September 24, 2026 Congress Wants Mandatory Cybersecurity Standards for Healthcare: What HISAA Would Mean for Your Dental Practice
For years, the cybersecurity expectations placed on healthcare have been a patchwork of “you really should” rather than “you must.” That may be about to change. On September 17, 2026, U.S. Senators Mark Warner and Ron Wyden reintroduced the Health Infrastructure Security and Accountability Act (HISAA) — a bill that would replace healthcare’s voluntary cybersecurity guidance with enforceable minimum standards, mandatory audits, annual executive sign-off, and dramatically higher penalties.
It is federal legislation, not yet law, and its path through Congress is uncertain. But for a dental practice, the direction of travel matters more than the odds of any single bill. Regulators and lawmakers have concluded that asking nicely hasn’t worked, and the requirements being drafted are a preview of the standard every practice will eventually be held to. Here is what HISAA would demand, and what a small office should take from it right now.
Why lawmakers say voluntary standards failed
The argument behind the bill is a numbers story. When HISAA was first introduced in 2024, 394 large hacking-related breaches had been reported to the HHS Office for Civil Rights, exposing the protected health information of roughly 43 million Americans. Two years later, the year-to-date figures the senators cite are worse: 426 hacking-related breaches and about 73 million individuals affected — a jump of roughly 70% in people exposed.
In 2024, OCR published two tiers of voluntary cybersecurity performance goals (Essential and Enhanced) for the health sector, and predicted at the time that voluntary measures alone wouldn’t move the needle. The senators frame these attacks bluntly as “entirely preventable” results of “lax cybersecurity practices by health care providers and their business partners.” HISAA is their answer: make the floor mandatory. This is the same regulatory shift already visible elsewhere — the FDA, for example, has moved from suggesting to requiring imaging devices to be cyber-secure by design.
What HISAA would actually require
The 2026 bill is largely unchanged from the 2024 version, with the timeline shifted forward. Its core requirements would apply to covered entities and their business associates — language that reaches well beyond hospitals and into ordinary practices and the vendors they rely on:
- Mandatory minimum cybersecurity standards established, enforced, and updated by HHS at least every two years, with heightened requirements for “systemically important” entities.
- Continuity and recovery plans for technical failures, disruptive cyberattacks, and natural disasters — plus stress tests to prove you can actually recover essential functions, not just claim you can.
- Annual risk analyses, including a specific assessment of the risk you inherit through your business associates.
- Written annual attestations signed by the CEO and the chief information security officer, formally certifying the organization meets the applicable standards.
- Independent audits of security measures, plus annual HHS audits of at least 20 regulated entities, focused on those of systemic importance.
- Much larger penalties. The bill would lift the current caps, setting escalating minimums — from $500 for a no-knowledge violation up to $250,000 for uncorrected willful neglect.
To soften the blow for smaller and rural providers, HISAA pairs the mandates with money: a proposed $1.3 billion investment, including $800 million in up-front funding for hospitals in rural and underserved communities to adopt the essential goals, and $500 million in incentives for adopting the enhanced ones.
What this means for a dental practice
It is tempting to read “systemically important entities” and “annual HHS audits of at least 20 organizations” and conclude this is a big-hospital problem. That would be a mistake for two reasons.
First, the minimum standards and the business-associate language apply broadly — not only to the twenty organizations HHS audits each year. A dental practice is a covered entity, and your practice-management host, billing service, and imaging-software vendor are business associates. When a bill makes you responsible for assessing the risk your vendors carry, the collapse of an outsourced partner becomes your compliance problem, not just theirs. Practices learned that lesson the hard way when a billing vendor like eAssist landed on a ransomware leak site, dragging the patient data of the practices it served along with it.
Second, even if HISAA never passes in its current form, its requirements are a checklist of where the bar is heading. Annual risk analyses, tested recovery plans, vendor risk assessment, and leadership accountability are exactly what the delayed HIPAA Security Rule update also points toward. The specifics of the breach headlines change, but the lessons from this year’s dental data breaches keep repeating: the practices that get hurt are the ones treating security as a someday project.
The four things worth doing before any law forces you
You don’t need to wait for a final vote to be in a strong position. Everything HISAA would mandate is defensible, sensible practice today — and doing it now is far cheaper than doing it under an audit deadline:
- Run a real annual risk analysis. Not a checkbox — an honest inventory of where protected health information lives, who can reach it, and where it is exposed. This is already a HIPAA expectation; HISAA would simply put teeth behind it.
- Write down your vendors and their risk. List every business associate that touches patient data, confirm you have current agreements, and ask each one what happens to your data if they are breached. Their weakness is your liability.
- Have a recovery plan you have actually tested. A downtime and business-continuity plan only counts if you’ve rehearsed it. HISAA’s “stress test” language is a reminder that an untested backup is a hope, not a plan.
- Make one person accountable. The bill’s CEO/CISO attestation reflects a simple truth: security that is “everyone’s job” is usually no one’s. In a small practice, name an owner and give them a partner who does this for a living.
The trend line is the real story
Whether HISAA advances this session, stalls, or returns again in two years, the message from Washington is consistent and getting louder: voluntary is over. Between rising breach numbers, the FDA’s device mandates, the pending HIPAA Security Rule changes, and now a bill that would attach personal executive sign-off and six-figure penalties to healthcare security, the era of good intentions is closing. Practices that build the habits now — documented risk analyses, tested recovery, vendor oversight, clear accountability — won’t be scrambling when the floor becomes mandatory.
Where Compudent fits
Turning a dense piece of proposed legislation into a short list of things your practice should actually do is exactly the kind of translation we handle every day. Compudent Systems works with dental and medical practices across the GTA and Ontario to run genuine risk analyses, keep business-associate agreements current, build and test recovery plans, and put a steady hand on security so compliance isn’t a fire drill. If you’d like to know how your practice measures against where the standards are heading — before anyone requires you to — reach out to Compudent for an assessment. Getting ahead of the rules is always cheaper than catching up to them.
Sources & further reading:
- Democratic Senators Reintroduce the Health Infrastructure Security and Accountability Act
- Warner, Wyden Introduce Bill to Strengthen Cybersecurity Standards for American Health Care System