Loading story…
A bipartisan group of U.S. senators has reintroduced the Health Care Cybersecurity and Resiliency Act of 2025, which aims to enhance cybersecurity protections in the healthcare sector. The proposed legislation includes provisions for updating HIPAA privacy and security regulations, increasing cyber grant funding, expanding workforce training, and improving breach notification requirements. The bill directs the Department of Health and Human Services (HHS) and the Cybersecurity and Infrastructure Security Agency (CISA) to coordinate efforts to bolster the sector's cyber resilience, reflecting growing concern over the frequency and impact of healthcare data breaches.
In parallel, healthcare organizations are reviewing their password management practices to ensure compliance with existing HIPAA Security Rule requirements. While HIPAA does not mandate specific password policies, it expects organizations to implement reasonable procedures for password creation, changes, and protection, as outlined in 45 CFR 164.308(a)(5)(ii)(D). Guidance from HHS and NIST, particularly NIST SP 800-66r2, provides technical recommendations for authentication management and credential safeguarding, underscoring the importance of robust password management in protecting protected health information (PHI).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Four bipartisan U.S. senators reintroduced the Health Care Cybersecurity and Resiliency Act of 2025 to strengthen cybersecurity and resiliency across the healthcare and public health sectors. The bill calls for HHS-CISA coordination, HIPAA rule updates, grants, rural-provider guidance, workforce training, and more detailed public breach-reporting disclosures.
By December 2025, reporting on the Change Healthcare incident said the February 2024 attack had affected 193 million people. This quantified the scale of the breach and was cited in support of new healthcare cybersecurity legislation.
During 2024, 730 major health data breaches were reported, affecting more than 270 million Americans. These breach figures were cited by lawmakers as evidence of escalating cyber risk in the healthcare sector.
A ransomware attack struck Change Healthcare in February 2024, causing widespread disruption to care delivery and business processes. The incident was later described as the largest healthcare cybersecurity incident in history.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcehelpnetsecurity.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Senate Health, Education, and Labor (HELP) Committee advanced the bipartisan **Health Care Cybersecurity and Resiliency Act**, legislation aimed at revamping cybersecurity practices at the Department of Health and Human Services (**HHS**). The bill would require the HHS Secretary to develop a comprehensive **cybersecurity incident response plan** and submit it to Congress for review, and it would direct HHS to coordinate with **CISA** on oversight of cybersecurity across the public health and healthcare sectors. Additional provisions include developing cybersecurity guidance for **rural healthcare providers** and initiatives to improve **cybersecurity literacy** across the healthcare workforce. Lawmakers cited the **2024 Change Healthcare** incident as a key catalyst, arguing it demonstrated the sector’s exposure to ransomware and other cyber threats and the systemic risk created by concentrated third-party dependencies. The measure would also designate HHS’ *Administration for Strategic Preparedness and Response* (**ASPR**) as the **Sector Risk Management Agency** for the Healthcare and Public Health sectors. CyberScoop reported the bill passed committee on a **22–1** vote, with Sen. Rand Paul as the lone dissenter, and sponsors including Sen. Bill Cassidy along with Sens. Maggie Hassan, Mark Warner, and John Cornyn.
Jun 29, 2026
The US Senate Health, Education, Labor, and Pensions (**HELP**) Committee advanced the bipartisan **Health Care Cybersecurity and Resiliency Act** by a 22–1 vote, proposing new baseline cybersecurity requirements for HIPAA-regulated entities. Reported measures include **multifactor authentication**, **data encryption**, **penetration testing**, and **regular security audits**, alongside changes to breach reporting such as requiring entities to report the number of individuals affected and directing HHS to publish post-breach corrective actions and recognized security practices used by the impacted organization. In parallel, HHS’ Office of the National Coordinator for Health IT (**ONC**) proposed reducing health IT certification criteria—cutting from 60 to 34 and modifying seven others—including criteria tied to **privacy and security controls**. Healthcare industry groups (including **CHIME** and the **American Hospital Association**) warned that removing longstanding certification requirements would shift privacy and security compliance burden from health IT developers (e.g., EHR and patient engagement tool vendors) to healthcare providers, potentially weakening standardized security expectations across certified health IT products.
Jun 29, 2026
HHS is signaling a more assertive posture on healthcare data governance, including **active enforcement of information-blocking rules** under the 21st Century Cures Act. In Senate HELP Committee testimony, HHS leadership emphasized improving nationwide health data exchange via **TEFCA**, noting broad connectivity across tens of thousands of locations and support for hundreds of millions of records, while lawmakers raised concerns that providers, health IT developers, and exchanges continue to impede data flow. Separately, HHS’ Office for Civil Rights has proposed the first major update to the **HIPAA Security Rule** in over two decades via a January 2025 Notice of Proposed Rulemaking, driven by escalating cyber threats and healthcare breaches. The proposal would move HIPAA from a flexible, risk-based approach toward more **prescriptive** requirements, including eliminating the “required” vs. “addressable” distinction for implementation specifications, updating/renumbering citations that will force control-mapping changes, mandating defined review and testing frequencies (often at least annually), and requiring detailed **asset inventories**, **network maps**, and **data-flow documentation** showing where ePHI/PHI is created, stored, processed, and transmitted.
Jun 29, 2026