Cybersecurity Policy Report, Bill Aims to Develop Cyber Workforce for Rural Hospitals, (Jun 26, 2025)
The Department of Health and Human Services would have to develop a plan to expand rural hospitals’ access to cybersecurity expertise under legislation introduced yesterday in the Senate.
The Rural Hospital Cybersecurity Enhancement Act (S.B. 2169, 119th Cong. (2025)) is being sponsored by Sen. Josh Hawley (R., Mo.) and co-sponsored by Sens. Maggie Hassan (D., N.H.) and Mark Kelly (D., Ariz.).
The bill would require HHS to develop “a comprehensive rural hospital cybersecurity workforce development strategy that, at a minimum, considers public-private partnerships, development of curricula and training resources, and policy recommendations,” the senators said in a news release.
HHS would also have to provide “instructional materials for rural hospitals to train staff on fundamental cybersecurity measures,” they said.
A “rural hospital,” as defined in the bill, is a health care facility “located in a non-urbanized area, as determined by the Bureau of the Census,” that provides “inpatient and outpatient healthcare services, including primary care, emergency care, and diagnostic services.”
“Unlike larger urban hospitals, rural hospitals often have little to no full-time cybersecurity personnel and are particularly exposed to cyberattacks. Vulnerabilities in rural hospitals’ cybersecurity defenses can also be used as entry points to disrupt larger healthcare systems, potentially compromising the sensitive medical and personal data of hundreds of thousands of American patients at once,” the senators explained.
Sen. Hawley introduced similar legislation in 2023 that stalled after clearing the Senate Homeland Security and Governmental Affairs Committee (CPR, June 14, 2023).
“Nearly half of the hospitals in my state are rural. I grew up in a town of 4,000 people—I have lived this firsthand,” Sen. Hawley said. “Congress must take action to shore up the ability of small-town hospitals to protect working Americans’ health records from debilitating cyberattacks.”
“Cyberattacks on hospitals can put at risk people’s medical information, and also sometimes shut the hospital down as it recovers, putting lifesaving care at risk,” Sen. Hassan said. “This bipartisan legislation is an important step toward ensuring that rural hospitals have the resources, tools, and training that they need to keep patients safe and protect hospitals from attacks from cybercriminals.”
“Rural hospitals are on the frontlines of care for so many Arizonans, but too often they’re underfunded and overexposed to cyber threats that can jeopardize patient safety. We saw this firsthand in Yuma, where a ransomware attack disrupted operations and put hundreds of thousands of patients at risk,” according to Sen. Kelly. “We are giving rural hospitals the tools and workforce they need to strengthen their security and keep delivering care, especially as they navigate new digital reporting requirements.”
The bill was referred to the Senate Health, Education, Labor, and Pensions Committee.
News: FederalLegislation DataSecurity