ADA urges House committee to tailor cybersecurity bill for small dental practices: 7 notes

The American Dental Association is urging the House Energy and Commerce Committee to account for the needs of small dental practices as it reviews a Senate-passed healthcare cybersecurity bill.

Seven notes:

1. In an Oct. 22 letter, the ADA said S. 3315, the Healthcare Cybersecurity and Resiliency Act of 2026, could impose significant requirements on dental practices without enough financial and technical help to comply. 
2. Section 8 would direct HHS to set minimum risk-based practices, including multifactor authentication, encryption, monitoring and penetration testing, which would go into effect 36 months after enactment.
3. The ADA asked Congress to direct HHS to tailor requirements to a provider’s size, complexity, technical capabilities, risk profile and resources. It also recommended giving HHS authority to exempt small practices from, or offer alternatives to, requirements such as penetration testing and continuous monitoring when the burden significantly outweighs the benefit.
4. Section 10 would fund cybersecurity grants for certain healthcare entities but generally excludes independent dental practices. The ADA recommended making small and independent practices eligible for grants or comparable financial assistance, offering technical assistance beyond rural areas and allowing professional associations to help provide resources.
5. The ADA recommended tying the compliance period to the publication of final HHS regulations rather than the date of enactment, giving practices time to update technology, contracts, policies and training.
6. The ADA supports Section 7’s recognition of established cybersecurity investments when HHS weighs audits and fines and other enforcement remedies, but wants it strengthened. The group recommended giving meaningful weight to good-faith investments and letting practices correct deficiencies before penalties, except in cases of willful neglect or ongoing failure to address known problems.
7. The ADA said responsibility for a cybersecurity failure should fall on the entity responsible, noting that practices increasingly rely on outside vendors for electronic health records, communications and payment systems. It urged protections for practices that exercised reasonable due diligence when a breach results from a business associate’s noncompliance.