New HIPAA Security Requirements: What the Health Care Cybersecurity Act Means for Security Teams

For more than twenty years, since the HIPAA Security Rule took effect, healthcare security has been run under a rule that is flexible but loose. It asks you to look at your risks, write down your policies and pick sensible safeguards. But it has never named penetration testing to show what an attacker could reach, and it has never required testing that proves those safeguards hold up against a real attack.

A new Senate bill signals that this is about to change.

On September 30, 2026, the U.S. Senate passed the Health Care Cybersecurity and Resiliency Act (S. 3315) with no objections. It is not law yet. But it shows clearly where HIPAA security is going, and you can start most of the work today.

Why HIPAA security rules are changing now

The bill was introduced in December 2025 by a group of senators. It came after the Change Healthcare ransomware attack, when a single breach held up insurance claims, prescriptions and patient care across the country.

In February 2024, attackers logged into a Change Healthcare remote access portal with a stolen password. The portal did not ask for a second login factor. Once inside, they moved through the network for nine days, stole data and then launched ransomware. Pharmacy claims, medical billing and payments across the country stopped working. Change Healthcare later told HHS that about 192.7 million people were affected, the largest healthcare data breach in U.S. history.

Attacks like this made it clear that the current rules were not enough, and lawmakers moved to change them. A Senate committee approved the bill earlier this year, and the full Senate passed an updated version with no objections. It now goes to the House. It is not clear whether the House will vote on it before this Congress ends in January.

The bill matters even before it becomes law, for two reasons. First, both parties backed it, which is rare for a bill that adds rules. Second, it matches the HIPAA Security Rule update HHS proposed in January 2025. That update is stuck and may not be finished before July 2027, if ever. The message from Congress is simple: if HHS does not finish the job, Congress will make it.

What changes in the HIPAA Security Rule

The HIPAA Security Rule is designed to be flexible, scalable and technology neutral. It does not tell organizations which security measures to use. Instead, each organization picks safeguards that are "reasonable and appropriate" for its size, budget, technology and risks. Some safeguards, including encryption, are "addressable." That does not make them optional, but it lets an organization use an alternative if it documents why. The rule also requires a risk analysis and a periodic evaluation of how well your safeguards work, but it does not name specific tests, such as penetration testing.

The bill tells HHS to rewrite that rule so private healthcare organizations, and the vendors that handle their patient data, must all meet a basic set of security practices.

Here are the key changes in the bill that matter most for security teams:

• Minimum controls: Multi-factor authentication and encryption of patient data become required.
• Testing: Ongoing monitoring, including penetration testing, to keep systems protected.
• Frameworks: The new rules build on NIST CSF, NIST SP 800-53, the healthcare sector's own performance goals and CISA's healthcare goals.
• Credit for good practice: HHS must list which security practices and investments can lower fines, shorten audits or lead to better settlements, and what proof you need to send.
• Breach reports: Breach notices must state how many people were affected.
• Coordination: HHS and CISA must share threat information, plan how they respond to attacks together and look at cutting duplicate incident reports.

Overall, the bill tightens HIPAA's loose security requirements and makes healthcare safer as a result.

What the new HIPAA requirements mean for security teams

The goal of the bill is a stronger, more effective security posture across healthcare, built on a set of minimum controls and the testing needed to keep them working. But for this to work, a few things need to be true in practice:

1. Monitoring only counts if it actually catches attacks.

The bill requires monitoring to keep systems protected. In practice, monitoring runs on logs and alerts, which raises harder questions:

• Do the right logs actually reach your security tools?
• When an attacker makes a move, does a detection rule fire?
• Does your EDR or firewall stop the attack, or only watch it happen?

Controls also change over time. An EDR policy gets relaxed for a clinical app. A detection rule stops firing after a SIEM migration. None of this shows up in a policy document. It only shows up when you test your defenses the way an attacker would.

2. Penetration testing only works when it keeps up with change.

The bill names penetration testing but does not say how often. That does not mean once a year is enough. A pentest shows your exposure on the day it runs, but your environment changes every week as new systems, vendors and vulnerabilities appear. Today's AI-powered threats make that gap even wider. With AI, the time between a vulnerability going public and attackers using it has dropped from weeks to hours. A pentest done in March says little about your exposure in October.

To keep up, penetration testing has to run whenever something changes, not on a fixed schedule. That change could be a new exploit going public, a new attack aimed at hospitals, a security setting that quietly stops working, or a new system added to your network.

3. Current frameworks show what is coming.

Because the new rules will be built on NIST CSF, NIST SP 800-53 and the healthcare sector's own performance goals, the controls in those frameworks are a preview of what HHS will expect. Organizations that already meet them, and can show it, will have much less to do when the rules arrive.

If you are not sure where to begin, NIST CSF is a good place to start. Testing the controls behind your CSF requirements today puts you ahead of what HHS will expect.

4. Evidence is what counts.

Under Section 7, HHS would have to spell out which security practices it recognizes, how fully they must be in place, and what proof you need to send to get credit for them. That credit is real: lower fines, audits that close sooner and better settlement terms. But it all depends on evidence.

Saying you have strong security will not be enough. You will need a clear record of what you tested, what you found, what you fixed and who signed off. Organizations that build this record as part of their daily work will be ready. Those that scramble to pull it together the week before an audit will not.

Put together, the message for security leaders is simple. The question is shifting from "did you buy the right tools?" to two questions you must answer with evidence:

• Which of our exposures can an attacker actually exploit to reach patient data?
• Do our controls stop that attack, today, in our environment?

Penetration testing that runs whenever something changes answers the first. Monitoring that actually detects and stops attacks answers the second.

In day-to-day work, this splits into new responsibilities for each security team in a healthcare organization:

• Red teams. The bill names penetration testing as part of required monitoring. Red teams will need to plan and budget for it as ongoing work and keep results that others can review.
• Blue teams. Blue teams will need to show that logs reach the right tools, and that detections and alerts fire when a real attack happens.
• Security teams overall. MFA and encryption become required. Systems that run without them today will need to be fixed, even those covered by a documented exception.
• GRC and compliance teams. Along with written policies, auditors will expect test results and records that show controls are working.

How to prepare for the new HIPAA security requirements

Picus helps you meet what the bill asks for. It finds what an attacker could actually reach in your environment with autonomous pentesting, uses attack simulations to show whether your defenses stop, detect, only log or completely miss each attacker action, and keeps a record of every result as evidence.

Here is how this maps to each part of the bill:

What to do now, law or not

Whether or not the House passes it, this is where healthcare security is heading. Starting now gives teams time to close gaps before any new rules take effect.

• Test the controls you already have. Check that your EDR, SIEM and other tools stop and detect the attack techniques used against healthcare today.
• Test again when something changes. A new exploit, a new system or a changed security setting is a good reason to run another test.
• Start with NIST CSF and the healthcare sector's goals. These frameworks show what HHS is likely to expect, so test those controls first.
• Keep a record of your testing. Write down what you tested, what you found, what you fixed and who approved it. Under the bill, this kind of record can help lower penalties.

Having security is no longer the bar. Proving it works is, and Picus helps you prove it.

The Picus Autonomous Exposure Validation Platform shows what attackers can actually exploit and what your defenses really stop, so every exposure becomes a clear, defensible decision. See how Picus helps healthcare teams get ready for what is coming. Get your free demo now.