Thompson Introduces Legislation to Strengthen Rural Hospitals' Cybersecurity Infrastructure

WASHINGTON, D.C. – Last week, United States Representatives Glenn “GT” Thompson (R-PA), Kim Schrier (D-WA), Erin Houchin (R-IN), Jill Tokuda (D-HI), Jefferson Shreve (R-IN), and Jennifer McClellan (D-VA) introduced the bipartisan Rural Hospital Cybersecurity Enhancement Act to strengthen rural hospitals’ protections against cyber threats.

"In our complex world, it is imperative that we safeguard sensitive personal information and medical records from cybercriminals," Rep. Thompson said. "The Rural Hospital Cybersecurity Enhancement Act aims to protect patient information by helping develop, promote, and expand the rural hospital cybersecurity workforce, particularly through education and training programs tailored to the needs of rural hospitals, such as those in Pennsylvania."

“As a doctor and a patient, I know we must protect hospitals from cyberattacks," Rep. Schrier, M.D. said. “Rural hospitals in particular often lack the funding and workforce necessary to prevent cyberattacks and some in Washington have already been impacted. This bill will give rural hospitals the tools they need to keep patients safe, protect personal data, and secure medical systems."   

"Rural hospitals are often operating with limited staff and resources, yet they're expected to defend against increasingly sophisticated cyberattacks," Rep. Houchin said. "When a rural hospital is forced offline, patient care is put at risk. This bipartisan bill is a practical step toward giving rural providers the workforce, training, and tools they need to strengthen their cybersecurity and continue serving their communities."

"For rural hospitals, a cyberattack isn't just a disruption to technology, it can become a disruption to care,” Rep. Tokuda said. “This legislation helps ensure rural providers can continue delivering lifesaving care by having the resources, training, and workforce support they need to protect patient data, respond to threats, and continue serving their communities." 

"Rural hospitals in Indiana's Sixth District are often the only option for Hoosier families who need care close to home,” Rep. Shreve said. “These hospitals don’t have the resources to hire a cybersecurity team, but they still need to keep their patients’ private information secure. This bill gives them the training and tools they need to do that. I'm glad to join Rep. Houchin on this important legislation."

“In our rapidly changing digital age, cybersecurity threats continue to grow. Rural hospitals and health clinics often lack the resources and personnel to defend against these threats,” Rep. McClellan said. “The Rural Hospital Cybersecurity Enhancement Act develops a comprehensive workforce training program to protect our rural communities from attacks that could exploit vulnerabilities in our health care system and undermine access to care. I am pleased to work on a bipartisan basis with Congresswoman Houchin to bolster our security measures to help maintain a strong care network.”  

The Rural Hospital Cybersecurity Enhancement Act is supported by the American Hospital Association, Blue Cross Blue Shield Association, National Rural Health Association, American Academy of Family Physicians, and the Alliance for Quality Medical Device Servicing.

The Rural Hospital Cybersecurity Enhancement Act requires the Department of Health and Human Services (HHS) to:

• Develop a comprehensive rural hospital cybersecurity workforce development strategy that considers public-private partnerships, cybersecurity curricula, workforce training, and policy recommendations;
• Make instructional materials available to help rural hospitals train staff on fundamental cybersecurity practices; and
• Provide annual updates to Congress on the implementation of the strategy and any related workforce development initiatives.

 
Cyberattacks against hospitals have become more frequent and more sophisticated, placing patient care, medical records, and critical healthcare infrastructure at risk. Rural hospitals are particularly vulnerable because they often lack the resources to recruit and retain dedicated cybersecurity professionals.
 
The Senate companion legislation, introduced by Senators Josh Hawley (R-MO), Maggie Hassan (D-NH), and Mark Kelly (D-AZ), has advanced out of the Senate Committee on Health, Education, Labor, and Pensions twice.

Read the full bill text here.