The U.S. Senate has passed the Health Care Cybersecurity and Resilience Act by unanimous consent, sending to the House a bill that would fund defenses at hospitals and clinics and bind the Department of Health and Human Services more closely to the Cybersecurity and Infrastructure Security Agency, SecurityWeek reported Monday. The measure is sponsored by Republican Sens. Bill Cassidy and John Cornyn and Democratic Sens. Maggie Hassan and Mark Warner.

What Happened

The bill combines money with mandates. It creates grants for preventing and responding to cyberattacks and for training the health care cybersecurity workforce, with additional support aimed at rural health facilities, which often lack dedicated security staff.

On the government side, it formalizes coordination between HHS and CISA. HHS's Administration for Strategic Preparedness and Response, known as ASPR, would be designated the sector risk management agency for health care, and CISA would become a direct source of threat intelligence for the sector. The bill also requires HHS to update its regulations to push providers toward established security best practices and directs the HHS secretary to develop a cybersecurity incident response plan.

RelatedWhite House AI Task Force Plans Breach Warnings From Labs at Its First Meeting

Cassidy said cyberattacks put patient data at risk and delay care, according to SecurityWeek. Cornyn emphasized patients' confidence that their information is protected and said rural providers in particular would benefit.

Why It Matters

Health care has become one of the most frequently breached sectors in the U.S. SecurityWeek cited more than 730 health care breaches in the past year affecting about 270 million Americans. The largest single incident, the 2024 ransomware attack on UnitedHealth Group's Change Healthcare unit, exposed data on more than 190 million people and disrupted claims processing and pharmacy payments across the country for weeks. The same year, a ransomware attack on Ascension disrupted operations at its hospitals in multiple states, forcing staff to work without electronic records.

Those incidents showed that a single compromised vendor or health system can interrupt care far beyond its own walls, and they intensified pressure on Congress to set clearer federal expectations. The bill's approach of naming ASPR as the lead agency and plugging it into CISA's intelligence is meant to give hospitals faster warning of active campaigns, while the regulatory provisions would raise the floor for basic controls.

Context

The legislation was first introduced in 2024 but did not advance before that Congress ended. Its sponsors reintroduced it in December 2025. Passage by unanimous consent means no senator objected, which suggests limited opposition in the chamber, but it also skipped a recorded floor vote.

SecurityWeek noted that observers caution the bill's real effect will depend on consistent enforcement and on Congress appropriating enough money. Providers, many of them operating on thin margins, have warned that new security requirements without matching federal funding or technical help could strain their finances, particularly at small and rural hospitals.

What to Watch

The bill now moves to the House, where SecurityWeek's report did not identify a companion measure or a timetable for action. If it becomes law, the details will shift to HHS rulemaking: how prescriptive the updated security requirements are, how quickly ASPR and CISA set up information sharing and how much grant money Congress actually provides for rural facilities.