The American Dental Association calls for adjustments to healthcare cybersecurity legislation to reduce compliance burdens on small dental practices.

Source: American Dental Association (ADA)

DentalGoodNews｜Recently, the American Dental Association (ADA) sent a letter to the U.S. House Committee on Energy and Commerce, proposing amendments to the Health Care Cybersecurity and Resiliency Act of 2026 (S.3315) passed by the Senate. The ADA believes that the cybersecurity requirements the bill proposes to add could impose a significant compliance burden on small dental practices, and recommends adjusting requirements based on the size, technical capabilities, and risk profile of healthcare organizations, while expanding the scope of funding and technical support.

According to the bill text passed by the Senate on September 30, 2026, Section 8 requires the U.S. Department of Health and Human Services (HHS) to update relevant security regulations, requiring non-governmental entities in the healthcare and public health sectors, as well as HIPAA-covered entities and business associates, to adopt minimum risk-based cybersecurity measures.

The measures include multi-factor authentication, encryption of protected health information, information system monitoring (including penetration testing), and other security standards consistent with the national cybersecurity framework. The relevant provisions are scheduled to take effect 36 months after the bill's enactment. The ADA notes that uniform security requirements may not adequately account for the resources, technical capabilities, and actual risks of independent and small dental practices.

Regarding Section 8, the ADA recommends explicitly requiring HHS to develop differentiated implementation requirements based on organization size, business complexity, technical capabilities, risk profile, and available resources. For measures such as penetration testing and continuous monitoring, if their implementation burden clearly exceeds expected benefits and other security measures can adequately control risks, HHS should be authorized to provide exemptions or reasonable alternatives for small practices.

S.3315 - Section 8 of the Healthcare Cybersecurity and Resilience Act of 2026

Funding support is another key recommendation put forward by the ADA. Section 10 of the bill proposes providing dedicated cybersecurity grants to eligible organizations, with funding recipients primarily including federally qualified health centers, healthcare facilities operated by the Indian Health Service, nonprofit hospitals, rural health clinics, and nonprofit organizations that partner with or coordinate referrals with the above institutions. Independent dental practices typically do not fall into these funding categories. The ADA recommends expanding grant coverage to include small and independent healthcare organizations as eligible recipients, extending technical support from rural areas to a broader range of small practices, and allowing professional associations and other trusted organizations to participate in providing cybersecurity resources.

Regarding implementation timelines, the ADA recommends linking compliance deadlines to the issuance of HHS final implementation rules rather than solely to the bill's enactment date, and implementing in phases based on practice size and business complexity, reserving more adjustment time for small practices to update technical systems, contracts, internal policies, and personnel training.

Regarding enforcement and liability allocation, the ADA supports Section 7 of the bill, which incorporates cybersecurity measures already taken by organizations into regulatory considerations, but recommends further clarification: for organizations that have made reasonable, good-faith cybersecurity investments, regulators should give substantive consideration and, absent willful negligence or persistent failure to remediate known issues, allow them to complete remediation before penalties are imposed. Additionally, for cybersecurity incidents caused by third-party vendors or business associates, the ADA recommends allocating liability according to the actual responsible party; healthcare organizations that have fulfilled reasonable due diligence and their own compliance obligations should receive appropriate protection.

In China, the National Health Commission, the National Administration of Traditional Chinese Medicine, and the National Disease Control and Prevention Administration jointly issued the "Measures for the Management of Cybersecurity in Healthcare Institutions" (Guo Wei Gui Hua Fa [2022] No. 29) in 2022, requiring healthcare institutions to implement the cybersecurity classified protection system and to conduct annual security self-assessments in the form of document verification, vulnerability scanning, and penetration testing during network operations, promptly remediating identified security risks. These measures apply to the cybersecurity management of networks operated by healthcare institutions, and primary healthcare institutions not included in regional primary health information systems are required to refer to and comply with them.