H.R. 9908: Rural Hospital Cybersecurity Enhancement Act

This bill would direct the Secretary of Health and Human Services to create a nationwide plan to help rural hospitals build cybersecurity talent and training.

What the bill covers

Within 1 year of enactment, HHS would have to develop and send Congress a comprehensive rural hospital cybersecurity workforce development strategy. The goal is to address the shortage of cybersecurity workers in rural hospitals.

To build that strategy, HHS would need to consult with:

• the Cybersecurity and Infrastructure Security Agency (CISA),
• the Secretary of Education,
• the Secretary of Labor,
• the National Cyber Director, and
• other relevant federal officials.

HHS would also need to talk with at least two rural health care provider representatives from each of the country’s nine geographic divisions.

Who counts as a rural hospital

The bill defines “rural hospital” broadly. It includes several types of hospitals serving rural areas, such as:

• hospitals located in rural areas or treated as rural under Medicare rules,
• hospitals in rural census tracts of metropolitan areas,
• critical access hospitals,
• sole community hospitals,
• medicare-dependent small rural hospitals,
• low-volume hospitals, and
• rural emergency hospitals.

What the strategy would need to consider

The required strategy would need to address several topics, including:

• partnerships between rural hospitals, other hospitals, schools, and private organizations to expand the rural cybersecurity workforce;
• cybersecurity curricula and teaching materials for community colleges, vocational schools, and other rural educational institutions;
• the main cybersecurity staffing challenges rural hospitals face; and
• common ways to reduce or manage those challenges.

Ongoing reporting to Congress

After the strategy is submitted, HHS would have to brief Congress each year, starting 60 days after the first full fiscal year ends. Those briefings would include:

• any updates to the strategy,
• programs or initiatives created under it and how many people were trained, and
• how effective the strategy has been in meeting rural hospitals’ cybersecurity staffing needs.

Training materials for rural hospitals

Within 1 year of enactment, HHS would also have to publish free instructional materials for rural hospitals on basic cybersecurity practices. These materials would be made available on the HHS website and through other appropriate channels.

In doing this, HHS would need to:

• consult with federal agencies, cybersecurity education experts, and rural health experts;
• identify existing materials that can be adapted for rural hospitals; and
• develop new materials if needed.

HHS would also have to run an awareness campaign so rural hospitals know the materials are available.

Funding

The bill does not authorize any additional funding to carry out these requirements.

Relevant Companies

None found