A bill moving through Congress could reshape how dental practices handle data security — and the American Dental Association is pushing back on parts of it before it reaches the House floor.
What the Bill Would Do
The Health Care Cybersecurity and Resiliency Act would direct HHS to update the security regulations under HIPAA to require non-governmental entities in the Healthcare and Public Health Sector, including covered entities and business associates, to adopt minimum risk-based cybersecurity practices, such as multifactor authentication, encryption of protected health information, and monitoring that includes penetration testing. S. 3315 passed the U.S. Senate by unanimous consent on September 30, 2026, and the House received it on October 5, 2026, but has not yet voted on it. If enacted, the new requirements would take effect 36 months after the date of enactment.
Why the ADA Is Concerned
The American Dental Association is urging the House Energy and Commerce Committee to consider the needs of small dental practices as it reviews the legislation, warning in an Oct. 22 letter that the Senate-passed bill could impose significant new requirements on dental practices without providing sufficient financial and technical assistance to help them comply. Section 8 of the bill would direct HHS to establish minimum risk-based cybersecurity practices for entities covered by HIPAA, including HIPAA-covered dental practices.
The ADA's objection isn't to cybersecurity standards in principle — it's to a one-size-fits-all approach. As the association put it, the same controls should not apply in the same manner to a solo or small dental practice as to a large health system. The ADA recommended expanding grant eligibility to make small and independent healthcare practices, including dental practices, eligible for cybersecurity grants or comparable financial assistance, and asked that professional associations be permitted to help provide cybersecurity resources.
There's also a funding gap worth flagging: the ADA raised concerns about Section 10, which would provide cybersecurity grants to certain categories of healthcare entities but generally exclude independent dental practices. In other words, the bill could require practices to upgrade their systems while steering the financial help elsewhere.
What This Means for Your Practice Now
Nothing is final, and nothing is due yet. The bill is not law yet — the House received S. 3315 on October 5, 2026, and it now waits there. But the direction of travel is clear. If passed, the Act would require HIPAA-regulated entities to make significant investments in cybersecurity infrastructure, including implementing multifactor authentication, encryption, penetration testing, and alignment with national frameworks such as NIST.
For office managers and practice owners, this is a good moment to take stock — not to panic. Confirm your practice already has multifactor authentication enabled on email, patient portals, and practice management software. Ask your IT vendor or EHR provider whether encryption is active for data at rest and in transit. Dental practices increasingly rely on third parties for electronic health records, communications, payment systems and other technology, so it's worth confirming those vendors' own security posture as part of your risk analysis, since their practices become your exposure.
My DDS Supply will continue tracking this bill as it moves through the House. In the meantime, the fundamentals of a solid HIPAA security program — risk assessments, staff training, documented policies, and a written incident response plan — remain the best investment a practice can make regardless of how the legislation ultimately shakes out.
Frequently Asked Questions
Is the Health Care Cybersecurity and Resiliency Act already law?
No. As of early November 2026, the bill has passed the Senate but is still awaiting a vote in the House of Representatives before it could be signed into law.
Will dental practices be required to have multifactor authentication?
If the bill becomes law as written, HHS would be directed to update HIPAA security rules to require multifactor authentication, encryption, and monitoring with penetration testing, but these changes would not take effect until 36 months after enactment.
Why is the ADA opposing parts of this cybersecurity bill?
The ADA isn't opposed to stronger cybersecurity, but it's asking Congress to tailor requirements and grant funding to the realities of small, independent dental practices rather than treating them the same as large hospital systems.
What should dental offices do now to prepare?
Practices can get ahead of future requirements by confirming multifactor authentication and encryption are already active on their email, patient portal, and practice management systems, and by reviewing their HIPAA risk assessment and incident response plan.