HSCC backs healthcare cybersecurity bills and calls for broader funding

The Healthcare and Public Health Sector Coordinating Council’s Cybersecurity Working Group has told the House Energy and Commerce Subcommittee on Health that the sector needs government support to scale up its security practices. Executive director Greg Garcia endorsed the Healthcare Cybersecurity and Resiliency Act and the Rural Hospital Cybersecurity Enhancement Act, while suggesting refinements to both.

Garcia said the HSCC has published nearly 40 cybersecurity best practices since 2019, many written jointly with the Department of Health and Human Services. Small, rural and resource-constrained providers remain the most vulnerable, he said, and need a combination of government programmes, funding and market-based mutual support.

The council asked HHS and CISA to formally involve it in policy deliberations, threat information sharing and incident response advisories. It also wants Section 4 of the Cyber Resiliency Act clarified so the HHS cybersecurity coordination role sits at deputy assistant secretary level or above, and for grant funding to reach the widest possible group of resource-constrained providers, including money to replace vulnerable legacy medical devices.

The HSCC urged Congress not to mandate specific technical controls such as multifactor authentication and encryption in legislation, arguing that technical guidance belongs in evolving industry frameworks. It pointed to its 2025 report On the Edge and to resources including the Health Industry Cybersecurity Practices publication, the Healthcare Cyber Performance Goals, the Sector Mapping and Risk Toolkit and Operation Vital Signs, a tabletop exercise held in July 2026 with more than 500 participants from about 120 organisations.