The American Dental Association is urging the House Energy and Commerce Committee to consider the needs of small dental practices as it reviews legislation aimed at strengthening cybersecurity across the healthcare system. 

In an Oct. 22 letter, the ADA expressed concern that the Health Care Cybersecurity and Resiliency Act of 2026, S. 3315, which recently passed the Senate, could impose significant new requirements on dental practices without providing sufficient financial and technical assistance to help them comply. 

“We are concerned, however, that the Senate-passed bill could impose significant new requirements on HIPAA-covered dental practices without sufficient consideration of the size, resources, technological capabilities and risk profiles of those practices,” the ADA said. 

According to the letter, Section 8 of the legislation would direct the U.S. Department of Health and Human Services to establish minimum risk-based cybersecurity practices for entities covered by the Health Insurance Portability and Accountability Act, including HIPAA-covered dental practices. 

These requirements would address measures such as multifactor authentication, encryption, monitoring and penetration testing. Under the Senate-passed bill, they would take effect 36 months after enactment. 

The Association urged Congress to direct HHS to tailor cybersecurity requirements to a provider’s size, complexity, technical capabilities, risk profile and available resources. 

“The same controls should not apply in the same manner to a solo or small dental practice as to a large health system,” the ADA said. 

According to the letter, the Association recommended giving HHS authority to provide exemptions or reasonable alternatives to requirements such as penetration testing and continuous monitoring for small practices when the burden significantly outweighs the benefit and other safeguards can adequately address the risk. 

The ADA also raised concerns about Section 10, which would provide cybersecurity grants to certain categories of healthcare entities but generally exclude independent dental practices. It recommended expanding Section 10 to make small and independent healthcare practices — including dental practices — eligible for cybersecurity grants or comparable financial assistance, noting that technical assistance should be available to small practices beyond rural areas and that professional associations and other trusted organizations should be permitted to help provide cybersecurity resources. 

Additionally, the Association recommended tying the compliance period to the publication of final HHS regulations rather than just the date of enactment, giving practices time to update their technology, contracts, policies and training. 

“The Committee should direct HHS to phase implementation based on practice size and complexity and provide additional time for small practices where appropriate,” reads the letter. 

According to the letter, the ADA supports Section 7's recognition ofinvestments in established cybersecurity practices when HHS considers audits, fines and other enforcement remedies. 

Those provisions should be strengthened to give meaningful consideration to “reasonable, good-faith cybersecurity investments” and allow practices an opportunity to correct deficiencies before penalties are imposed, the letter recommended, except in cases involving willful neglect or an ongoing failure to address known problems. 

The ADA also raised concerns about how responsibility would be assigned when cybersecurity failures involve outside vendors or business associates. According to the letter, dental practices increasingly rely on third parties for electronic health records, communications, payment systems and other technology. 

Federal policy should assign responsibility to the entity responsible for a cybersecurity failure, the Association recommended. It also urged appropriate protections for dental practices that have exercised reasonable due diligence and fulfilled their own obligations when a breach results from a business associate’s failure to comply with applicable requirements. 

The letter builds on the ADA’s previous advocacy concerning federal cybersecurity requirements. The Association has previously urged Congress to account for the challenges small providers face when considering healthcare cybersecurity legislation, including the need for funding, technical assistance, phased implementation and opportunities to correct deficiencies before penalties are imposed. 

The ADA has also joined health care provider coalitions in raising concerns about the financial and administrative burdens that prescriptive cybersecurity requirements could place on small dental practices. 

“The ADA shares Congress’s goal of strengthening cybersecurity throughout the health care system,” the Association concluded. “Achieving that goal requires policies that improve security without imposing requirements that small health care providers cannot reasonably implement or afford.”