Rural Hospital Cybersecurity Enhancement Act

The bill would direct the HHS Secretary to develop, within one year, a comprehensive strategy for building a cybersecurity workforce in rural hospitals. The strategy must consider partnerships among rural hospitals, non-rural hospitals, educational institutions, and private entities; the development of cybersecurity curricula for community colleges and vocational schools in rural areas; and identification of cybersecurity workforce challenges specific to rural hospitals with recommended practices to address them. HHS must consult with the Cybersecurity and Infrastructure Security Agency, the Departments of Education and Labor, the National Cyber Director, and at least two rural health care provider representatives from each of the nine U.S. Census geographic divisions.

Separately, within the same one-year window, HHS would be required to publish free instructional materials on its website for rural hospitals to use in training staff on basic cybersecurity. HHS would also conduct an awareness campaign to promote those materials. After the strategy is transmitted, HHS must provide annual briefings to Congress. Notably, the bill explicitly authorizes no additional funds for implementation.

Rural hospitals as defined under Medicare law — including critical access hospitals, sole community hospitals, Medicare-dependent small rural hospitals, low-volume hospitals, and rural emergency hospitals — and their clinical and administrative staff who would be trained using the new materials. Community colleges, vocational schools, and other rural educational institutions could also be affected if they adopt the cybersecurity curricula the strategy envisions.

Rural hospitals typically have limited IT staff and budgets, making them more vulnerable to cyberattacks that can disrupt patient care. If enacted, this bill would push the federal government to map the cybersecurity workforce gap at those facilities and produce free, ready-to-use training materials — but because no new funding is authorized, the impact depends entirely on resources HHS can redirect within existing appropriations.

HHS would lead all activity: developing the workforce strategy through interagency consultation and input from at least 18 rural provider representatives (two per Census division), then transmitting the strategy to the Senate HELP, Senate Finance, House Energy and Commerce, and House Ways and Means committees. Annual briefings must follow within 60 days after each fiscal year end, covering strategy updates, program outcomes, and training numbers. For instructional materials, HHS would survey existing cybersecurity resources, adapt or create new ones, post them on the HHS website at no charge, and run an awareness campaign — all within the same one-year deadline.