CYBERSECURITY MONTH 2026
Hospitals attesting to the Medicare Promoting Interoperability Program for calendar year 2026 have to answer “yes” to something new: that they completed a full annual self-assessment against all eight SAFER Guides, not only the High Priority Practices guide (FY 2026 IPPS/LTCH PPS final rule, via Medcurity). One of those eight is the Contingency Planning guide. Every eligible hospital and critical access hospital now has to examine how its EHR holds up when it goes down, then sign its name to the result.
That’s one of four federal actions this year that change what a hospital security program has to prove. Here’s what each one says, what it doesn’t, and where downtime fits.
| Action | Status | Applies to | Downtime relevance |
|---|---|---|---|
| All eight SAFER Guides, annual attestation | Final. Effective CY 2026.FY 2026 IPPS/LTCH PPS final rule (Medcurity) | Hospitals and CAHs in Medicare Promoting Interoperability | Contingency Planning guide is now a required annual self-assessment. |
| CMS-0062-P, drug prior authorization | Proposed. Comments closed June 15, 2026.CMS; Crowell & Moring | MA organizations, Medicaid and CHIP, QHP issuers on federal exchanges | Indirect. More payer-provider API connections to inventory. |
| CMS internal shift to continuous, automated defense | Under way. ARS 5.2 published June 29, 2026.CMS ISPG; ExecutiveGov | CMS systems | Signals where CMS expectations are heading. |
| S. 3315, Health Care Cybersecurity and Resiliency Act | Passed Senate by unanimous consent, Sept 30, 2026. Pending in House.AHA; Congress.gov | HIPAA-regulated entities; grants for rural and under-resourced providers | Would make MFA, PHI encryption and penetration testing binding HIPAA minimums. |
SAFER Guides: all eight, every year.
ASTP/ONC released the 2025 SAFER Guides in August 2025, consolidated into eight guides focused on “the highest risk, most commonly occurring issues” (HealthIT.gov). The FY 2026 IPPS final rule turned the full set into an annual attestation starting in CY 2026. The updated guides put added weight on patient safety, AI risk in clinical care, and EHR safeguards (Medcurity).
The same rule tightened the Security Risk Analysis measure. Hospitals now attest “yes” to conducting a Security Risk Analysis and to carrying out Security Risk Management (Medcurity). Finding a risk no longer satisfies the measure. Acting on it does.
The Contingency Planning guide is where most hospitals will feel this. A downtime plan can look fine in a binder and still fail the question a real outage asks: what do clinicians use to chart and place orders if the EHR is gone for two weeks?
Drug prior authorization moves to APIs. Proposed, not final.
CMS released the Interoperability Standards and Prior Authorization for Drugs proposed rule (CMS-0062-P) in April 2026. Comments closed June 15, 2026 (CMS). The rule would extend CMS’s electronic prior authorization and API requirements to drugs across Medicare Advantage, Medicaid and CHIP, and QHP issuers on the federal exchanges.
QHP issuers would get one day to decide urgent drug requests and three days for routine ones. Payers would publish drug prior authorization metrics, with reporting starting in 2028, and most requirements carry a proposed compliance date of October 1, 2027 (Crowell & Moring).
One correction to how this rule is often summarized: it doesn’t add a cybersecurity reporting requirement. The metrics are prior authorization performance data. The security effect for hospitals is indirect. More of the authorization workflow would run over API connections between payers and providers, and each connection belongs on your security team’s inventory.
CMS is changing how it secures itself.
CMS Chief Information Security Officer Keith Busby described the agency’s shift in August: “We’re starting to make that transition from just having visibility, but using automated continuous reaction based off of that visibility.” His stated principle is “protect first, visibility second.” CMS also uses CISA’s bug bounty program to bring in outside researchers to find vulnerabilities in its public-facing systems (ExecutiveGov, August 2026).
The tooling followed. CMS published Acceptable Risk Safeguards (ARS) 5.2 on June 29, 2026, adding Zero Trust requirements and new safeguards for high value assets (CMS Information Security and Privacy Group). In March, CMS set a June 30, 2026 deadline to move to CrowdStrike EDR for 100% endpoint coverage under the HHS get-well plan, and began replacing Tenable.sc with Tenable One (CMS ISPG).
None of this is a rule for hospitals. Still, when the agency that writes your Conditions of Participation decides point-in-time compliance isn’t enough for its own systems, expect that view to show up in what it asks of you.
The Senate passed the HCRA.
On September 30, 2026, the Senate passed the Health Care Cybersecurity and Resiliency Act (S. 3315) by unanimous consent (AHA). Sen. Bill Cassidy, chair of the HELP Committee, introduced it in December 2025 with bipartisan cosponsors including Sens. Mark Warner and Maggie Hassan (Congress.gov).
The bill directs HHS and CISA to build a joint healthcare cybersecurity capability plan within one year, and requires HHS to expand its cyber incident response plan. It authorizes grants for rural and under-resourced providers. It also directs HHS to update the HIPAA Security Rule with binding minimums: multifactor authentication, encryption of protected health information, and regular monitoring that includes penetration testing, with compliance due 36 months after enactment (S. 3315 text). The OCR breach portal would also show whether a breached entity had recognized security practices in place (HIPAA Journal).
It isn’t law yet. The bill now goes to the House.
A related HHS action is still pending. The January 2025 proposed HIPAA Security Rule update would require regulated entities to restore critical relevant electronic information systems and data “within 72 hours of the loss of functionality” (DLA Piper). HIPAA Journal reports the final rule has been pushed to July 2027 at the earliest.
Where downtime fits.
Read the four actions together and most of the weight falls on keeping attackers out and finding them faster. MFA, encryption, EDR, penetration testing and bug bounties all live on that side of the line. Two pieces ask what happens to patient care when those controls fail anyway. The SAFER Contingency Planning guide makes hospitals assess it every year. The proposed 72-hour restoration standard would put a clock on it.
Seventy-two hours is a restore target for systems. It says nothing about what clinicians use during those 72 hours, or during week two if the restore slips. That window is the one Spare Tire covers.
Spare Tire® is an EHR downtime continuity layer, externally hosted and architecturally separated from the systems it protects. In normal operation it stays current through bi-directional HL7 sync, with a read-only API. When the primary EHR goes down, clinicians sign in to Spare Tire and keep charting and placing orders. When the primary environment is restored and verified clean, records created during the outage sync back through CyberVault’s validation gate.
If your CY 2026 SAFER self-assessment is still on the Q4 list, run the Contingency Planning guide against a two-week outage instead of a two-hour one. If the honest answer is paper, we should talk.
Frequently asked questions
What changed with the SAFER Guides for hospitals in 2026?
Starting in CY 2026, hospitals and critical access hospitals in the Medicare Promoting Interoperability Program must attest to a full annual self-assessment using all eight 2025 SAFER Guides, including Contingency Planning. Previously only the High Priority Practices guide was required. The change comes from the FY 2026 IPPS/LTCH PPS final rule.
Does CMS-0062-P add cybersecurity reporting requirements?
No. CMS-0062-P is a proposed rule that extends electronic prior authorization and API requirements to drugs. Its reporting provisions cover prior authorization performance metrics, starting in 2028.
Is the Health Care Cybersecurity and Resiliency Act law?
Not yet. The Senate passed S. 3315 by unanimous consent on September 30, 2026. It now goes to the House.
Is there a federal deadline for restoring EHR systems after an attack?
Not in final form. HHS’s January 2025 proposed HIPAA Security Rule update would require restoring critical relevant electronic information systems and data within 72 hours of the loss of functionality. The final rule has been delayed to July 2027 at the earliest, per HIPAA Journal.