Can you restore critical systems in 72 hours?

Two federal measures are moving on healthcare cybersecurity. On 26 February 2026, the Senate HELP Committee advanced the Health Care Cybersecurity and Resiliency Act of 2026 (S.3315) by a vote of 22-1. Separately, HHS published a proposed overhaul of the HIPAA Security Rule (45 CFR Part 164) on 6 January 2025; the comment period closed 7 March 2025, and it is not yet final, with final action currently targeted for 2027. Neither is binding today. Both point in the same direction.

Both add preventive controls — multi-factor authentication, encryption, penetration testing, alignment to a NIST-based framework. Those matter, and they are the more visible part of each instrument. But the requirement that carries the heavier operational cost sits on the other side of an incident: what your organization can restore, and how fast. The bill's name signals it — the Cybersecurity and Resiliency Act — and the proposed rule specifies it.

What the proposed rule requires on recovery

Under the current Security Rule, contingency planning falls under the flexible "reasonable and appropriate" standard that has governed since 2005; a documented backup policy has often satisfied it. The proposed rule makes the recovery obligations specific. A regulated entity would be required to:

1. Restore critical systems and data within 72 hours of a loss, supported by immutable, logically separate backups that an attacker cannot encrypt alongside production data. (proposed contingency-plan specifications, 45 CFR 164.308)
2. Conduct a "criticality analysis" — rank information systems and technology assets by restoration priority. This is not limited to systems that hold ePHI; it includes any system material to patient care or business operations.
3. Test the contingency plan at least annually, and conduct regular tabletop exercises.
4. Receive 24-hour notice from business associates when they activate their own contingency plan.

These are business-continuity and disaster-recovery obligations with a defined time target. The statutory bill reinforces the same posture from the legislative side: it would direct HHS to set minimum standards, and it adds grants for under-resourced and rural providers and a mandate for HHS to share threat intelligence — the support a resilience program needs to function.

Prevention you buy; recovery you build

The two halves of these instruments demand different kinds of work.

Multi-factor authentication is a configuration. Encryption is a setting. Both can be procured and deployed on a defined timeline.

A demonstrable 72-hour restoration capability is built, not bought:

1. It depends on knowing which systems are genuinely critical — the criticality analysis — which many organizations have not formally completed.
2. It depends on backups that survive the incident rather than being encrypted with everything else, which is an architecture decision.
3. It depends on a plan specific people have run under realistic conditions — the tabletop — which cannot be substituted with a document.
4. It depends on knowing which vendors could halt operations, with 24-hour notification written into the contract.

This work is done before an incident or improvised during one. The latter is slower and more expensive.

The reference point: Change Healthcare, 2024

Both instruments trace to the Change Healthcare incident. What made it consequential was operational, not informational: claims processing stopped, pharmacies could not fill prescriptions, and providers could not bill — for weeks — because a critical node went down and the sector had no fast path to restore or route around it.

That is a continuity failure. The regulatory response, statute and rule alike, is aimed at recovery: whether an organization can keep operating through a disruption and how quickly it can return. The requirements are calibrated to an event the sector has already experienced.

Where to start

A sequence that builds resilience and holds up whichever instrument is finalized first:

1. Run the criticality analysis. Rank your systems by restoration priority, including the non-ePHI systems that keep care and revenue moving. Every other step depends on it.
2. Make recovery real and measured. Move to immutable, segregated backups, then time your actual restoration path against the 72-hour target — establish the real number now, not during an incident.
3. Test it end to end. Run a tabletop against a ransomware scenario, then a live restore of a critical system. The gap between the written plan and the exercise is the exposure.
4. Map vendor dependencies. Identify the business associates that could stop your operations and secure 24-hour contingency-activation notice in the contract.

None of this is exotic; it is the business-continuity and crisis-management discipline resilient operations already run. The bill and the rule add a clock.

The one question to take to your operations review

If your most critical clinical or billing system went down today, can you demonstrate restoration within 72 hours, from backups that survive the incident — and when was that tested end to end?

If that answer is not documented, the fastest way to find the gap is a facilitated restoration tabletop against a realistic scenario, followed by a timed restore of one critical system. That produces two things a COO can act on immediately: a real recovery-time number, and a prioritized list of what stands between you and the 72-hour target.

That is the work Resilis, the crisis-management and business-continuity platform I partner with, is built to run — turning the criticality analysis, restoration testing, tabletop exercises, and vendor-notification workflow into a capability you operate rather than a plan you file. If you want to pressure-test your 72-hour answer, that is a focused first engagement.

An operator's read of a proposed rule and a bill in progress — not legal advice. S.3315 has passed committee only, and the HIPAA Security Rule NPRM is not final; both could change or stall. Applicability is entity- and activity-specific; confirm against the current text and your own counsel before acting.

Sources: HIPAA Security Rule NPRM, "To Strengthen the Cybersecurity of Electronic Protected Health Information," 90 FR 898 (6 Jan 2025), and the HHS OCR fact sheet — contingency provisions incl. 72-hour restoration, immutable backups, criticality analysis, annual testing and tabletop exercises, and 24-hour business-associate notification; comment period closed 7 Mar 2025; not final (final action targeted 2027 per the federal Unified Agenda, RIN 0945-AA22). S.3315, Health Care Cybersecurity and Resiliency Act of 2026 (119th Congress), Senate HELP Committee markup 26 Feb 2026; Sen. Warner press release; CBO cost estimate.

#OperationalResilience #BusinessContinuity #HIPAA #HealthcareCybersecurity #DisasterRecovery