The US Senate has passed the bipartisan Health Care Cybersecurity and Resilience Act, introduced by Senators Bill Cassidy, Maggie Hassan, Jon Cornyn, and Mark Warner.
The bill was first introduced in 2024, but failed to pass before the end of that congressional term. It was reintroduced in December 2025.
Having passed the Senate by unanimous consent, the Health Care Cybersecurity and Resilience Act now heads to the US House of Representatives for consideration.
“Cyberattacks on our healthcare sector not only put patients’ sensitive health data at risk but can delay life-saving care. This bipartisan legislation ensures health institutions can safeguard Americans’ health data against increasing cyber threats,” claims Cassidy. Its purpose is to assist the sector in reducing the number of future successful criminal attacks.
Healthcare is a primary target for cybercriminals. More than 730 cyber breaches affected over 270 million Americans last year – costing an average of $10 million per breach.
Major incidents include the historic Anthem breach of 2015 (compromising the PI and health records of 78.8 million customers, and costing more than $115 million); the ransomware attack against Ascension in 2024 (which disrupted clinical operations and electronic health records across 11 US states), and the Change Healthcare attack in 2024 that is believed to have exposed the data of over 190 million people while causing significant delays in care and electronic prescribing.
The definitive criminal weapon of choice in this war against healthcare is ransomware coupled with double-extortion (and increasingly, pure data-extortion). Ransomware is devastating to healthcare. The sector is caught between government advice not to pay ransoms and its own requirement to protect its patients. Criminals expect it to pay a ransom rather than risk the health of patients. The new Act aims to help the sector improve its resilience against these attacks.