Congress Moves to Fortify Health Care Cybersecurity After Change Healthcare Breach

The shocking cyberattack on Change Healthcare two years ago exposed the vulnerability of America’s health care system, putting millions of patients’ personal information at risk and causing major disruptions to hospitals and clinics. Now, Congress is stepping up to ensure that such devastating attacks don’t happen again. Lawmakers are advancing a bipartisan plan aimed at strengthening health care cybersecurity, creating a framework to protect sensitive data, and safeguarding critical medical services. With health care cyberattacks costing billions and threatening patient care, this legislation could mark a turning point in the industry’s digital defenses.

Summarizing the Legislative Push

Last month, the Senate Health Committee overwhelmingly approved legislation to improve health care cybersecurity, passing with a decisive 22-1 vote. The bill focuses on several key measures:

Enhanced coordination between government agencies to respond to cyber threats.

Mandated incident response plans developed by the Department of Health and Human Services (HHS).

New grants for health care organizations to fund cyberattack preparation and recovery.

Requirements for multi-factor authentication and data encryption, addressing critical vulnerabilities highlighted by the Change Healthcare breach.

Sen. Bill Cassidy (R-La.), chair of the committee, emphasized that the 2024 attack had a broad impact on patient care and highlighted the urgency of fortifying defenses across the health system. Experts like Paul Luehr, a partner at Manatt in privacy and data security, note that health care bears the highest average cost of data breaches in the U.S., around $10 million per incident, with attacks often coming from overseas, limiting law enforcement response.

Previous legislation proposed in 2024 by Democrats took a more aggressive stance on cybersecurity and penalties but faced resistance from the health industry. The current bill represents a middle ground, designed to be more acceptable to hospitals and providers while still addressing urgent threats. Support comes from coalitions like the Healthcare Trust Institute (HTI) and major insurers such as the Blue Cross Blue Shield Association, highlighting the recognition that health data is highly valuable on the black market and a prime target for attackers.

Despite the progress, challenges remain. Congress has a packed legislative agenda, and health care measures rarely get standalone votes. Supporters may need to attach the bill to broader legislation, like year-end funding packages. Lingering tensions over unrelated health issues, such as Medicaid cuts or vaccine policies, could complicate the bill’s path. Nevertheless, experts stress that cyberattacks in health care are not just financial threats—they can directly affect patient safety, making the legislation a critical step forward.

What Undercode Say:

The Change Healthcare attack was a wake-up call for the entire health care ecosystem. While hospitals, insurance companies, and providers are already investing heavily in cybersecurity, the U.S. system remains fragmented, with uneven standards and inconsistent preparedness. This legislation represents a move toward centralized coordination, which is essential for timely response to large-scale breaches.

Mandatory encryption and multi-factor authentication will help close glaring security gaps, but technology alone is insufficient. Staff training, real-time threat intelligence sharing, and rapid incident response protocols are equally critical. The inclusion of government grants is a smart move, providing smaller providers with the resources they often lack for robust defenses.

However, political and procedural hurdles could slow implementation. With midterm elections approaching and Congress juggling numerous priorities, the risk is that the bill may be delayed or attached to a larger package where health cybersecurity is only a footnote. Even if passed, enforcement and compliance monitoring will require sustained attention to ensure hospitals and providers actually adopt the required safeguards.

The bill’s bipartisan nature, combined with backing from industry stakeholders, signals growing consensus that cyberattacks are no longer theoretical threats—they are operational and life-threatening realities. The success of this legislation could serve as a blueprint for other sectors facing critical infrastructure threats, including finance and energy.

Ultimately, the legislation reflects a shift from reactive to proactive cybersecurity strategy. Rather than simply responding to breaches, health care providers will now have a framework for anticipating attacks, minimizing patient impact, and limiting financial fallout. If implemented effectively, it could reduce the systemic risk that cyberattacks pose to the U.S. health system.

Fact Checker Results:

✅ Senate Health Committee approved the bill 22-1, confirming strong bipartisan support.
✅ Legislation mandates multi-factor authentication and encryption, aligning with cybersecurity best practices.
❌ The bill is not yet law and may face delays due to congressional scheduling and political disagreements.

Prediction:

The legislation is likely to pass if attached to broader government funding bills, but its impact will depend on enforcement and adoption by providers. Over the next 2–3 years, hospitals with proactive cybersecurity measures could see a significant reduction in breach-related disruptions, while smaller clinics may still struggle without sustained federal support. Cyberattacks in health care will remain a top risk, making this bill a first but essential step toward a more resilient system.