Senate Passes Bill Proposing New HIPAA Cybersecurity Requirements
Summary
The Senate passed S. 3315, a bill proposing stricter HIPAA security requirements, including MFA, encryption and ongoing testing. It is not law and awaits House action; the article also offers preparation guidance and promotes Picus products.
Key points
- The Senate passed the Health Care Cybersecurity and Resiliency Act (S. 3315) on September 30, 2026; the bill is not law and awaits House action.
- The bill would require baseline practices including multi-factor authentication, patient-data encryption, ongoing monitoring and penetration testing.
- Proposed rules would draw on NIST frameworks and healthcare-sector security goals; HHS would identify practices that could reduce penalties or audit burdens.
- The bill would require breach notices to state how many people were affected and calls for HHS-CISA coordination on threat information and incident response.
- The article recommends testing controls when environments change and keeping evidence of tests, findings, fixes and approvals.
- The article is promotional and presents Picus testing and exposure-validation products as ways to support these activities.
Article Details
- Event Type
- The U.S. Senate passed the Health Care Cybersecurity and Resiliency Act (S. 3315) on 2026-09-30; the bill is not law and was sent to the House.
- Impact
- If enacted, the bill would require healthcare organizations and vendors handling patient data to implement minimum security practices, including multi-factor authentication and encryption, and ongoing monitoring that includes penetration testing. It would also require breach notices to state how many people were affected and direct HHS and CISA to coordinate threat information and incident response. The bill follows the Change Healthcare ransomware attack, which the article says disrupted pharmacy claims, medical billing, and payments nationwide; Change Healthcare reported to HHS that about 192.7 million people were affected.
Vendors
Products
Picus Autonomous Exposure Validation PlatformThe Picus Autonomous Exposure Validation Platform shows what attackers can actually exploit and what your defenses really stop, so every exposure becomes a clear, defensible decision.Picus Autonomous Penetration TestingPicus Autonomous Penetration Testing runs safe, ongoing pentests that link real weaknesses and exploit chains together to see if an attacker could reach your critical systems.Picus Breach and Attack SimulationPicus Breach and Attack Simulation checks every day whether your security tools block and detect attacks.Picus Exposure ValidationIf there is no exploit, or the system is too critical to attack live, Picus Exposure Validation proves it another way.