The US Health Care Cybersecurity and Resiliency Act of 2026 could introduce stronger cybersecurity requirements for healthcare organizations. But the financial and operational consequences of inadequate security are already being felt across the industry.
Cyberattacks against healthcare organizations threaten far more than patient information.
They can interrupt clinical operations, prevent access to electronic health records, delay prescriptions, disrupt insurance claims and payments, and affect the ability of healthcare providers to deliver essential patient care.
They also carry a significant financial cost.
According to IBM's 2026 Cost of a Data Breach Report, the average cost of a healthcare data breach was $6.64 million, the highest average among the industries studied.
That figure covers costs associated with data breaches across the report's global healthcare sample. It is not a prediction of what every U.S. hospital will lose.
For healthcare leadership, the question is no longer simply whether security policies and procedures exist. It's whether the organization has the technical protections, tested response capabilities, and operational resilience needed to withstand an actual cyberattack.
The 2024 Change Healthcare cyberattack provides one of the clearest examples of how a cybersecurity incident can affect an entire healthcare ecosystem.
Change Healthcare supports essential healthcare transactions, including claims processing, payment operations, and pharmacy-related services.
When its systems were disrupted, the impact extended well beyond the organization itself.
UnitedHealth Group, the parent company of Change Healthcare, reported approximately $3.09 billion in total cyberattack impacts during 2024.
According to its financial disclosures, that included:
These figures represent UnitedHealth Group's reported 2024 impacts, not the total economic cost to every hospital or healthcare organization affected by the incident.
The American Hospital Association (AHA) surveyed approximately 1,000 hospitals in March 2024 about the effects of the Change Healthcare cyberattack.
The results demonstrated the wider consequences of a major healthcare technology disruption.
94% of responding hospitals reported a financial impact.
More than 80% reported an impact on cash flow. Among those experiencing cash-flow disruption, nearly 60% reported revenue impacts of $1 million or more per day.
Importantly, these figures describe affected revenue and cash flow. They should not be interpreted as permanent financial losses of the same amount.
The same survey found that 74% of responding hospitals reported impacts to direct patient care.
These findings raise an important question for healthcare executives:
What would an extended interruption to your organization's clinical systems, claims processing, or essential service providers cost?
For a large hospital network, the financial exposure may be substantial. For a smaller provider or rural healthcare facility, even a shorter disruption could create serious operational and financial pressure.
The costs of an incident also extend beyond immediate recovery. They can involve forensic investigations, legal expenses, notifications, security improvements, lost business, and longer term damage to patient and stakeholder confidence.
On September 30, 2026, the U.S. Senate passed the Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315).
The legislation has moved to the House of Representatives and has not yet become law.
If enacted, it would direct the Department of Health and Human Services (HHS) to update cybersecurity regulations affecting HIPAA covered entities, business associates, and certain other healthcare-sector organizations.
The Senate-passed legislation identifies several areas for stronger cybersecurity practices, including:
The legislation references NIST CSF, NIST RMF, NIST SP 800-53, and healthcare cybersecurity performance goals.
Under the Senate-passed text, the updated regulations would become effective 36 months after enactment. The bill does not specify a mandatory annual penetration testing frequency.
Those details remain subject to the legislative and regulatory processes.
However, healthcare organizations do not need to wait for new regulations to begin identifying weaknesses in their existing cybersecurity programs.
HIPAA assessments remain essential for understanding an organization's regulatory obligations and whether appropriate safeguards have been implemented.
A comprehensive assessment can include policy reviews, technical examinations, interviews, and evidence validation.
But not every assessment provider delivers the same level of technical security expertise.
Consider the difference between reviewing a policy that requires multifactor authentication and independently validating whether it is correctly implemented across critical systems. Or reviewing a vulnerability scan and conducting penetration testing to determine whether identified weaknesses can actually be exploited.
Both approaches have value, but they answer different questions.
Healthcare organisations should be asking their current assessment provider:
The proposed legislation creates an opportunity to evaluate whether an organization's current assessment approach offers sufficient depth to address both regulatory expectations and operational cybersecurity risk.
Foregenix combines cybersecurity consulting, governance, risk management, technical security assessment, penetration testing, and incident response expertise.
Our approach is designed to help healthcare organizations understand not only whether controls are documented and implemented, but also whether they provide effective protection.
Through a Foregenix Healthcare Cybersecurity Readiness Assessment, organizations can receive four core deliverables:
An evidence-based review of the organization's current cybersecurity posture against applicable HIPAA Security Rule obligations, relevant NIST frameworks, and healthcare cybersecurity guidance.
Proposed S. 3315 requirements can also be mapped separately to help organizations understand areas that may need further attention as the legislation progresses.
Assessment of selected technical safeguards, including access management, encryption, network and cloud security, monitoring, and vulnerability management.
When included in the engagement, Foregenix can conduct penetration testing to investigate exploitable weaknesses and potential attack paths.
Testing in healthcare environments must be carefully planned and authorized to protect clinical operations and patient safety.
Documented findings supported by assessment evidence, identifying weaknesses, existing controls, and potential business and clinical impacts.
Rather than simply identifying a missing security measure, the report can help leadership understand the significance of the weakness and the risk it presents.
A prioritized corrective-action plan identifying recommended improvements, accountable owners, target dates, and appropriate follow-up validation.
This allows organizations to make informed decisions about cybersecurity spending and focus resources on their most consequential risks.
The Change Healthcare incident demonstrated that the consequences of a cyberattack can extend across providers, patients, insurers, and technology suppliers.
For healthcare executives, cybersecurity planning must therefore consider more than the confidentiality of patient information.
It must also address operational dependencies, financial continuity, incident preparedness, and the ability to restore essential services.
The challenge is understanding how existing technical weaknesses could affect those operations before an incident occurs.
Foregenix can help healthcare organizations identify relevant security gaps, assess technical protections, and develop practical improvements aligned with their operational priorities.
The objective should not be to replace a qualified HIPAA assessor simply because new legislation is being considered.
It should be to determine whether your organization is receiving the appropriate combination of compliance knowledge, technical security expertise, and practical risk management advice.
If your current assessment provider cannot independently validate critical technical controls, investigate exploitable weaknesses, or help evaluate operational cybersecurity resilience, it may be time to consider additional expertise.
The financial consequences of cyber incidents are too significant to rely solely on assumptions about control effectiveness.
The Health Care Cybersecurity and Resiliency Act of 2026 is still moving through Congress, and its final requirements may change.
The business case for stronger cybersecurity, however, already exists.
The cost of a healthcare data breach can reach millions of dollars. A significant incident affecting a critical technology provider can interrupt operations and revenue across an entire healthcare ecosystem.
Foregenix can help healthcare organizations assess their current security posture, validate important safeguards, and establish a practical roadmap for improvement.
As legislation and implementing requirements are finalized, Foregenix can also support assessments against the applicable standards.
The question is not simply whether your organization is compliant.
It's whether your cybersecurity controls can withstand the threats that could disrupt patient care and cost your organization millions.