Senate Passes Bipartisan Health Care Cybersecurity and Resilience Act

Senate Approves Cybersecurity Bill

The US Senate has passed the bipartisan Health Care Cybersecurity and Resilience Act. This bill, introduced by Senators Bill Cassidy, Maggie Hassan, Jon Cornyn, and Mark Warner, aims to bolster the cybersecurity defenses of the healthcare sector. It passed the Senate by unanimous consent and will now proceed to the US House of Representatives for further consideration.

Purpose and Background

The legislation's primary purpose is to assist healthcare institutions in preventing and responding to cyberattacks, thereby safeguarding sensitive patient data and ensuring continuity of care. Senator Cassidy stated that cyberattacks on healthcare not only risk patient data but can also delay life-saving care. The bill was initially introduced in 2024 but failed to pass, then reintroduced in December 2025.

The healthcare sector is a frequent target for cybercriminals, with over 730 cyber breaches affecting more than 270 million Americans last year. These breaches cost an average of $10 million per incident.

Impact of Cyberattacks on Healthcare

Major cyber incidents have highlighted the vulnerability of the healthcare industry. Examples include the 2015 Anthem breach, which compromised 78.8 million customer records, and the 2024 ransomware attacks against Ascension and Change Healthcare. The Change Healthcare attack is believed to have exposed data for over 190 million people and caused significant disruptions to care and electronic prescribing.

Ransomware, often coupled with double-extortion, is a prevalent threat. Healthcare organizations face a dilemma between government advice against paying ransoms and their need to protect patients, which criminals exploit.

Key Provisions and Future Steps

Key elements of the Act include providing grants to improve cyberattack prevention and response capabilities within the healthcare sector. Senator Cornyn emphasized that the legislation would strengthen interagency coordination and improve security practices, particularly for rural providers. The bill's passage in the Senate marks a step towards enhancing the resilience of healthcare systems against increasing cyber threats.