Show-Me State Times

U.S. Senators Josh Hawley (R-Mo.), Maggie Hassan (D-N.H.), and Mark Kelly (D-Ariz.) have reintroduced the Rural Hospital Cybersecurity Enhancement Act. The legislation instructs the Department of Health and Human Services (HHS) to create a comprehensive strategy to address the shortage of skilled cybersecurity professionals in rural hospitals. The goal is to improve preparedness and build a workforce that can protect rural healthcare facilities from cyber threats. The bill previously passed unanimously out of a Senate committee during the last Congress.

Senator Hawley emphasized the importance of this initiative for his state, saying, “Nearly half of the hospitals in my state are rural. I grew up in a town of 4,000 people—I have lived this firsthand. Congress must take action to shore up the ability of small-town hospitals to protect working Americans’ health records from debilitating cyberattacks.”

Senator Hassan highlighted risks posed by cyberattacks: “Cyberattacks on hospitals can put at risk people’s medical information, and also sometimes shut the hospital down as it recovers, putting lifesaving care at risk. This bipartisan legislation is an important step toward ensuring that rural hospitals have the resources, tools, and training that they need to keep patients safe and protect hospitals from attacks from cybercriminals.”

Senator Kelly noted how these threats have affected his state: “Rural hospitals are on the frontlines of care for so many Arizonans, but too often they’re underfunded and overexposed to cyber threats that can jeopardize patient safety. We saw this firsthand in Yuma, where a ransomware attack disrupted operations and put hundreds of thousands of patients at risk,” said Senator Kelly. “We are giving rural hospitals the tools and workforce they need to strengthen their security and keep delivering care, especially as they navigate new digital reporting requirements.”

Rural hospitals generally lack dedicated cybersecurity staff compared to urban counterparts, making them more vulnerable to attacks. Weaknesses in their defenses may also serve as access points into larger healthcare systems, potentially exposing sensitive data for large numbers of patients.

The proposed act would require HHS to develop a workforce development strategy focusing on public-private partnerships, curriculum creation, training resources, and policy recommendations; make instructional materials available for hospital staff training; and report annually to congressional committees about progress on these efforts.

A full text version of the bill is available online.