Senators Reintroduce Bill to Boost Healthcare Cybersecurity

Four U.S. lawmakers – including the chair of the high-profile Senate health, education, labor and pensions committee – are taking another stab with a bipartisan bill aimed at strengthening cybersecurity in healthcare.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

The Health Care Cybersecurity and Resiliency Act of 2025 unveiled last week is a nearly identical version of a bill first introduced in November 2024 by the same group of senators.

The bill calls for multiple initiatives including bolstering HIPAA privacy regulations, providing cyber grants and training to the sector, and providing more detailed breach notification data. Reintroduced last Thursday, the bill is co-sponsored by Senators Bill Cassidy, R-La. – a physician and chair of the Senate HELP committee; Mark Warner, D-Va.; John Cornyn, R-Texas; and Maggie Hassan, D-N.H.

The legislation stems out of a bipartisan Senate working group formed in 2023 to rally congressional support for potential legislation focused on improving the state of cybersecurity in the healthcare sector (see: New Bipartisan Senate Group Tackling Healthcare Cyber Bill).

The bill requires the Secretary of U.S. Department of Health and Human Services and the Director of the Cybersecurity and Infrastructure Security Agency “to coordinate to improve cybersecurity in the healthcare and public health sectors.”

Among many other provisions, the legislation calls upon HHS to update the HIPAA privacy, security and breach notification regulations.

That includes requiring HIPAA-covered organizations and business associates to adopt multifactor authentication and encryption, to conduct audits – including penetration testing, and “other minimum cybersecurity standards” that will be determined by the HHS secretary, “in consultation with private sector organizations, based on landscape analysis of emerging and existing cybersecurity vulnerabilities and consensus-based best practices.”

HHS’ Office for Civil Rights, in the final weeks of the Biden administration, issued a proposed update to the HIPAA Security Rule that includes most of those same elements proposed in the bill, plus a long list of other specific mandates (see: What’s in HHS’ Proposed HIPAA Security Rule Overhaul?).

But the proposed HIPAA rulemaking overhaul faced harsh criticism from many healthcare sector organizations that argued the requirements, if finalized, would be too expensive and difficult to implement, especially by resourced-stretched organizations (see: HSCC Urges White House to Shift Gears on Health Cyber Regs).

Other Proposals

The bipartisan cybersecurity bill also proposes to offset some of the new potential regulatory burdens with grants to help healthcare organizations bolster their preparedness and response to cyberattacks. It also calls upon HHS to develop and provide guidance to rural healthcare providers to help improve their cyber readiness and for HHS to provide healthcare workforce training for cybersecurity best practices.

Also, the legislation calls for HHS to make updated requirements to its public HIPAA breach reporting portal to display whether federal regulators took corrective actions against entities that submitted breach notifications, and “to what extent, as appropriate, recognized security practices were considered in the investigation.”

The Health Care Cybersecurity and Resiliency Act of 2025 joins several similar bills introduced in the past year or two to shore up cybersecurity in the healthcare sector.

Other stalled efforts include the Strengthening Cybersecurity in Health Care Act of 2024, which was introduced in February 2024 by Sens. Angus King, I-Maine, and Marco Rubio, former Republican senator from Florida. Among other provisions, that bill sought to require DHS “to perform consistent evaluations of its cybersecurity systems and provide biannual reports on its current practices and progress on future safety procedures they are working to implement” (see: Bipartisan Senate Bill Requires HHS to Bolster Cyber Efforts).

More recently, Cassidy in November introduced the Health Information Privacy Reform Act, which aimed at creating HIPAA-like privacy protections for consumer health data that falls outside of HIPAA’s purview (see: Bill Seeks HIPAA Like Protections for Consumer Health Data).

Regulatory attorney Rachel Rose said having a bipartisan working group to address “a bona fide and increasing threat to our nation’s critical infrastructure, revenue cycles and patient outcomes” is a positive development.

Secondly, the proposals build upon what is already required under HIPAA through regulations that have been in place for decades, as well as Section 405(d) of the Cybersecurity Act of 2015.

Some existing grant programs are already available for critical access hospitals, she said, and some companies, such as Microsoft and Google, have worked with industry groups including the American Hospital Association to help facilitate free or low-cost cybersecurity resources for rural hospitals (see: Microsoft, Google Offering Cyber Help to Rural Hospitals).

“Cybercriminals look for any vulnerability to exploit, so ensuring that covered entities and business associates alike are not using outdated systems, providing adequate training and having an effective compliance program is critical to thwarting an attack,” Rose said.

The senators in a statement about the proposed legislation note that more than 270 million Americans were affected by the 730 major health data breaches reported to federal regulators in 2024.

The biggest incident was the February ransomware attack on UnitedHealth Group’s IT services unit, Change Healthcare, which affected 193 million people. It is currently ranked as the largest healthcare cybersecurity incident in history. Not only did the attack expose health data of a majority of Americans, it led to significant delays in care, electronic prescribing and critical disruptions to healthcare business processes.

“Cyberattacks on our healthcare sector not only put patients’ sensitive health data at risk but can delay life-saving care,” Cassidy said in a statement. “This bipartisan legislation ensures health institutions can safeguard Americans’ health data against increasing cyberthreats,” he said.

The lawmakers did not immediately respond to Information Security Media Group’s requests for additional comment.