The "Health Care Cybersecurity and Resiliency Act of 2025" mandates that the Secretary of Health and Human Services (HHS) and the Director of the Cybersecurity and Infrastructure Security Agency (CISA) coordinate to improve cybersecurity across the Healthcare and Public Health Sector. This coordination includes making resources available to entities for sharing cyber threat indicators and defensive measures. The bill also clarifies that the HHS Secretary, through the Assistant Secretary for Preparedness and Response, will lead oversight and coordination of cybersecurity activities within HHS.

HHS is required to develop and implement a cybersecurity incident response plan within one year, outlining processes to prepare for, prevent, detect, and recover from cybersecurity incidents involving its information systems. The plan must include strategies for risk assessment, prevention, detection, damage minimization, data protection, and recovery. Additionally, the bill amends the HITECH Act to update breach reporting regulations, requiring public display of corrective actions, consideration of recognized security practices, and the number of affected individuals.

The legislation enhances the recognition of security practices by requiring HHS to issue guidance on how these practices are considered when assessing fines and conducting audits. Furthermore, it mandates that HHS update privacy, security, and breach notification regulations to require covered entities and business associates to adopt specific cybersecurity practices, including multifactor authentication, encryption safeguards, and regular audits like penetration testing, along with other minimum standards determined by the Secretary.

The bill also directs HHS to issue guidance on rural cybersecurity readiness and establishes a new grant program to help eligible entities like hospitals and health centers adopt cybersecurity best practices. Finally, it requires HHS, in coordination with CISA, to provide training for healthcare asset owners and operators and develop a strategic plan to grow the healthcare cybersecurity workforce.