Rural Hospital Cybersecurity Enhancement Act

SUMMARY

Rural Hospital Cybersecurity Enhancement Act

This bill requires the Department of Health and Human Services (HHS) to create a workforce development strategy to address the need for cybersecurity professionals in rural hospitals.

Among other topics, the strategy must consider (1) partnerships between rural hospitals, hospitals that are not rural hospitals, educational institutions, and private nonprofit or for-profit entities; and (2) the development of a cybersecurity curriculum for use in rural educational institutions. HHS must annually brief Congress on the strategy and any programs or initiatives established thereunder.

Additionally, HHS must disseminate free materials that rural hospitals may use to train staff about cybersecurity.

FULL TEXT

[Congressional Bills 119th Congress] [From the U.S. Government Publishing Office] [S. 2169 Reported in Senate (RS)]

Calendar No. 309 119th CONGRESS 2d Session S. 2169

To require the development of a comprehensive rural hospital cybersecurity workforce development strategy, and for other purposes.

IN THE SENATE OF THE UNITED STATES

June 25 (legislative day, June 24), 2025

Mr. Hawley (for himself, Ms. Hassan, Mr. Kelly, Mr. Ossoff, Ms. Collins, and Mr. Warnock) introduced the following bill; which was read twice and referred to the Committee on Health, Education, Labor, and Pensions

January 28, 2026

Reported by Mr. Cassidy, with an amendment [Strike out all after the enacting clause and insert the part printed in italic]

A BILL

To require the development of a comprehensive rural hospital cybersecurity workforce development strategy, and for other purposes.

Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled, <DELETED>SECTION 1. SHORT TITLE.</DELETED>

<DELETED> This Act may be cited as the ``Rural Hospital Cybersecurity Enhancement Act''.</DELETED>

<DELETED>SEC. 2. DEFINITIONS.</DELETED>

<DELETED> In this Act:</DELETED>

<DELETED> (1) Agency.--The term ``agency'' has the meaning given the term in section 551 of title 5, United States

Code.</DELETED>

<DELETED> (2) Appropriate committees of congress.--The term

``appropriate committees of Congress'' means--</DELETED>

<DELETED> (A) the Committee on Health, Education, Labor, and Pensions of the Senate; and</DELETED>

<DELETED> (B) the Committee on Energy and Commerce of the House of Representatives.</DELETED>

<DELETED> (3) Geographic division.--The term ``geographic division'' means a geographic division that is among the 9 geographic divisions determined by the Bureau of the Census.</DELETED>

<DELETED> (4) Rural hospital.--The term ``rural hospital''

means a healthcare facility that--</DELETED>

<DELETED> (A) is located in a non-urbanized area, as determined by the Bureau of the Census; and</DELETED>

<DELETED> (B) provides inpatient and outpatient healthcare services, including primary care, emergency care, and diagnostic services.</DELETED>

<DELETED> (5) Secretary.--The term ``Secretary'' means the Secretary of Health and Human Services.</DELETED>

<DELETED>SEC. 3. RURAL HOSPITAL CYBERSECURITY WORKFORCE DEVELOPMENT STRATEGY.</DELETED>

<DELETED> (a) In General.--Not later than 1 year after the date of enactment of this Act, the Secretary shall develop and transmit to the appropriate committees of Congress a comprehensive rural hospital cybersecurity workforce development strategy to address the growing need for skilled cybersecurity professionals in rural hospitals.</DELETED>

<DELETED> (b) Consultation.--</DELETED>

<DELETED> (1) Agencies.--In carrying out subsection (a), the Secretary may consult with the Director of the Cybersecurity and Infrastructure Security Agency, the Secretary of Education, the Secretary of Labor, and any other appropriate head of an agency.</DELETED>

<DELETED> (2) Providers.--In carrying out subsection (a), the Secretary shall consult with not fewer than 2 representatives of rural healthcare providers from each geographic division in the United States.</DELETED>

<DELETED> (c) Considerations.--The rural hospital cybersecurity workforce development strategy developed under subsection (a) shall, at a minimum, consider the following components:</DELETED>

<DELETED> (1) Partnerships between rural hospitals, nonrural healthcare systems, educational institutions, private sector entities, and nonprofit organizations to develop, promote, and expand the rural hospital cybersecurity workforce, including through education and training programs tailored to the needs of rural hospitals.</DELETED>

<DELETED> (2) The development of a cybersecurity curriculum and teaching resources that focus on teaching technical skills and abilities related to cybersecurity in rural hospitals for use in community colleges, vocational schools, and other educational institutions located in rural areas.</DELETED>

<DELETED> (3) Identification of--</DELETED>

<DELETED> (A) cybersecurity workforce challenges that are specific to rural hospitals, as well as challenges that are relative to hospitals generally;

and</DELETED>

<DELETED> (B) common practices to mitigate both sets of challenges described in subparagraph (A).</DELETED>

<DELETED> (4) Recommendations for legislation, rulemaking, or guidance to implement the components of the rural hospital cybersecurity workforce development strategy.</DELETED>

<DELETED> (d) Annual Briefing.--Not later than 60 days after the date on which the first full fiscal year ends following the date on which the Secretary transmits the rural hospital cybersecurity workforce development strategy developed under subsection (a), and not later than 60 days after the date on which each fiscal year thereafter ends, the Secretary shall provide a briefing to the appropriate committees of Congress that includes, at a minimum, information relating to--</DELETED>

<DELETED> (1) updates to the rural hospital cybersecurity workforce development strategy, as appropriate;</DELETED>

<DELETED> (2) any programs or initiatives established pursuant to the rural hospital cybersecurity workforce development strategy, as well as the number of individuals trained or educated through such programs or initiatives;</DELETED>

<DELETED> (3) additional recommendations for legislation, rulemaking, or guidance to implement the components of the rural hospital cybersecurity workforce development strategy;

and</DELETED>

<DELETED> (4) the effectiveness of the rural hospital cybersecurity workforce development strategy in addressing the need for skilled cybersecurity professionals in rural hospitals.</DELETED>

<DELETED>SEC. 4. INSTRUCTIONAL MATERIALS FOR RURAL HOSPITALS.</DELETED>

<DELETED> (a) In General.--Not later than 1 year after the date of enactment of this Act, the Secretary shall make available instructional materials for rural hospitals that can be used to train staff on fundamental cybersecurity efforts.</DELETED>

<DELETED> (b) Duties.--In carrying out subsection (a), the Secretary shall--</DELETED>

<DELETED> (1) consult with appropriate heads of agencies, experts in cybersecurity education, and rural healthcare experts;</DELETED>

<DELETED> (2) identify existing cybersecurity instructional materials that can be adapted for use in rural hospitals and create new materials as needed; and</DELETED>

<DELETED> (3) conduct an awareness campaign to promote the materials available to rural hospitals developed under subsection (a).</DELETED>

<DELETED>SEC. 5. NO ADDITIONAL FUNDS.</DELETED>

<DELETED> No additional funds are authorized to be appropriated for the purpose of carrying out this Act.</DELETED>

This Act may be cited as the ``Rural Hospital Cybersecurity Enhancement Act''.

In this Act:

``appropriate committees of Congress'' means--

(A) the Committee on Health, Education, Labor, and Pensions of the Senate;

(B) the Committee on Finance of the Senate;

(C) the Committee on Energy and Commerce of the House of Representatives; and

(D) the Committee on Ways and Means of the House of Representatives.

means a geographic division that is among the 9 geographic divisions determined by the Bureau of the Census.

(A) a subsection (d) hospital (as defined in

section 1886(d)(1)(B) of the Social Security Act (42

U.S.C. 1395ww(d)(1)(B))) that--

(i) is located in a rural area (as defined in paragraph (2)(D) of section 1886(d) of such

Act);

(ii) is treated as being located in a rural area pursuant to paragraph (8)(E) of such

section 1886(d); or

(iii) is located in a rural census tract of a metropolitan statistical area (as determined under the most recent modification of the Goldsmith Modification, originally published in the Federal Register on February 27, 1992 (57

Fed. Reg. 6725));

(B) a critical access hospital (as defined in

section 1861(mm)(1) of such Act (42 U.S.C.

1395x(mm)(1)));

(C) a sole community hospital (as defined in

section 1886(d)(5)(D)(iii) of such Act (42 U.S.C.

1395ww(d)(5)(D)(iii)));

(D) a medicare-dependent, small rural hospital (as defined in section 1886(d)(5)(G)(iv) of such Act (42

U.S.C. 1395(ww)(d)(5)(G)(iv)));

(E) a low-volume hospital (as defined in section

1886(d)(12)(C) of such Act (42 U.S.C.

1395ww(d)(12)(C))); or

(F) a rural emergency hospital (as defined in

section 1861(kkk)(2) of such Act (42 U.S.C.

1395x(kkk)(2))).

(a) In General.--Not later than 1 year after the date of enactment of this Act, the Secretary shall develop and transmit to the appropriate committees of Congress a comprehensive rural hospital cybersecurity workforce development strategy to address the growing need for skilled cybersecurity professionals in rural hospitals.

(b) Consultation.--

(c) Considerations.--The rural hospital cybersecurity workforce development strategy developed under subsection (a) shall, at a minimum, consider the following components:

(A) cybersecurity workforce challenges of rural hospitals; and

(B) common practices to mitigate the challenges described in subparagraph (A).

(d) Annual Briefing.--Not later than 60 days after the date on which the first full fiscal year ends following the date on which the Secretary transmits the rural hospital cybersecurity workforce development strategy developed under subsection (a), and not later than

60 days after the date on which each fiscal year thereafter ends, the Secretary shall provide a briefing to the appropriate committees of Congress that includes, at a minimum, information relating to--

(a) In General.--Not later than 1 year after the date of enactment of this Act, the Secretary shall publish on the website of the Department of Health and Human Services and make available through other appropriate means, at no cost, instructional materials for rural hospitals that can be used to train staff on fundamental cybersecurity efforts.

(b) Duties.--In carrying out subsection (a), the Secretary shall--

No additional funds are authorized to be appropriated for the purpose of carrying out this Act. Calendar No. 309

119th CONGRESS

2d Session

S. 2169

A BILL

To require the development of a comprehensive rural hospital cybersecurity workforce development strategy, and for other purposes.

January 28, 2026

Reported with an amendment