Community Hospital in McCook, Neb., a town of about 7,400 people, defends its patient data with just nine information systems staffers, several of whom share cybersecurity duties. Its leaders say the hospital faces many of the same digital threats as large urban health systems, and they are looking for new ways to recruit and keep security talent despite limited resources.
“Even though we’re a small organization, we’re protecting the same assets,” says Lori Beeby, the hospital’s CIO and vice president of support services. “We have to protect our users, our patients and our community.”
A Small Team With a Large Responsibility
Community Hospital’s situation reflects a broader reality for rural providers. They hold the same electronic health records, billing data and connected medical devices as bigger institutions, but they have far fewer people to protect them.
Beeby says the hospital must rely on innovative approaches because it cannot match the budgets of major health systems. In a team of nine, security is a shared responsibility rather than a standalone department.
Why Rural Hospitals Are Targets
Attackers do not scale their efforts to the size of the victim. Healthcare records carry high value on criminal markets, and disruptions to patient care create pressure to pay ransoms.
The U.S. Department of Health and Human Services Office for Civil Rights, which tracks breaches affecting 500 or more people, has logged steady growth in hacking incidents at healthcare organizations over the past several years. Industry trackers such as the HIPAA Journal reported that well over 100 million healthcare records were exposed in 2023 alone.
The 2024 attack on Change Healthcare, a major claims processor, showed how a single compromise can ripple through providers of every size. Smaller hospitals often feel those disruptions acutely because they have fewer reserves and fewer staff to manage workarounds.
The Talent Gap Hits Harder Outside Cities
The cybersecurity workforce shortage compounds the problem. ISC2, a nonprofit cybersecurity certification body, has estimated the global gap at roughly 4 million professionals.
Rural employers face additional hurdles. They draw from smaller local labor pools, often cannot match the salaries of metropolitan employers or large technology firms, and may struggle to persuade candidates to relocate.
Remote work has widened the competition. A security analyst who once might have taken a regional hospital job can now apply for fully remote roles at national companies.
Strategies Rural Organizations Can Use
Workforce specialists and healthcare IT leaders commonly point to several tactics that smaller organizations can use to compete.
One is to develop talent locally. Partnerships with community colleges, universities and high school technology programs can create a pipeline of candidates who already have ties to the area.
Another is cross-training existing IT employees. Staff who understand a hospital’s systems and clinical workflows can add security certifications and responsibilities, and that investment can strengthen retention.
A third is to offer what large employers cannot. Rural hospitals can promote close-knit teams, broad responsibility early in a career, and a visible link between daily work and the safety of neighbors. For some candidates, that sense of mission carries weight.
Many small providers also supplement internal staff with outside help. Managed security services, shared regional resources and vendor partnerships can provide round-the-clock monitoring that a nine-person team could not staff alone.
Government and Industry Support
Federal agencies have increased their attention to the issue. HHS has published voluntary cybersecurity performance goals for healthcare, and the Cybersecurity and Infrastructure Security Agency offers free services to eligible critical infrastructure organizations, including vulnerability scanning.
These resources matter most for organizations that cannot afford large security budgets. They give small teams a baseline framework and tools without requiring new hires for every function.
What It Means for Healthcare Leaders
For rural hospital executives, the message from Community Hospital is that size does not reduce the obligation to protect patients. It does change how the work must be organized.
Leaders who treat security as a shared, organization-wide responsibility, invest in their current staff and use external partnerships can narrow the gap with larger competitors. Those who wait for a perfect hiring market may find the wait costly.
Policymakers and health system partners are also watching. Rural hospitals often serve as the only care option for miles, so a successful attack can affect an entire region’s access to care.
What to Watch Next
Several developments will shape how rural providers fare. Federal discussions about mandatory cybersecurity standards for hospitals could raise expectations, and possibly costs, for small facilities. Expanded grant programs and regional information-sharing networks could ease those burdens.
Training pipelines will also matter. If community colleges and rural health systems build stronger partnerships, hospitals like Community Hospital may find that their best security recruits are already living down the road.