The Senate passage date is not yet confirmed. The official Congress.gov status page still showed a March 2026 committee action when checked, so the October 1, 2026 vote should be verified against the Senate record. The bill's grant program has no stated funding amount. The HELP Committee advanced HCCRA 22-1 on February 26, 2026, with Sen. Rand Paul (R-Ky.) as the only no vote. Separately, Warner and Wyden reintroduced the Health Infrastructure Security and Accountability Act (HISAA) in September 2026. The bill is substantially identical to their 2024 version. It would direct HHS to set minimum security standards for all HIPAA covered entities and business associates, with enhanced standards for entities deemed of systematic importance to national security, updated at least every two years. It would also provide $800 million over two years to rural and urban safety-net hospitals, plus $500 million to incentivize all hospitals to adopt enhanced practices, and would impose annual HHS-set fees on covered entities.
HCCRA's House path is now the key question. A House Energy and Commerce subcommittee discussed both HCCRA and the Rural Hospital Cybersecurity Enhancement Act earlier this month. Attorneys advising hospitals, payers, and business associates should track House action on HCCRA's mandatory controls, since these would move HHS guidance from voluntary goals to binding obligations. HISAA's return also signals that a broader HIPAA Security Rule overhaul, more demanding than HCCRA, remains an active legislative push. The push follows the 2024 Change Healthcare attack, which exposed the protected health information of an estimated 192.7 million Americans.