toward centralised guidance and accountability for cybersecurity across health care in the United States.