CyberMed
← All articles

Congress Just Advanced a Healthcare Cybersecurity Bill. What It Means for Medical Device Companies.

Published Updated Jose Bohorquez, PhDEditorial policy

The Health Care Cybersecurity and Resiliency Act (S.3315) cleared the Senate HELP Committee. What it would require and what it means for device manufacturers.

The Senate Health, Education, Labor, and Pensions Committee advanced S.3315, the Health Care Cybersecurity and Resiliency Act, on February 26, 2026, by a 22 to 1 vote. It was reported to the full Senate on March 23. This is happening against a backdrop of the Stryker wiper attack in March and a February ransomware incident at the University of Mississippi Medical Center that closed its outpatient clinics statewide and cancelled elective procedures.

If you are a medical device manufacturer, read this one carefully. If the bill passes, it raises the mandatory floor across the health sector you sell into.

What S.3315 actually does

The bill has three core components that matter for device companies:

  • Minimum cybersecurity practices for the health sector. The bill would direct HHS to update HIPAA security rules with minimum risk-based practices, including encryption, multi-factor authentication, and monitoring and testing practices such as penetration testing. These would apply to covered entities and business associates. The hospitals and health systems you connect to, distribute through, or partner with would face stricter requirements.
  • HHS and CISA coordination. The bill would formalize coordination between HHS and CISA on healthcare cybersecurity and name the HHS Administration for Strategic Preparedness and Response as the Sector Risk Management Agency. CISA, which issued an alert on hardening endpoint management platforms after the Stryker attack, would have an explicit mandate to work with HHS on sector-wide practices.
  • Grant funding for cybersecurity improvements. The bill would create a grant program within HHS to strengthen cybersecurity. In practice, that means federal money for a wave of upgrades at the hospitals and health systems that process your device data or connect to your devices.

The committee summary also describes an incident response plan expectation for regulated entities, updates to breach reporting, and a safe harbor for entities that meet the minimum practices.

What it does not cover, but you should treat as if it does

The bill is not a medical device regulation. FDA's Section 524B authority and the premarket cybersecurity guidance (February 2026) remain the governing framework for device manufacturers. S.3315 does not replace or supersede either. For where regulation is heading more broadly, our book chapter on future regulatory trends covers the trajectory.

The downstream effect is still clear. When the hospitals and health systems buying your devices are legally required to document their security posture, they will ask harder questions about the devices they connect to their networks. Procurement security questionnaires get longer. Hospital security teams push back on devices that cannot show a documented cybersecurity program.

Companies with clean, documented cybersecurity packages, SBOMs, vulnerability management plans, and penetration test results will have an easier time in those conversations than companies piecing something together under deadline.

The timing is not a coincidence

This bill cleared committee in the same quarter that a major medical device company was hit by a nation-state attack. Stryker confirmed that attackers wiped employee laptops and phones. The attackers claimed 200,000 devices, a number Stryker has not confirmed. RAPS Regulatory Focus is already asking whether FDA will use the event to reassess cybersecurity requirements.

Congress is moving because the threat is visible. The Stryker attack made mainstream news and the industry trade press. When a wiper attack on a medical device company gets that kind of coverage, legislators pay attention.

What to do now

If your company is already submitting to FDA with a full cybersecurity documentation package, you are ahead of most of the market. "Ahead" is not the same as "done."

Three things worth doing now:

  1. Review your SBOM quality. The SBOM obligation comes from Section 524B(b)(3) of the FD&C Act, not from S.3315. But hospital procurement teams operating under stricter HIPAA practices will ask for it too. If you can't produce a clean, current SBOM, that gap matters in both places.
  2. Check your penetration testing cadence. The bill lists penetration testing among the minimum practices for HIPAA-regulated entities. It binds your customers, not you, but those customers will expect the same discipline from their vendors. If your last pen test was done before your 510(k) submission and nothing has changed since, you are running on stale assurance.
  3. Document your incident response plan. The gap between ransomware response and wiper response is significant: with a wiper, there are no encrypted files to recover, only backups. For cyber devices, Section 524B(b)(1) requires a postmarket vulnerability plan, and FDA's guidance Section VI.B describes the cybersecurity management plan behind it. Our book chapter on incident response covers what the plan needs.

If you need to know where you stand before this environment gets tighter, the FDA 524B Readiness Assessment is a practical place to start.

Need help with FDA cybersecurity documentation or a penetration test? Email us at info@cybermed.ai.

Sources

Frequently asked questions

›What is the Health Care Cybersecurity and Resiliency Act?

S.3315 is a Senate bill that would direct HHS to set minimum cybersecurity practices for HIPAA-regulated entities, formalize HHS and CISA coordination, and create a grant program. The Senate HELP Committee advanced it on February 26, 2026 by a 22 to 1 vote.

›Does S.3315 regulate medical device manufacturers?

Not directly. Its minimum practices bind HIPAA covered entities and business associates, such as hospitals and health systems. Device manufacturers remain governed by FDA, including Section 524B of the FD&C Act and the February 2026 premarket cybersecurity guidance.

›Does the bill require an SBOM?

No. The SBOM obligation for cyber devices comes from Section 524B(b)(3) of the FD&C Act, not from S.3315.

›What should device companies do now?

Keep the SBOM current, keep penetration testing on a cadence rather than one test before the 510(k), and document and test an incident response plan that covers destructive attacks. Hospital procurement questions will get harder as the bill's practices take hold.