Congress mandates rural hospital cybersecurity training—without spending a dime
S. 2169 — Rural Hospital Cybersecurity Enhancement Act · Filed by Josh Hawley (R-MO) · 6 cosponsors · Introduced Jun 25, 2025 · Reported out
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the Secretary of Health and Human Services to develop a comprehensive strategy within one year to address cybersecurity workforce shortages in rural hospitals. The strategy must include partnerships with educational institutions, curriculum development for community colleges and vocational schools, and identification of rural hospital cybersecurity challenges. The bill also requires HHS to publish free instructional materials for rural hospital staff and provide annual briefings to Congress on progress, but explicitly prohibits any new federal funding for these activities.
Why we flagged it
The bill's core mechanism is a planning and coordination mandate—requiring HHS to develop a strategy and publish educational materials—rather than direct funding or regulatory change. It is fundamentally a workforce development and public health infrastructure measure.
What the text implies
- The 'no additional funds' clause means implementation depends entirely on HHS reallocation of existing budgets, potentially crowding out other health IT or rural health initiatives unless Congress appropriates separately.
- Annual briefing requirement creates ongoing congressional oversight and accountability mechanism, but effectiveness depends on whether HHS actually establishes programs or merely reports on the strategy itself.
The full analysis lists 4 implications of this text.
Who stands to gain
Educational institutions (community colleges, vocational schools); Cybersecurity training and curriculum vendors; Rural hospitals (indirect benefit through workforce development)