The bill
Health Care Cybersecurity and Resiliency Act of 2026
S. 3315, 119th Congress — read as touching Hospitals & Health Systems.
Sponsored by
Sen. Cassidy, Bill [R-LA]
ID: C001075
Follow the money
The bill
S. 3315, 119th Congress — read as touching Hospitals & Health Systems.
The sponsor
Every bill has someone who introduced it. That name is where the paper trail starts.
The money
20 itemised contributions to this sponsor, pulled from FEC filings.
The alignment
This bill's text tracks the "Intelligence Community" section, p. 254-256 of the Mandate for Leadership.
Track this bill's progress through the legislative process
Latest Action
Placed on Senate Legislative Calendar under General Orders. Calendar No. 365.
March 22, 2026
📍 Current Status
Next: The bill will be reviewed by relevant committees who will debate, amend, and vote on it.
1. Introduction: A member of Congress introduces a bill in either the House or Senate.
2. Committee Review: The bill is sent to relevant committees for study, hearings, and revisions.
3. Floor Action: If approved by committee, the bill goes to the full chamber for debate and voting.
4. Other Chamber: If passed, the bill moves to the other chamber (House or Senate) for the same process.
5. Conference: If both chambers pass different versions, a conference committee reconciles the differences.
6. Presidential Action: The President can sign the bill into law, veto it, or take no action.
7. Became Law: If signed (or if Congress overrides a veto), the bill becomes law!
Another masterpiece of legislative theater, courtesy of the geniuses in Congress. Let's dissect this farce, shall we?
**Main Purpose & Objectives:** The Health Care Cybersecurity and Resiliency Act of 2026 is a laughable attempt to improve cybersecurity in the healthcare and public health sectors. Its primary objective is to create the illusion of action while lining the pockets of lobbyists and special interest groups.
**Key Provisions & Changes to Existing Law:** This bill is a Frankenstein's monster of bureaucratic jargon, stitched together from various existing laws and regulations. It proposes to:
* Require the Secretary of Health and Human Services (HHS) and the Director of the Cybersecurity and Infrastructure Security Agency (CISA) to "coordinate" efforts to improve cybersecurity. Because, clearly, they weren't doing that already. * Define a plethora of terms, including "cybersecurity incident," "cybersecurity risk," and "information system." One can only assume this is an attempt to confuse the issue further. * Amend existing laws to clarify (read: obscure) cybersecurity responsibilities within HHS. This will undoubtedly create more bureaucratic red tape and opportunities for corruption.
**Affected Parties & Stakeholders:** The usual suspects are involved:
* Healthcare providers, who will be forced to navigate even more complex regulatory requirements. * Cybersecurity companies, which will reap the benefits of increased government spending on "cybersecurity solutions." * Lobbyists, who will continue to manipulate the system to serve their clients' interests. * Taxpayers, who will foot the bill for this legislative boondoggle.
**Potential Impact & Implications:** This bill is a classic case of "treat the symptom, not the disease." It fails to address the underlying issues plaguing our healthcare system, such as inadequate funding, outdated infrastructure, and a lack of qualified personnel. Instead, it creates more bureaucratic hurdles and opportunities for corruption.
In conclusion, this bill is a masterclass in legislative obfuscation, designed to confuse, mislead, and enrich special interest groups. It's a testament to the boundless incompetence of our elected officials and their willingness to prioritize profits over people. Now, if you'll excuse me, I have better things to do than watch this train wreck unfold.
Sen. Cassidy, Bill [R-LA]
Congress 119 • 2024 Election Cycle
No PAC contributions found
No organization contributions found
No committee contributions found
This bill has 3 cosponsors. Below are their top campaign contributors.
ID: H001076
Top Contributors
20
ID: C001056
Top Contributors
21
ID: W000805
Top Contributors
23
Hub layout: Politicians in center, donors arranged by type in rings around them.
Showing 51 nodes and 46 connections
Total contributions: $46
Showing top 20 donors by contribution amount
Which industries are materially affected by specific provisions in this bill. 6 helped.
The bill provides grants and technical assistance to hospitals and health systems for cybersecurity improvements (Sec. 10, 11, 12), which is a clear benefit.
The bill requires HHS and CISA to coordinate to improve cybersecurity in the Healthcare and Public Health Sector, which includes pharmaceutical manufacturers as part of the sector. This is supported by the definition of 'Healthcare and Public Health Sector' in SEC. 2(7) referencing National Security Memorandum-22, which covers the pharmaceutical industry as critical infrastructure. The bill's provisions for grants, training, and standards would benefit pharmaceutical companies by enhancing their
Health insurers are covered entities under HIPAA and will benefit from improved cybersecurity standards and guidance (Sec. 8, 9) that reduce breach risks and compliance costs.
Medical device manufacturers are business associates under HIPAA and will benefit from cybersecurity guidance and standards that protect health data (Sec. 7, 8).
Long-term care facilities are eligible for grants and technical assistance under the bill (Sec. 10(b)(1), (4)) to improve cybersecurity.
Biotech firms handling health data are covered entities or business associates and will benefit from cybersecurity improvements (Sec. 8, 9, 10).
For each industry this bill affects, here's what the sponsor (Sen. Cassidy, Bill [R-LA])received from donors associated with that industry during the 2022–present cycles. Donations are not proof of intent — they are a record of who funds the people writing the law.
This bill shows semantic similarity to the following sections of the Project 2025 policy document.AI-enhanced analysis provides detailed alignment ratings.
AI Analysis:
"The bill focuses on healthcare cybersecurity coordination between HHS and CISA, while the Project 2025 policy emphasizes intelligence community-wide information sharing, declassification reform, and real-time auditing for cyber threat intelligence. Both address improving cyber threat information sharing, but the bill is sector-specific and does not directly implement the broader IC reforms or 'obligation to share' policy outlined in Project 2025."
— 222 — Mandate for Leadership: The Conservative Promise forward-leaning in sharing cyber threat intelligence with private-sector partners and the public, emphasizing that the protective nature of such information is of value only if put into the right hands at the right time. Since critical infrastructure and services are overwhelmingly owned, managed, and defended by the private sector in the United States, there has been an increasing emphasis on declassify- ing intelligence and sharing actionable information with private-sector partners, often through industry-specific Information Sharing and Analysis Centers (ISACs); regional meetings of government and private-sector experts called InfraGard, run by the FBI; direct public notification from the Department of Homeland Security, the FBI, and (increasingly) the NSA; and more discreet one-on-one engagements led by the collecting agencies. These programs properly recognize the private sector’s role in providing cyber- security for Americans; in practice, however, the intelligence shared by the U.S. government through these venues is too often already known or no longer relevant by the time it makes its way through the downgrade process for sharing. In addition, government-shared information often needs to take advantage of the opportunity to provide contexts, such as attribution, trends, and size of the observed cyber problem. As warranted, additional context should be provided to the private sector as a matter of routine. To continue improving the U.S. government’s ability to defend the country’s most vital networks, the IC must adopt an “obligation to share” policy process, including the capacity for “write to release” intelligence products whereby newly discovered technical indicators, targeting, and other intelligence relevant to cyber defense are automatically provided either to the public or to targeted entities within 48 hours of their collection—which is how counterterrorism intel- ligence has been managed for years when it comes to a “duty to warn.” Under this policy, agency heads should still have the flexibility to withhold intelligence for operational or counterintelligence reasons but would need to report regularly to Congress on the number of and justification for exceptions. This policy would make sharing intelligence and defending networks the default, as it already is in the rest of the cybersecurity community outside the IC, to improve the quantity, relevance, and timeliness of defensive information while ensuring accountability for top leaders when they must withhold this information. One of the most significant challenges within the IC is presented by the need to share information promptly among the 18 elements of the intelligence enterprise. The only long-term solution to the understandable tension between the need to share information and the need to protect intelligence sources and methods is a robust real-time auditing capability that electronically flags unauthorized access. Under an identity management system with real-time audit, even the most sensi- tive information acquired by America’s intelligence agencies can be shared, and the access to and use of that information are appropriately monitored. Establishing — 223 — Intelligence Community a real-time auditing capability is essential to decreasing the risk for the heads of intelligence agencies in meeting their statutory requirements to ensure that they protect sources and methods associated with the classified information their agen- cies collect. Overclassification. There is broad consensus across the U.S. government and among stakeholders that the system for classifying, declassifying, and otherwise marking and handling sensitive information is at a crossroads. Exorbitant amounts of classified data are created daily, and agency personnel often mistakenly choose classification as the default selection to ensure national security. At the same time, the effectiveness of downgraded and carefully declassified information to support foreign policy efforts has been borne out in, for example, alerting the broader world of Russia’s buildup and likely plans for its invasion of Ukraine. Two executive orders principally govern how the U.S. government handles clas- sified and sensitive information. l Executive Order 13526, “Classified National Security Information,” issued in 2009,38 prescribes the classification levels and procedures for declassification. l Executive Order 13556, “Controlled Unclassified Information,” issued in 2010,39 aimed to establish a uniform program for managing all unclassified information that requires safeguarding or dissemination controls. The current system for declassifying classified national security information (CNSI) is extraordinarily analog, requiring experts’ review of individual records. Declassification policies are based on human review of paper and need to con- template and handle the proliferation and volume of digital records created by agencies. The U.S. government will soon reach the point at which manual review is impossible. The declassification of CNSI should support key U.S. national security objectives, reflect mission priorities, and not serve solely as a necessary procedural function. Reforms should include: l Tighter definitions and greater specificity for categories of information requiring protection. l More stringent policies to effect significant reductions in the number of Original Classification Authorities (OCAs). l Stricter accountability measures at the OCA level and more detailed security classification guides.
AI Analysis:
"The bill focuses on healthcare cybersecurity and coordination between HHS and CISA, while the Project 2025 policy emphasizes reducing regulatory burdens, expanding telehealth access, increasing provider supply, and promoting pro-life and family agendas—none of which are addressed in the bill."
— 488 — Mandate for Leadership: The Conservative Promise limited or no Internet access, which restricts their access to telehealth services (especially video visits). To improve its health care policies that affect rural regions, HHS should: l Reduce the regulatory burden and unleash private innovation that can discover solutions to unique, local needs. l Implement or encourage policies that increase the supply of health care providers, such as increased telehealth access and interstate licensure (a historically state matter), including for volunteers wishing to provide temporary, charitable services across state lines. l Encourage flexibility in modes of health care delivery, including less expensive alternatives to hospitals and telehealth independent of expensive air ambulances. OFFICE OF THE SECRETARY The Secretary of Health and Human Services and the Office of the Secretary necessarily set the tone for the entire department. The Secretary is the most accountable individual within HHS and, along with his or her immediate staff, should therefore be responsible for setting the policies that govern the depart- ment’s operations instead of allowing the operational divisions to assume the leading role in policymaking, thereby diffusing responsibility. Practical reforms to enhance the Secretary’s accountability should include the following: l Restrict HHS’s ability to declare indefinite public health emergencies (PHEs). Currently, HHS is merely required to notify Congress of such a declaration within 48 hours. Congress should establish a set time frame for any PHE, placing on the Secretary the burden of proof as to why an extension of the PHE is necessary. l Reinstate the HHS SUNSET (Securing Updated and Necessary Statutory Evaluations Timely) rule.75 Congress should codify the now- reversed Trump Administration rule that required all HHS agencies to review regulations retrospectively and publish results; without such a review, regulations expire. l Investigate, expose, and remediate any instances in which HHS violated people’s rights by: — 489 — Department of Health and Human Services 1. Colluding with Big Tech to censor dissenting opinions during COVID. 2. Colluding with abortion advocates and LGBT advocates to violate conscience-protection laws and the Hyde Amendment. The Life Agenda. The Office of the Secretary should eliminate the HHS Repro- ductive Healthcare Access Task Force and install a pro-life task force to ensure that all of the department’s divisions seek to use their authority to promote the life and health of women and their unborn children. Additionally, HHS should return to being known as the Department of Life by explicitly rejecting the notion that abortion is health care and by restoring its mission statement under the Strategic Plan and elsewhere to include furthering the health and well-being of all Americans “from conception to natural death.” The next Administration should create a dedicated Special Representative for Domestic Women’s Health. In the Trump Administration, there was a Special Representative for Global Women’s Health that focused on international issues, but this position lacked authority to be the lead on international policies because of overlapping issues with the U.S. Department of State and USAID (and at times a lack of clarity as to the lead point of contact and policy decisions at the White House). The new Special Representative would serve as the lead on all matters of federal domestic policy development related to life and family with support from the DPC for implementation and coordination among agencies. In the post-Dobbs era, advancing support for mothers will include coordination among agencies out- side of HHS, and the Special Representative would provide a clear focal point for all issues related to protecting life and serving families. The Family Agenda. The Secretary’s antidiscrimination policy statements should never conflate sex with gender identity or sexual orientation. Rather, the Secretary should proudly state that men and women are biological realities that are crucial to the advancement of life sciences and medical care and that married men and women are the ideal, natural family structure because all children have a right to be raised by the men and women who conceived them. OFFICE OF THE ASSISTANT SECRETARY FOR HEALTH (OASH) / OFFICE OF THE SURGEON GENERAL (OSG) The Assistant Secretary for Health (ASH) is the four-star admiral for the United States Public Health Service Commissioned Corps (USPHS), and the Surgeon Gen- eral (SG) is the three-star admiral. The ASH is tasked with overseeing not only the USPHS, but also 10 regional health offices, multiple presidential and secretarial advisory committees, and other offices such as the Offices of Minority Health, Women’s Health, and Population Affairs. The Secretary can further expand the ASH’s responsibilities (for example, by
AI Analysis:
"The bill addresses cybersecurity coordination between HHS and CISA, which is a tangential concern for healthcare operations but does not directly engage with the core Project 2025 HHS priorities such as equitable access, abortion data reporting, drug price reform, or religious freedom protections."
— 498 — Mandate for Leadership: The Conservative Promise ENDNOTES 1. U.S. Department of Health and Human Services, Strategic Plan, FY 2018–2022, p. 50, https://aspe.hhs.gov/ sites/default/files/documents/feac346aca967bfadc446398679e14ec/hhs-strategic-plan-fy-2018-2022.pdf (accessed February 7, 2023). 2. “Strategic Goal 1: Protect and Strengthen Equitable Access to High Quality and Affordable Healthcare” in ibid. “In the context of HHS, this Strategic Plan adopts the definition of underserved communities listed in Executive Order 13985: Advancing Racial Equity and Support for Underserved Communities through the Federal Government to refer to ‘populations sharing a particular characteristic, as well as geographic communities, who have been systematically denied a full opportunity to participate in aspects of economic, social, and civic life’; this definition includes individuals who belong to underserved communities that have been denied such treatment, such as Black, Latino, and Indigenous and Native American persons, Asian Americans and Pacific Islanders and other persons of color; members of religious minorities; lesbian, gay, bisexual, transgender, and queer (LGBTQ+) persons; persons with disabilities; persons who live in rural areas; and persons otherwise adversely affected by persistent poverty or inequality. Individuals may belong to more than one underserved community and face intersecting barriers. This definition applies to the terms underserved communities and underserved populations throughout this Strategic Plan.” Ibid. Emphasis in original. 3. Karen Weintraub, “Americans’ Life Expectancy Continues to Fall, Erasing Health Gains of the Last Quarter Century,” USA Today, December 22, 2022, https://www.usatoday.com/story/news/health/2022/12/22/us-life- expectancy-continues-fall-erasing-25-years-health-gains/10937418002/ (accessed February 6, 2023). 4. Apoorva Mandavilli, “The C.D.C. Isn’t Publishing Large Portions of the Data It Collects,” The New York Times, updated February 22, 2022, https://www.congress.gov/117/meeting/house/114450/documents/HHRG-117- IF02-20220302-SD004.pdf (accessed March 22, 2023). 5. Zachary B. Sluzala and Edmund F. Haislmaier, “Lessons from COVID-19: How Policymakers Should Reform the Regulation of Clinical Testing,” Heritage Foundation Backgrounder No. 3696, March 28, 2022, https://www. heritage.org/public-health/report/lessons-covid-19-how-policymakers-should-reform-the-regulation-clinical. 6. U.S. Department of Health and Human Services, Centers for Disease Control and Prevention, “Centers for Disease Control and Prevention (C),” https://www.cdc.gov/maso/pdf/cdcmiss.pdf (March 16, 2023). 7. Judith Garber, “CDC ‘Disclaimers’ Hide Financial Conflicts of Interest,” Lown Institute Accountability Blog, November 6, 2019, https://lowninstitute.org/cdc-disclaimers-hide-financial-conflicts-of-interest/ (accessed February 6, 2023). See also U.S. Department of Health and Human Services, Centers for Disease Control and Prevention, “CDC Foundation Active Programs (October 1, 2014–September 30, 2015),” https://www. cdcfoundation.org/sites/default/files/upload/pdf/CDCFoundation-ActivePrograms-FY2015.pdf (accessed February 7, 2023); “CDC Active Programs (October 1, 2015–September 30, 2016),” https://www.cdcfoundation. org/sites/default/files/upload/pdf/CDCFoundation-ActivePrograms-FY2016.pdf (accessed February 7, 2023); “CDC Foundation Active Programs (October 1, 2016–September 30, 2017),” https://www.cdcfoundation.org/ sites/default/files/upload/pdf/CDCFoundation-ActivePrograms-FY2017.pdf (accessed February 7, 2023); “CDC Foundation Active Programs (October 1, 2017–September 30, 2018),” https://www.cdcfoundation.org/sites/default/ files/upload/pdf/CDCFoundation-ActivePrograms-FY2018.pdf (accessed February 7, 2023); “CDC Foundation Active Programs, October 1, 2018–September 30, 2019,” https://www.cdcfoundation.org/sites/default/files/upload/ pdf/CDCFoundation-ActivePrograms-FY2019.pdf (accessed February 7, 2023); “CDC Foundation Active Programs, October 1, 2029–September 30, 2020,” https://www.cdcfoundation.org/CDCF-ActivePrograms-CDC-FY20?inline (accessed February 7, 2023); and “CDC Foundation Active Programs, October 1, 2020–September 30, 2021,” https://www.cdcfoundation.org/CDCF-ActivePrograms-CDC-FY21?inline (accessed February 7, 2023). 8. Joel White and Doug Badger, “In Order to Defeat COVID-19, the Federal Government Must Modernize Its Public Health Data,” Heritage Foundation Backgrounder No. 3527, September 3, 2020, https://www.heritage. org/sites/default/files/2020-09/BG3527_0.pdf. 9. S. 15, Ensuring Accurate and Complete Abortion Data Reporting Act of 2023, 118th Congress, introduced January 23, 2023, https://www.congress.gov/118/bills/s15/BILLS-118s15is.pdf (accessed March 22, 2023), and H.R. 632, Ensuring Accurate and Complete Abortion Data Reporting Act of 2023, 118th Congress, introduced January 30, 2023, https://www.congress.gov/118/bills/hr632/BILLS-118hr632ih.pdf (accessed March 22, 2023). 10. Doug Badger, “How Congress Can Make Real Progress on Drug Prices,” Heritage Foundation Issue Brief No. 5016, December 9, 2019, https://www.heritage.org/sites/default/files/2019-12/IB5016_1.pdf. — 499 — Department of Health and Human Services 11. Sluzala and Haislmaier, “Lessons From COVID-19: How Policymakers Should Reform the Regulation of Clinical Testing.” 12. Ibid. 13. H.R. 5471, Clinical Laboratory Improvement Amendments of 1988, Public Law No. 100-578, 100th Congress, October 31, 1988, https://uscode.house.gov/statutes/pl/100/578.pdf (accessed March 17, 2023). 14. Sluzala and Haislmaier, “Lessons From COVID-19: How Policymakers Should Reform the Regulation of Clinical Testing.” 15. Edmund F. Haislmaier, “Ensuring Americans’ Access to Pharmaceuticals: A Primer and Road Map for Policymakers,” Heritage Foundation Backgrounder No. 3545, October 20, 2020, https://www.heritage.org/ sites/default/files/2020-10/BG3545.pdf. 16. 18 U.S.C. 1461, https://www.law.cornell.edu/uscode/text/18/1461 (accessed March 16, 2023), and 18 U.S.C. 1462, https://www.law.cornell.edu/uscode/text/18/1462 (accessed March 16, 2023). 17. H.R. 1308, Religious Freedom Restoration Act of 1993, Public Law No. 103-141, 103rd Congress, November 16, 1993, https://www.congress.gov/103/statute/STATUTE-107/STATUTE-107-Pg1488.pdf (accessed March 18, 2023). 18. Charles Piller, “Is FDA’s Revolving Door Open Too Wide?” Science, Vol. 361, No. 6397 (July 6, 2018), p. 21, https://www.science.org/doi/epdf/10.1126/science.361.6397.21 (accessed February 6, 2023). 19. Joel Achenbach, “NIH Halts $100 Million Study of Moderate Drinking That Is Funded by Alcohol Industry,” The Washington Post, May 17, 2018, https://www.washingtonpost.com/news/to-your-health/wp/2018/05/17/nih- halts-controversial-study-of-moderate-drinking/ (accessed February 6, 2023). 20. Alexander Tin, “Moderna Offers NIH Co-ownership of COVID Vaccine Patent amid Dispute with Government,” CBS News, November 15, 2021, https://www.cbsnews.com/news/moderna-covid-vaccine-patent-dispute- national-institutes-health/ (accessed February 6, 2023). 21. Informed Consent Action Network, “NIH Officials Profiting from COVID-19 Vaccine,” June 3, 2021, https://www. icandecide.org/nih-officials-profiting-from-covid-19-vaccine/ (accessed February 6, 2023). 22. Adam Andrzejewski, “Substack Investigation: Fauci’s Royalties and the $350 Million Royalty Payment Stream HIDDEN by NIH,” Open the Books Substack, May 9, 2022, https://openthebooks.substack. com/p/faucis-royalties-and-the-350-million?utm_source=/profile/24758236-adam-andrzejewski&utm_ medium=reader2&s=w (accessed February 6, 2023). 23. Robert E. Moffit, “Time to Reverse Hospital Market Consolidation,” Heritage Foundation Commentary, January 5, 2022, https://www.heritage.org/health-care-reform/commentary/time-reverse-hospital-market-consolidation. 24. H.R. 3590, Patient Protection and Affordable Care Act, Public Law No. 111-148, 111th Congress, March 23, 2021, https://www.congress.gov/111/plaws/publ148/PLAW-111publ148.pdf (accessed March 16, 2023). 25. Brian J. Miller, Robert E. Moffit, James Ficke, Joseph Marine, and Jesse Ehrenfeld, “Reversing Hospital Consolidation: The Promise of Physician-Owned Hospitals,” Health Affairs Forefront, April 12, 2021, https:// www.healthaffairs.org/do/10.1377/forefront.20210408.980640/ (accessed February 13, 2023). 26. Robert E. Moffit, “Medicare’s Future: Challenges and Opportunities,” testimony before the Special Committee on Aging, U.S. Senate, November 21, 2022, https://www.heritage.org/testimony/medicares-future-challenges- and-opportunities. 27. 42 U.S. Code § 256b, https://www.law.cornell.edu/uscode/text/42/256b (accessed March 16, 2023). 28. H.R. 3590, Patient Protection and Affordable Care Act, § 3022. 29. H.R. 5376, Inflation Reduction Act of 2022, Public Law No. 117-169, 117th Congress, August 16, 2022, https:// www.congress.gov/117/plaws/publ169/PLAW-117publ169.pdf (accessed March 16, 2023). 30. Robert E. Moffit, “Reducing Patient Access to New Medications Is the Left’s Latest Medicare Price-Fixing Scheme,” Heritage Foundation Commentary, July 22, 2022, https://www.heritage.org/medicare/commentary/ reducing-patient-access-new-medications-the-lefts-latest-medicare-price-fixing, and Badger, “How Congress Can Make Real Progress on Drug Prices.” 31. Nina Owcharenko Schaefer, “Medicaid at 55: Understanding the Design, Trends, and Reforms Needed to Improve the Health Care Safety Net,” Heritage Foundation Backgrounder No. 3604, April 14, 2021, https:// www.heritage.org/sites/default/files/2021-04/BG3604_0.pdf, and Brian C. Blase, “Punishing Conservative States: Payment Cuts to Hospitals Where Federal Spending Is Already Low,” Paragon Health Institute, December 2021, https://paragoninstitute.org/wp-content/uploads/2022/06/Punishing-Conservative-States- HTML.html (accessed February 13, 2023).
Showing 3 of 5 policy matches
Policy matches are calculated using a hybrid approach: initial candidates are found using semantic similarity between bill summaries and Project 2025 policy text, then an AI model (Llama 3.1 70B) provides detailed alignment ratings and analysis. Ratings range from 1 (minimal alignment) to 5 (very strong alignment). This analysis does not imply direct causation or intent.