TallyHQ
github
S 2169 · 119th Congress · Science, Technology, Communications

Rural Hospital Cybersecurity Enhancement Act

Introduced June 25, 2025 Latest action January 28, 2026 6 cosponsors

Sponsor

Latest action

Placed on Senate Legislative Calendar under General Orders. Calendar No. 309.

Action timeline

Every recorded action on this bill, newest first. Stage badges color-code the legislative path.

Jan 28, 2026
committee Committee on Health, Education, Labor, and Pensions. Reported by Senator Cassidy with an amendment in the nature of a substitute. Without written report.
Health, Education, Labor, and Pensions Committee
Jan 28, 2026
other Placed on Senate Legislative Calendar under General Orders. Calendar No. 309.
Jan 15, 2026
committee Committee on Health, Education, Labor, and Pensions. Ordered to be reported with an amendment in the nature of a substitute favorably.
Health, Education, Labor, and Pensions Committee
Jun 25, 2025
introduced Introduced in Senate
Jun 25, 2025
introduced Read twice and referred to the Committee on Health, Education, Labor, and Pensions.
Health, Education, Labor, and Pensions Committee

Text versions

Each stage of the bill — official text published by GPO. Click any format to read on congress.gov / govinfo.

Jan 28, 2026 Reported to Senate
XML
Jun 25, 2025 Introduced in Senate
XML

CRS summaries

Plain-English summaries written by the Congressional Research Service — neutral, nonpartisan staff who summarize bills as they advance through stages. The authoritative description of what each version of the bill does.

via Congressional Research Service · published through congress.gov

Changelog
ⓘ

How a bill moves through Congress. Each stage produces a new official text. The diff between them shows what changed at that step.

  1. ih / is — Introduced in House / Senate. First filed version.
  2. rfh / rfs — Referred to a committee for review.
  3. rh / rs — Reported back by the committee to the floor (often with amendments — this is where most language changes happen).
  4. pcs / pch — Placed on Calendar for floor consideration.
  5. eh / es — Engrossed. Passed by the originating chamber. Text is now what was actually voted on.
  6. rdh / rds — Received by the other chamber.
  7. eah / eas — Engrossed Amendment. The other chamber passed an amended version.
  8. ath / ats — Agreed to. Both chambers settled on the same text.
  9. enr — Enrolled. Final reconciled text, sent to the President.
  10. pl — Public Law. Signed by the President. It's now law.
  11. pp — Public Print. Official printing post-enactment.

Most bills die before eh/es. Going from pcs → enr is the full path through both chambers.

Line-level diff between text versions of this bill — what actually changed at each legislative stage.

→
+216 −46 66 unchanged
--- Introduced (Senate)
+++ Reported (Senate)
@@ -1,10 +1,11 @@
[From the U.S. Government Publishing Office]
-[S. 2169 Introduced in Senate (IS)]
+[S. 2169 Reported in Senate (RS)]
<DOC>
+Calendar No. 309
119th CONGRESS
-1st Session
+2d Session
S. 2169
To require the development of a comprehensive rural hospital
@@ -16,9 +17,16 @@
June 25 (legislative day, June 24), 2025
-Mr. Hawley (for himself, Ms. Hassan, and Mr. Kelly) introduced the
-following bill; which was read twice and referred to the Committee on
-Health, Education, Labor, and Pensions
+Mr. Hawley (for himself, Ms. Hassan, Mr. Kelly, Mr. Ossoff, Ms.
+Collins, and Mr. Warnock) introduced the following bill; which was read
+twice and referred to the Committee on Health, Education, Labor, and
+Pensions
+
+January 28, 2026
+
+Reported by Mr. Cassidy, with an amendment
+[Strike out all after the enacting clause and insert the part printed
+in italic]
_______________________________________________________________________
@@ -29,6 +37,127 @@
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
+
+<DELETED>SECTION 1. SHORT TITLE.</DELETED>
+
+<DELETED> This Act may be cited as the ``Rural Hospital
+Cybersecurity Enhancement Act''.</DELETED>
+
+<DELETED>SEC. 2. DEFINITIONS.</DELETED>
+
+<DELETED> In this Act:</DELETED>
+<DELETED> (1) Agency.--The term ``agency'' has the meaning
+given the term in section 551 of title 5, United States
+Code.</DELETED>
+<DELETED> (2) Appropriate committees of congress.--The term
+``appropriate committees of Congress'' means--</DELETED>
+<DELETED> (A) the Committee on Health, Education,
+Labor, and Pensions of the Senate; and</DELETED>
+<DELETED> (B) the Committee on Energy and Commerce
+of the House of Representatives.</DELETED>
+<DELETED> (3) Geographic division.--The term ``geographic
+division'' means a geographic division that is among the 9
+geographic divisions determined by the Bureau of the
+Census.</DELETED>
+<DELETED> (4) Rural hospital.--The term ``rural hospital''
+means a healthcare facility that--</DELETED>
+<DELETED> (A) is located in a non-urbanized area, as
+determined by the Bureau of the Census; and</DELETED>
+<DELETED> (B) provides inpatient and outpatient
+healthcare services, including primary care, emergency
+care, and diagnostic services.</DELETED>
+<DELETED> (5) Secretary.--The term ``Secretary'' means the
+Secretary of Health and Human Services.</DELETED>
+
+<DELETED>SEC. 3. RURAL HOSPITAL CYBERSECURITY WORKFORCE DEVELOPMENT
+STRATEGY.</DELETED>
+
+<DELETED> (a) In General.--Not later than 1 year after the date of
+enactment of this Act, the Secretary shall develop and transmit to the
+appropriate committees of Congress a comprehensive rural hospital
+cybersecurity workforce development strategy to address the growing
+need for skilled cybersecurity professionals in rural
+hospitals.</DELETED>
+<DELETED> (b) Consultation.--</DELETED>
+<DELETED> (1) Agencies.--In carrying out subsection (a), the
+Secretary may consult with the Director of the Cybersecurity
+and Infrastructure Security Agency, the Secretary of Education,
+the Secretary of Labor, and any other appropriate head of an
+agency.</DELETED>
+<DELETED> (2) Providers.--In carrying out subsection (a),
+the Secretary shall consult with not fewer than 2
+representatives of rural healthcare providers from each
+geographic division in the United States.</DELETED>
+<DELETED> (c) Considerations.--The rural hospital cybersecurity
+workforce development strategy developed under subsection (a) shall, at
+a minimum, consider the following components:</DELETED>
+<DELETED> (1) Partnerships between rural hospitals, non-
+rural healthcare systems, educational institutions, private
+sector entities, and nonprofit organizations to develop,
+promote, and expand the rural hospital cybersecurity workforce,
+including through education and training programs tailored to
+the needs of rural hospitals.</DELETED>
+<DELETED> (2) The development of a cybersecurity curriculum
+and teaching resources that focus on teaching technical skills
+and abilities related to cybersecurity in rural hospitals for
+use in community colleges, vocational schools, and other
+educational institutions located in rural areas.</DELETED>
+<DELETED> (3) Identification of--</DELETED>
+<DELETED> (A) cybersecurity workforce challenges
+that are specific to rural hospitals, as well as
+challenges that are relative to hospitals generally;
+and</DELETED>
+<DELETED> (B) common practices to mitigate both sets
+of challenges described in subparagraph (A).</DELETED>
+<DELETED> (4) Recommendations for legislation, rulemaking,
+or guidance to implement the components of the rural hospital
+cybersecurity workforce development strategy.</DELETED>
+<DELETED> (d) Annual Briefing.--Not later than 60 days after the
+date on which the first full fiscal year ends following the date on
+which the Secretary transmits the rural hospital cybersecurity
+workforce development strategy developed under subsection (a), and not
+later than 60 days after the date on which each fiscal year thereafter
+ends, the Secretary shall provide a briefing to the appropriate
+committees of Congress that includes, at a minimum, information
+relating to--</DELETED>
+<DELETED> (1) updates to the rural hospital cybersecurity
+workforce development strategy, as appropriate;</DELETED>
+<DELETED> (2) any programs or initiatives established
+pursuant to the rural hospital cybersecurity workforce
+development strategy, as well as the number of individuals
+trained or educated through such programs or
+initiatives;</DELETED>
+<DELETED> (3) additional recommendations for legislation,
+rulemaking, or guidance to implement the components of the
+rural hospital cybersecurity workforce development strategy;
+and</DELETED>
+<DELETED> (4) the effectiveness of the rural hospital
+cybersecurity workforce development strategy in addressing the
+need for skilled cybersecurity professionals in rural
+hospitals.</DELETED>
+
+<DELETED>SEC. 4. INSTRUCTIONAL MATERIALS FOR RURAL HOSPITALS.</DELETED>
+
+<DELETED> (a) In General.--Not later than 1 year after the date of
+enactment of this Act, the Secretary shall make available instructional
+materials for rural hospitals that can be used to train staff on
+fundamental cybersecurity efforts.</DELETED>
+<DELETED> (b) Duties.--In carrying out subsection (a), the Secretary
+shall--</DELETED>
+<DELETED> (1) consult with appropriate heads of agencies,
+experts in cybersecurity education, and rural healthcare
+experts;</DELETED>
+<DELETED> (2) identify existing cybersecurity instructional
+materials that can be adapted for use in rural hospitals and
+create new materials as needed; and</DELETED>
+<DELETED> (3) conduct an awareness campaign to promote the
+materials available to rural hospitals developed under
+subsection (a).</DELETED>
+
+<DELETED>SEC. 5. NO ADDITIONAL FUNDS.</DELETED>
+
+<DELETED> No additional funds are authorized to be appropriated for
+the purpose of carrying out this Act.</DELETED>
SECTION 1. SHORT TITLE.
@@ -43,19 +172,46 @@
(2) Appropriate committees of congress.--The term
``appropriate committees of Congress'' means--
(A) the Committee on Health, Education, Labor, and
-Pensions of the Senate; and
-(B) the Committee on Energy and Commerce of the
-House of Representatives.
+Pensions of the Senate;
+(B) the Committee on Finance of the Senate;
+(C) the Committee on Energy and Commerce of the
+House of Representatives; and
+(D) the Committee on Ways and Means of the House of
+Representatives.
(3) Geographic division.--The term ``geographic division''
means a geographic division that is among the 9 geographic
divisions determined by the Bureau of the Census.
-(4) Rural hospital.--The term ``rural hospital'' means a
-healthcare facility that--
-(A) is located in a non-urbanized area, as
-determined by the Bureau of the Census; and
-(B) provides inpatient and outpatient healthcare
-services, including primary care, emergency care, and
-diagnostic services.
+(4) Rural hospital.--The term ``rural hospital'' means--
+(A) a subsection (d) hospital (as defined in
+section 1886(d)(1)(B) of the Social Security Act (42
+U.S.C. 1395ww(d)(1)(B))) that--
+(i) is located in a rural area (as defined
+in paragraph (2)(D) of section 1886(d) of such
+Act);
+(ii) is treated as being located in a rural
+area pursuant to paragraph (8)(E) of such
+section 1886(d); or
+(iii) is located in a rural census tract of
+a metropolitan statistical area (as determined
+under the most recent modification of the
+Goldsmith Modification, originally published in
+the Federal Register on February 27, 1992 (57
+Fed. Reg. 6725));
+(B) a critical access hospital (as defined in
+section 1861(mm)(1) of such Act (42 U.S.C.
+1395x(mm)(1)));
+(C) a sole community hospital (as defined in
+section 1886(d)(5)(D)(iii) of such Act (42 U.S.C.
+1395ww(d)(5)(D)(iii)));
+(D) a medicare-dependent, small rural hospital (as
+defined in section 1886(d)(5)(G)(iv) of such Act (42
+U.S.C. 1395(ww)(d)(5)(G)(iv)));
+(E) a low-volume hospital (as defined in section
+1886(d)(12)(C) of such Act (42 U.S.C.
+1395ww(d)(12)(C))); or
+(F) a rural emergency hospital (as defined in
+section 1861(kkk)(2) of such Act (42 U.S.C.
+1395x(kkk)(2))).
(5) Secretary.--The term ``Secretary'' means the Secretary
of Health and Human Services.
@@ -68,37 +224,33 @@
need for skilled cybersecurity professionals in rural hospitals.
(b) Consultation.--
(1) Agencies.--In carrying out subsection (a), the
-Secretary may consult with the Director of the Cybersecurity
+Secretary shall consult with the Director of the Cybersecurity
and Infrastructure Security Agency, the Secretary of Education,
-the Secretary of Labor, and any other appropriate head of an
-agency.
+the Secretary of Labor, the National Cyber Director, and any
+other appropriate head of an agency.
(2) Providers.--In carrying out subsection (a), the
Secretary shall consult with not fewer than 2 representatives
-of rural healthcare providers from each geographic division in
+of rural health care providers from each geographic division in
the United States.
(c) Considerations.--The rural hospital cybersecurity workforce
development strategy developed under subsection (a) shall, at a
minimum, consider the following components:
-(1) Partnerships between rural hospitals, non-rural
-healthcare systems, educational institutions, private sector
-entities, and nonprofit organizations to develop, promote, and
-expand the rural hospital cybersecurity workforce, including
-through education and training programs tailored to the needs
-of rural hospitals.
+(1) Partnerships between rural hospitals, hospitals that
+are not rural hospitals as defined in section 2(4), educational
+institutions, and private nonprofit or for-profit entities, to
+develop, promote, and expand the rural hospital cybersecurity
+workforce, including through education and training programs
+tailored to the needs of rural hospitals.
(2) The development of a cybersecurity curriculum and
teaching resources that focus on teaching technical skills and
abilities related to cybersecurity in rural hospitals for use
in community colleges, vocational schools, and other
educational institutions located in rural areas.
(3) Identification of--
-(A) cybersecurity workforce challenges that are
-specific to rural hospitals, as well as challenges that
-are relative to hospitals generally; and
-(B) common practices to mitigate both sets of
-challenges described in subparagraph (A).
-(4) Recommendations for legislation, rulemaking, or
-guidance to implement the components of the rural hospital
-cybersecurity workforce development strategy.
+(A) cybersecurity workforce challenges of rural
+hospitals; and
+(B) common practices to mitigate the challenges
+described in subparagraph (A).
(d) Annual Briefing.--Not later than 60 days after the date on
which the first full fiscal year ends following the date on which the
Secretary transmits the rural hospital cybersecurity workforce
@@ -109,27 +261,26 @@
(1) updates to the rural hospital cybersecurity workforce
development strategy, as appropriate;
(2) any programs or initiatives established pursuant to the
-rural hospital cybersecurity workforce development strategy, as
-well as the number of individuals trained or educated through
-such programs or initiatives;
-(3) additional recommendations for legislation, rulemaking,
-or guidance to implement the components of the rural hospital
-cybersecurity workforce development strategy; and
-(4) the effectiveness of the rural hospital cybersecurity
+rural hospital cybersecurity workforce development strategy,
+and the number of individuals trained or educated through such
+programs or initiatives; and
+(3) the effectiveness of the rural hospital cybersecurity
workforce development strategy in addressing the need for
skilled cybersecurity professionals in rural hospitals.
SEC. 4. INSTRUCTIONAL MATERIALS FOR RURAL HOSPITALS.
(a) In General.--Not later than 1 year after the date of enactment
-of this Act, the Secretary shall make available instructional materials
-for rural hospitals that can be used to train staff on fundamental
-cybersecurity efforts.
+of this Act, the Secretary shall publish on the website of the
+Department of Health and Human Services and make available through
+other appropriate means, at no cost, instructional materials for rural
+hospitals that can be used to train staff on fundamental cybersecurity
+efforts.
(b) Duties.--In carrying out subsection (a), the Secretary shall--
(1) consult with appropriate heads of agencies, experts in
-cybersecurity education, and rural healthcare experts;
+cybersecurity education, and rural health care experts;
(2) identify existing cybersecurity instructional materials
-that can be adapted for use in rural hospitals and create new
+that can be adapted for use in rural hospitals and develop new
materials as needed; and
(3) conduct an awareness campaign to promote the materials
available to rural hospitals developed under subsection (a).
@@ -138,4 +289,23 @@
No additional funds are authorized to be appropriated for the
purpose of carrying out this Act.
-<all>
+Calendar No. 309
+
+119th CONGRESS
+
+2d Session
+
+S. 2169
+
+_______________________________________________________________________
+
+A BILL
+
+To require the development of a comprehensive rural hospital
+cybersecurity workforce development strategy, and for other purposes.
+
+_______________________________________________________________________
+
+January 28, 2026
+
+Reported with an amendment

Cosponsors (6)

Members who signed on to support this bill.

Hassan D
Kelly D
Ossoff D
Collins R
Warnock D
Heinrich D