Healthcare organizations that have managed HIPAA's cybersecurity requirements at the margins, including those that treat encryption as optional, defer multi-factor rollouts, and conduct penetration tests only after something goes wrong, will soon have to change their ways. Two parallel regulatory efforts aim to reshape the healthcare regulatory compliance landscape more than 20 years in the making, and the endpoint is in focus: a substantially prescriptive regulatory environment.
The Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315) passed the Senate by unanimous consent on September 30, 2026. As of early October, it sits at the House desk; whether it gets a House vote before the 119th Congress expires in January is uncertain. However, understanding what the bill signals is crucial, as is what the bill shares with the pending HIPAA Security Rule Notice of Proposed Rulemaking (NPRM) issued in January 2025. Together, they form a durable federal consensus on what healthcare cybersecurity compliance will require going forward. Here is our recent article on the topic:
George V. Hulme
Both regulatory proposals mandate the same baseline: multifactor authentication, encryption of protected health information, recurring penetration testing, and monitoring. While the NPRM is more prescriptive (vulnerability scans at least every six months, penetration tests annually, encryption of all electronic PHI at rest and in transit), S. 3315 is more directive and authorizes HHS to define the technical parameters through rulemaking. But if S. 3315 becomes law before HHS finalizes the NPRM, the most likely outcome is a harmonized regulatory picture built on the NPRM's existing proposal.
What is clear is that the current flexibility in healthcare cybersecurity regulatory compliance is expiring. Under today's Security Rule, encryption is "addressable" rather than required, meaning covered organizations can opt out, provided they document a good enough reason. An organization must assess whether encryption is reasonable and appropriate, document that analysis, and either implement it or adopt a defensible equivalent. “The question changes from ‘explain why not’ to ‘show that you did, or fit a listed exception,” Aaron Warner, CEO at ProCircular, says.
“I read that [bill language] as taking away the choice of whether to encrypt while leaving the choice of how. It is narrower than ending HIPAA’s flexibility altogether,” says James H. Tily, attorney, Tily Law LLC, Salt Lake City, Utah, who has been tracking this legislation for a non-profit health care client.
In practice, however, HHS has found through enforcement that many entities treat "addressable" as synonymous with "optional." That finding, coupled with legal decisions, crippled enforcement of addressable encryption. “The rule invited this,” added Warner. He explained how HHS's own F.A.Q., still posted on hhs.gov and last reviewed in 2013, answers "Is the use of encryption mandatory in the Security Rule?" “With one word: No. And when OCR tried to make encryption stick, it lost,” he says, referring to a 2020 decision in which the Fifth Circuit vacated a $4.3 million penalty against MD Anderson over an unencrypted laptop and two unencrypted thumb drives, holding that the regulation required only a "mechanism" to encrypt, which the hospital had even though the devices did not. “After that decision, addressable encryption was effectively unenforceable,” he says.
Experts say the bill's prescriptive nature, if enacted, would make mitigating risk more difficult. “The goal should be eliminating unnecessary risk, not eliminating the flexibility needed to manage risk responsibly,” Jason Elrod, CISO of Multicare Health System and senior advisor to Elisity, says.
The Operational Weight
For large health systems with mature security programs, the practical difference between their current practice and incoming mandates is likely meaningful but manageable. The bigger challenge will fall on the sector's mid-sized and smaller organizations: small physician groups, rural hospitals, community health centers, and independent clinics that lack the staff and budget to comply with a prescriptive compliance overhaul.
HHS estimated approximately $9 billion in first-year compliance costs across regulated entities under the NPRM, with roughly $6 billion annually thereafter. For hospitals, 41% of which were operating at a financial loss according to Chartis's 2026 Rural Health State of the State report, the math doesn’t work. Microsoft’s 2025 Rural Hospital Cybersecurity Landscape Report found that 69% of rural hospitals lack MFA. These organizations aren't standing on the threshold of compliance; many are starting from fundamental infrastructure gaps that haven't been meaningfully addressed in years.
On the hopeful side, S. 3315 does create a discretionary grant program intended to help safety-net providers, federally qualified health centers, nonprofit hospitals, and rural health clinics. However, how the program is currently proposed to be structured warrants attention. The Senate-passed text removed the authorization-of-appropriations provision from an earlier version of the bill. Grants are authorized but not funded with "may award" language, permissive eligibility, and no guarantees. The Congressional Budget Office's April 2026 estimate is roughly $100 million in grant outlays. Considering the $9 billion in projected first-year compliance costs, the funding gap is significant.
“Eligibility isn’t funding, and authorization to award grants doesn’t mean the money will actually be available,” Elrod said.
“Even if appropriators fund the CBO number, that is about a penny for every dollar HHS itself says year one will cost,” Warner added.
The grants would also be one-off relief. The three-year grant awards may support initial deployment, but the recurring costs of managed detection, penetration testing contracts, security staffing, software licensing, and legacy system replacement — continue after the grant runs out. Smaller organizations that lack in-house grant-writing capacity face an additional barrier just to get into the pipeline. Meanwhile, eligibility has narrowed as the legislative process moved forward, leaving government-owned rural hospitals, approximately a third of rural facilities, with no clear path to assistance.
“The bigger gap is public hospitals,” said Tily. “About a third of rural hospitals are owned by a state or local government, mostly counties and hospital districts. The passed bill limits eligibility to a ‘nonprofit hospital’ and does not define the term. The introduced bill said ‘a hospital.’”
“We need to be careful that our efforts to make healthcare safer don’t inadvertently make healthcare less accessible,” Elrod said.
What Organizations Should Do Now
For many healthcare organizations whose cybersecurity programs don’t match where the regulations are heading, it’s likely a bad bet to wait to get started.
The existing Security Rule remains enforceable today, and OCR's active risk-analysis enforcement initiative underscores the risk of compliance gaps. Additionally, both the Senate’s and HHS’s proposed changes converge on the same four baseline capabilities: multifactor authentication, encryption, recurring penetration testing, and continuous monitoring.
Covered organizations generally maintain an accurate asset inventory. Organizations can’t protect what they haven't mapped: ePHI data flows, system dependencies, and legacy infrastructure, particularly medical devices and vendor-managed systems, need to be documented and assessed for encryption and MFA coverage gaps. Wherever those assessments reveal exceptions or workarounds to current addressable requirements, those decisions need to be formalized. Any reasonableness analysis supporting a non-encryption determination is already a liability under OCR requirements.
From there, many advise setting priorities by deployment difficulty. MFA is the highest-value, most enforcement-visible control and, for most organizations, the most immediately achievable. Priority deployment targets include remote access, email, privileged accounts, and electronic health record access. Encryption of endpoints, backups, databases, and cloud storage is next, with documented migration plans for systems that can’t yet support encryption.
“I expect the money to move toward MFA and identity more than encryption. In HHS’s 2024 breach report to Congress, theft accounted for 2 percent of large breach reports and hacking for 81 percent, and network servers accounted for 99 percent of the people affected. Encrypting a server does little against someone who logs in with stolen credentials,” Tily said.
Penetration testing requires organizational maturity many providers have yet to reach, and a retesting protocol, and a remediation process with documented remediation. The required monitoring within S. 3315 and the NPRM assume robust telemetry is in place. For business associates, managed service providers, and medical device vendors, you must verify compliance. Contracts and assurance efforts should ensure the same baseline is in place as required by covered entities.
“Having MFA deployed doesn’t automatically mean identity is secure. Conducting an annual penetration test doesn’t mean you’ve adequately addressed exploitable weaknesses. And collecting security telemetry isn’t the same as being able to detect and respond to an attack. Coverage is not capability,” Elrod adds.
Start with a controls inventory scoped to the requirements outlined in Section 8 of S. 3315. Map every system that stores, transmits, or accesses PHI and flag where multifactor authentication is missing or bypassable, where encryption at rest and in transit is not enforced end-to-end, and where penetration testing is non-existent or irregular. Pay special attention to legacy clinical systems such as imaging archives, lab interfaces, medical device networks, and vendor-managed SaaS. These are historically areas where “addressable” has become “deferred.”
“In practice, MFA and encryption stop being policy questions and become inventory and procurement questions. The hard part is never the policy. It is the lab interface, the EHR module, or the 2012 imaging workstation that cannot do MFA. Those are replacement-cycle problems, and the cycle has to start now,” Warner said.
Once those gaps are identified, close them in order of enforcement exposure. The systems most likely to trigger a breach notification or OCR investigation, such as internet-facing portals, email, remote access, and partner-connected data stores, should move to the front of the queue. For devices and applications that can't technically support MFA or encryption without manufacturer recertification, document compensating controls, risk acceptance, and remediation timelines now. A risk register that shows why a control is missing and when it will be fixed will matter.
On enforcement mitigation, existing HITECH Act law, which S. 3315 Section 7 directs HHS to implement by regulation, already requires at least 12 consecutive months of documented recognized security practices before an alleged violation of those practices can be considered in penalty or audit decisions. That means providers should align their programs with a recognized framework such as NIST CSF or HITRUST and maintain dated evidence: policies, configuration standards, training records, vulnerability-scan results, incident-response drills, and the like. Don’t treat this as a checkbox; the documentation needs to be strong enough to survive discovery and OCR review.
Vendor management likely needs a revamp. Providers should revise business-associate agreements to require MFA, encryption, and penetration testing; demand evidence of those controls during renewals; and build contractual right-to-audit language for third parties that handle PHI. The Change Healthcare breach revealed how a single vendor’s incident can cascade across payments, records, and even patient care.
Finally, be ready to boost budgets. The CBO score of $421 million from 2026 to 2031 across affected organizations refers only to the Senate bill; the HHS Security Rule update carries a separate estimated first-year price tag of $9 billion. Between the two, providers should expect higher costs for identity tools, encryption, vulnerability management, and third-party assessments. Organizations that treat the 36-month window as time to plan and the safe-harbor calendar as a near-term project will be better positioned if and when the House sends the bill to the President’s desk or the NPRM goes into effect.
Neither the NPRM nor S. 3315 has produced a final compliance date. The NPRM is now categorized as a long-term action, with final rulemaking projected for July 2027. That’s a planning estimate, not a hard timeline. S. 3315's 36-month statutory clock would run from enactment. “If HHS finalizes on its existing authority first, entities could face the shorter clock on those controls. If it finalizes under the statute, the 36 months likely controls. I would plan on the earlier date,” Tily advised.
While the exact scope, frequencies, and exceptions remain unsettled, both tracks tell the same story about which investments carry no regulatory risk: MFA, encryption, penetration testing, and documented monitoring are coming regardless of which vehicle delivers them. They are the minimum viable security posture for a sector that recently experienced some of the most consequential cyberattacks across the board. The compliance mandate, when it goes into effect, may finally be catching up to real-world risks that have been moving considerably faster than regulators.
Whichever track wins the race between S. 3315 and HHS’s NPRM, healthcare security teams end at the same destination. “Do not bet on the House. The 119th Congress ends January 3, 2027, and Energy and Commerce has not scheduled a markup. If the bill dies, the NPRM is still coming. If it passes, the NPRM becomes the vehicle. Either way, the work is the same,” Warner concludes.
