S. 2169 — Rural Hospital Cybersecurity Enhancement Act

This section defines the following terms for purposes of the Act: (1) “agency,” as having the meaning given in 5 U.S.C. §551; (2) “appropriate committees of Congress,” as the Senate Committee on Health, Education, Labor, and Pensions and the House Committee on Energy and Commerce; (3) “geographic division,” as one of the nine geographic divisions determined by the Bureau of the Census; (4) “rural hospital,” as a healthcare facility located in a non-urbanized area, as determined by the Bureau of the Census, that provides inpatient and outpatient healthcare services, including primary care, emergency care, and diagnostic services; and (5) “Secretary,” as the Secretary of Health and Human Services.

This section directs the Secretary of Health and Human Services to develop and transmit to the appropriate congressional committees, not later than one year after enactment, a comprehensive rural hospital cybersecurity workforce development strategy. The strategy must consider, at a minimum, (1) partnerships among rural hospitals, non-rural healthcare systems, educational institutions, private sector entities, and nonprofits to expand the rural hospital cybersecurity workforce through tailored education and training; (2) development of a cybersecurity curriculum and resources for community colleges, vocational schools, and other rural educational institutions; (3) identification of cybersecurity workforce challenges specific to rural hospitals (and relative to hospitals generally) along with mitigation practices; and (4) recommendations for legislation, rulemaking, or guidance. The section further requires the Secretary to consult with specified agency heads and at least two representatives of rural healthcare providers from each U.S. geographic division and to provide annual briefings to the committees, beginning 60 days after the first full fiscal year following strategy transmittal, on strategy updates, training programs and participant numbers, additional recommendations, and overall effectiveness.

This section directs the Secretary, not later than one year after enactment, to make available instructional materials for rural hospitals to train staff on fundamental cybersecurity efforts. In doing so, the Secretary must (1) consult with appropriate agency heads, cybersecurity education experts, and rural healthcare experts; (2) identify existing cybersecurity instructional materials that can be adapted for rural hospitals and create new materials as needed; and (3) conduct an awareness campaign to promote the materials.