Health Law Daily Wrap Up, SENATE NEWS—Bipartisan Bill to Boost Rural Hospitals’ Cyber Defenses Clears Senate Committee, (Jan 21, 2026)
Legislation that would require the Department of Health and Human Services to expand rural hospitals’ access to cybersecurity expertise yesterday cleared the Senate Health, Education, Labor, and Pensions Committee by a vote of 22-0.
The committee approved an amended version of the Rural Hospital Cybersecurity Enhancement Act (S.B. 2169, 119th Cong. (2025)), which was introduced by Sen. Josh Hawley (R., Mo.). Its co-sponsors include Sens. Maggie Hassan (D., N.H.), Mark Kelly (D., Ariz.), Jon Ossoff (D., Ga.), Susan Collins (R., Maine), and Raphael Warnock (D., Ga.).
The bill would require HHS “to develop and transmit to appropriate committees of Congress a rural hospital cybersecurity workforce development strategy within one year,” according to a fact sheet released by the committee.
The strategy would have to “consider a host of components including, but not limited to, rural-hospital partnerships to develop, promote, and expand the rural hospital cybersecurity workforce; the development of a cybersecurity curriculum and teaching resources; and the identification of cybersecurity workforce challenges that are specific to rural hospitals and common practices to mitigate those challenges,” the fact sheet says.
In developing the strategy, HHS would have to work with the Cybersecurity and Infrastructure Security Agency and other federal agencies and “consult with not fewer than 2 representatives of rural health care providers from each geographic division in the United States,” according to the bill.
The bill defines “rural hospital” using definitions from the Social Security Act and also specifies that the definition would include health care facilities “located in a rural census tract of a metropolitan statistical area,” “critical access” hospitals, “sole community” hospitals, “low-volume” hospitals, and similar facilities.
“Cyber attacks on the health care sector not only put patients’ sensitive health data at risk but can delay life-saving care,” Sen. Bill Cassidy (R., La.), the committee’s chairman, said at yesterday’s markup.
He said he would soon attempt to advance another health-related cybersecurity bill, the Health Care Cybersecurity and Resiliency Act (S 3315), which would add new cybersecurity requirements to Health Insurance Portability and Accountability Act (HIPAA) rules and provide cybersecurity grants to health care providers (CPR, Dec. 4, 2025).
IndustryNews: NewsStory ComplianceNews SenateNews HITNews RuralNews