Picus Security addresses pending U.S. healthcare cybersecurity legislation

The U.S. Health Care Cybersecurity and Resiliency Act (S. 3315) proposes significant updates to the HIPAA Security Rule, mandating stricter risk-based cybersecurity practices for healthcare entities and business associates. If enacted, the bill would require the adoption of multifactor authentication, data encryption, and regular monitoring, including penetration testing.

Following its passage in the Senate, the bill now awaits review by the House of Representatives. While the legislation provides a 36-month window for full implementation once signed, it requires HHS to issue updated regulatory guidance within one year. The bill also expands accountability, requiring business associates to meet these standards directly rather than relying solely on contractual obligations.

Picus Security argues that compliance in this evolving regulatory environment requires continuous verification. The company suggests that organizations use automated validation platforms to simulate real-world cyberattacks, allowing security teams to prove their control efficacy and identify potential security gaps before they can be exploited by threat actors.