Kelly, Hawley, Hassan Reintroduce Bipartisan Bill to Strengthen Rural Hospital Cybersecurity
Today, Senators Mark Kelly (D-AZ), Josh Hawley (R-MO), and Maggie Hassan (D-NH) reintroduced the Rural Hospital Cybersecurity Enhancement Act, which directs a comprehensive strategy to address the growing need for skilled cybersecurity professionals in rural hospitals. The strategy aims to improve cybersecurity preparedness and create a robust workforce to protect vulnerable critical infrastructure—rural hospitals— from cyber threats. This legislation unanimously passed out of the Senate Homeland Security and Governmental Affairs Committee last Congress.
“Rural hospitals are on the frontlines of care for so many Arizonans, but too often they’re underfunded and overexposed to cyber threats that can jeopardize patient safety. We saw this firsthand in Yuma, where a ransomware attack disrupted operations and put hundreds of thousands of patients at risk,” said Kelly. “We are giving rural hospitals the tools and workforce they need to strengthen their security and keep delivering care, especially as they navigate new digital reporting requirements.”
“Nearly half of the hospitals in my state are rural. I grew up in a town of 4,000 people – I have lived this firsthand,” said Hawley. “Congress must take action to shore up the ability of small-town hospitals to protect working Americans’ health records from debilitating cyberattacks.”
“Cyberattacks on hospitals can put at risk people’s medical information, and also sometimes shut the hospital down as it recovers, putting lifesaving care at risk,” said Hassan. “This bipartisan legislation is an important step toward ensuring that rural hospitals have the resources, tools, and training that they need to keep patients safe and protect hospitals from attacks from cybercriminals.”
Unlike larger urban hospitals, rural hospitals often have little to no full-time cybersecurity personnel and are particularly exposed to cyberattacks. Vulnerabilities in rural hospitals’ cybersecurity defenses can also be used as entry points to disrupt larger healthcare systems, potentially compromising the sensitive medical and personal data of hundreds of thousands of American patients at once.
The Rural Hospital Cybersecurity Enhancement Act would require the Department of Health and Human Services to:
- Develop a comprehensive rural hospital cybersecurity workforce development strategy that, at a minimum, considers public-private partnerships, development of curricula and training resources, and policy recommendations.
- Make available instructional materials for rural hospitals to train staff on fundamental cybersecurity measures.
- Report annually to congressional committees with updates regarding the strategy and any programs that have been implemented pursuant to the strategy.
Read the bill text here.
