Back in July Sen Capito (R,WV) introduced S 2587, the Departments of Labor, Health and Human Services, and Education, and Related Agencies Appropriations Act, 2026. The Senate Appropriations Committee published their Report on the bill at the same time. There are two cybersecurity mentions in passing in the bill and five cybersecurity discussions in the Report. There are also three cybersecurity mentions in passing and six cybersecurity earmarks in the Report.
S 2587 is similar to S 4942, the Departments of Labor, Health and Human Services, and Education, and Related Agencies Appropriations Act, 2025, that was introduced by Sen Baldwin (D,WI) in August 2025. No action was taken on that bill (or its House counterpart – HR 9029) in the Senate in the 118th Congress.
Cybersecurity in the Bill
There are two areas in the bill where cybersecurity issues are mentioned in passing:
On pages 115-6 cybersecurity is mentioned as one of the issues to be addressed by the spending for expenses necessary to carry out title II of the Public Health Service Act, and
On pgs 161-2 cybersecurity is mentioned as one of the allowable areas where spending transfers are authorized at an excepted rate of 10%.
Cybersecurity Discussions in the Report
On page 64, under the heading of ‘Rural Health Research’, the report notes that: “The Committee urges HRSA [Health Resources and Services Administration] to clarify that funds from the Small Hospital Improvement Program may be used to support cybersecurity measures including purchases of hardware, software, and training.”
On page 25, under the heading of ‘Hospital Cybersecurity Infrastructure’, the report notes:
“As the number of health-related cyber-attacks increase, hospitals are reporting that cyber insurance premiums are increasing at a rate of 20–50 percent per year. The Committee encourages the administration to work with hospitals, especially small and rural providers, and other healthcare stakeholders prior to finalizing any new cybersecurity standards.”
On page 251, under the heading of ‘Hospital Cybersecurity Infrastructure’, the report notes:
“The Committee recognizes that cybersecurity has been one of the most significant investments hospitals have had to make in the past decade in terms of technology, workforce, and insurance. As the number of health-related cyber-attacks increase, hospitals are reporting that cyber insurance premiums are increasing at a rate of 20–50 percent per year. The Committee encourages the administration to work with hospitals, especially small and rural providers, and other healthcare stakeholders prior to finalizing any new cybersecurity standards”
On page 261, under the heading of ‘Cybersecurity’, the report notes:
“The Committee provides $100,000,000 for information technology cybersecurity in the Office of the Chief Information Officer and HHS-wide to strengthen the Department’s cybersecurity posture. These funds provide continuous monitoring and security incident response coordination for the Department’s computer systems and networks.”
On page 313, under the heading of ‘Cybersecurity and other Requirements’, the report notes:
“The Committee notes the importance of IES’s [Institute of Education Sciences] statutorily-required activities related to cybersecurity, privacy, accuracy, and confidentiality. The Committee directs the required administrative and staffing plan to include a description of implemented actions and a plan and associated timeline for future actions needed to comply with applicable requirements.”
Cybersecurity Mentions in the Report
There are cybersecurity mentions in passing in the following sections in the Report:
Pgs 232-3, under ‘Report on Essential Medicines Risk Assessment’,
Pg 247, under the heading of ‘General Department Management’,
Pg 254, under the heading of ‘Pharmaceutical Supply Chain Risk Assessment’,
Cybersecurity Earmarks
The following cybersecurity related earmarks are listed in the tables found on pages 347 to 425:
HHS - Health Resources and Services Administration, Mon Health Medical Center, WV, for equipment for technical infrastructure upgrades and cybersecurity technology $8,100,000 Sen Capito (R,WV), Sen Justice (R,WV),
ED - Higher Education, Chamber of Commerce of the Borough of Queens Inc, NY, for a cybersecurity education and training program, including the purchase of technology and equipment $1,500,000 Sen Gillibrand (D,NY),
ED - Higher Education, New Jersey Institute of Technology, NJ, for cybersecurity education, including the purchase of equipment $1,000,000 Sen Booker (D,NJ),
ED - Higher Education, Northern Michigan University, MI, for improving cybersecurity education, including purchasing equipment and technology $606,000 Sen Peters (D,MI),
ED - Higher Education, Northwest Indian College, WA, for cybersecurity education, including the purchase of equipment $500,000 Sen Murray (D,WA),
ED - Higher Education, Rhode Island College, RI, for improving cybersecurity and technology education programs, including the purchase of equipment and technology $3,000,000 Sen Reed (D,RI),
Moving Forward
It has been reported that the Senate is considering adding the language from this bill to the substitute language that will be considered when the Senate takes up HR 4016, possibly as early as next week. As of yesterday, no amendments to HR 4016 have been proposed in the Senate, so we do not know what language will be considered.
Commentary
The House has not yet taken up HR 5304, the House version of this bill. Normally, the House would first pass their bill then the Senate would take up the bill, substituting their language before beginning the amendment process. A conference committee would then work out the differences. Making up a multi-bill mini-bus, appears to becoming a way to work around the amount of time it takes for the Senate to consider spending bills. It also looks like it is a way of bypassing House consideration of controversial spending bills without upsetting the spending radicals too much.