Washington, D.C., September 15, 2026 – Today, the Healthcare and Public Health Sector Coordinating Council (HSCC) Cybersecurity Working Group testified to the House Energy and Commerce Subcommittee on Health about progress the Council is making to equip health sector entities with strong cybersecurity practices. The Council’s Executive Director Greg Garcia also commented favorably with suggestions for refinement on two cybersecurity bills the committee is considering – the “Healthcare Cybersecurity and Resiliency Act” and the “Rural Hospital Cybersecurity Enhancement Act.”
Garcia told the committee that the HSCC has produced almost 40 healthcare cybersecurity best practices since 2019 – some published jointly with HHS. He said that “Implementation of these tools will measurably improve the security and resiliency of the nation’s healthcare system if we can get them to the stakeholders who need them, with the government’s help, at scale.”
The threat of cyber insecurity among small, rural and resource-constrained health providers makes them the most vulnerable in the sector, Garcia said, which “calls for a concerted, multi-pronged combination of government programs, assistance, and funding coupled with market-based mutual support, community defense and safe harbor dispensation when they take appropriate steps to protect themselves.”
A bill pending before the committee – the Rural Cybersecurity Enhancement Act – would provide targeted assistance to the nation’s small, rural, and resource-constrained health providers. In supporting the bill’s provisions, Garcia pointed the committee to a 2025 HSCC report on rural healthcare cybersecurity challenges and needs – “On the Edge: Cybersecurity Health of America’s Resource-Constrained Health Providers”, which validates the findings and provisions in the committee bill.
Garcia further observed that both bills “represent a welcome indication of the committee’s attention to this complex and evolving challenge,” adding that “where clarifications or refinements are needed in certain provisions, we stand ready to work with the committee to consider recommendations.” HSCC suggestions include:
- Direct HHS and CISA to formally involve the council in cybersecurity policy deliberations, threat information sharing, and incident response advisories to the community;
- Clarify Section 4 of the Cyber Resiliency Act to require that the HHS designee for internal and external cybersecurity coordination be at the deputy assistant secretary level or above with the appropriate authority to influence policy and programmatic decisions;
- Ensure that grant funding is available to the broadest community of resource-constrained health providers, and include the ability to replace old and vulnerable medical devices that can no longer be protected from cyber threats; and
- Avoid Congressionally-prescribed technical solutions such as “multifactor authentication” and “encryption”. Technology is constantly evolving in ways that will change the meaning, implementation and effectiveness of technical products and methods. Such technical guidance is better left to evolving industry security frameworks that are already widely recognized and referenced.
