Rural hospital cybersecurity is a critical health issue

Rural hospitals play a vital role in providing essential health services to nearly 14 percent of the U.S. population — or roughly 46 million Americans. These hospitals are often a lifeline for rural communities, offering critical health care services and serving as significant economic drivers. However, the cybersecurity landscape for these institutions is fraught with challenges that threaten their viability and the health outcomes of rural residents.

The importance of rural hospitals

Rural hospitals are indispensable to the communities they serve. They provide essential health care services, often being the only accessible provider for miles. Rural residents typically have to travel more than twice as far as urban residents to reach the nearest hospital, making these institutions crucial for timely medical care. Beyond health care, rural hospitals are often the largest employers in their communities, supporting local economies by attracting businesses and investments. According to the American Hospital Association, rural hospitals supported one in every 12 rural jobs in the U.S. in 2020, generating around $220 billion annually in economic activity.

The financial and resourcing strain on rural hospitals

Despite their importance, rural hospitals face significant financial and operational challenges. From 2010 to 2017, rural hospitals closed at a rate of about one per month, and the trend has continued with 136 closures in 2020 and 2021 alone. As of 2022, more than 429 rural hospitals are at high financial risk. These closures force rural residents to travel farther for medical services, which is associated with higher mortality rates for time-sensitive conditions like heart attacks and strokes. The ripple effect of hospital closures also burdens remaining providers, exacerbating the disparity in health outcomes for rural Americans. When a rural hospital closes, it leads to a 14 percent reduction in employment in the affected area, which can exacerbate pre-existing economic challenges.

Moreover, rural hospitals often operate with low margins due to lower patient volumes and high fixed costs. They also face challenges in recruiting and retaining health care professionals, including IT specialists and revenue management teams. Limited budgets make it difficult for these hospitals to implement key cybersecurity measures, leaving them vulnerable to cyberattacks.

Cybersecurity risks increasing financial strain

Cybersecurity threats are a significant concern for rural hospitals. Aging IT systems and limited resources make them prime targets for cybercriminals. Ransomware attacks in particular pose a major threat, as hospitals often pay ransoms to avoid patient care disruptions. The rise of the ransomware-as-a-service ecosystem has industrialized cybercrime, making it easier for malicious actors to use ready-made tools for their attacks. Financially motivated cybercrime groups tracked by Microsoft as Vanilla Tempest, Sangria Tempest, and Cadenza Tempest employ tactics like double extortion, demanding ransom for unlocking systems and preventing the release of stolen data.

According to an FBI report, the health care sector reported more ransomware attacks in 2023 than any of the other U.S. 16 critical infrastructure areas. These types of incidents surged by nearly 130 percent that year, according to the Office of the Director of National Intelligence, on an already high baseline following COVID-19.

The role of technology companies

Technology companies can play a crucial role in addressing the cybersecurity challenges faced by rural hospitals. By providing advanced cybersecurity solutions and support, tech companies can help mitigate immediate cyber risks and help address broader systemic challenges. Collaboration between health care providers, technology companies, and government agencies is essential to protect rural hospitals from cyber threats and ensure they can continue to serve their communities effectively.

Looking forward

Rural hospitals are critical to the health and economic stability of rural communities. However, they face significant cybersecurity threats that jeopardize their ability to provide essential services — and their financial solvency altogether. It is imperative that we act together to protect these institutions from cyberattacks and ensure they can continue their vital missions. By addressing the cybersecurity landscape of rural hospitals, we can safeguard the health and well-being of millions of Americans and support the economic vitality of rural communities.

Microsoft’s Cybersecurity for Rural Hospitals Program is an initiative designed to help protect access to healthcare for the 46 million people living in rural America. Funded through a philanthropic investment, the program now has more than 550 rural hospitals, nearly one-third of all US rural hospitals, participating to receive free cybersecurity assessments, cybersecurity training, Microsoft security product discounts, and AI solutions designed to promote hospital resiliency.  Learn more about eligibility for the Cybersecurity for Rural Hospitals Program and register to participate.

NRHA adapted the above piece from Microsoft, a trusted NRHA partner, for publication within the Association’s Rural Health Voices blog.

About the author: Erin Burchfield is a senior director of technology for social impact at Microsoft. Erin's team at Microsoft is focused on promoting democratic resilience worldwide, including efforts promote a secure and resilient rural health ecosystem.