Most rural healthcare IT leaders (73%) struggle to maintain HIPAA compliance because they lack staff and funding, according to Paubox's Rural healthcare left vulnerable to cyber attacks report. Cost was also one of the biggest criticisms of the proposed HIPAA Security Rule update, especially for small and rural providers, HIPAA Journal reports. On October 26, the federal government launched its most direct answer yet, Project Lifeline 250, a six-month pilot that gives rural hospitals free cybersecurity hardware and services. For now, it covers one state, and officials haven't said how a nationwide version would be paid for.

Project Lifeline 250 gives South Carolina rural hospitals free upgrades for six months

The White House Office of the National Cyber Director (ONCD) and South Carolina Governor Henry McMaster launched the pilot at Newberry Health, a 90-bed independent hospital about 40 miles northwest of Columbia. Technology and cybersecurity companies will provide the hardware and services at no cost to participating hospitals.

The pilot is a different effort from the 2024 commitments Microsoft and Google made under the earlier Health Sector Cyber Initiative, which we covered in Microsoft and Google's cybersecurity lifeline for underserved communities. Project Lifeline 250 is a new, state-by-state pilot run by ONCD.

According to the governor's office, the pilot focuses on three things:

  • Strengthening hospital network defenses
  • Providing backup technology so a hospital can keep delivering critical care after a cyberattack
  • Identifying high-risk and legacy devices in critical care settings and replacing them

The South Carolina Critical Infrastructure Cybersecurity program and the State Law Enforcement Division (SLED) will oversee it with ONCD. It follows Project Watershed 250, a six-month pilot for Texas water utilities that ONCD announced on August 31.

"We'll find what works and we'll scale it," National Cyber Director Sean Cairncross said at the launch, according to the SC Daily Gazette.

One tool Newberry will test is Code Cart, an "IT system in a box" that researchers at the University of California San Diego built with an HHS grant. Cairncross said it is designed to restore essential hospital functions, such as communications, radiology, labs, and access to critical health records, within two hours of a full ransomware shutdown.

The pilot leaves its start date, scale, and funding open

Officials didn't say when the six-month period begins or how the program would be maintained or paid for after the pilot, according to both the SC Daily Gazette and Nextgov. The announcement also didn't specify which or how many rural hospitals would take part, Fierce Healthcare reports.

Grant money is further off. HIPAA Journal reports that the Senate unanimously passed a healthcare cybersecurity bill calling for grants to underserved hospitals. It still needs the House, the President's signature, and a separate funding approval from Congress.

A cyberattack helped close an Illinois hospital in 2023

St. Margaret's Health in Illinois closed in 2023 and cited a cyberattack as one of the reasons, HHS Chief Counselor Chris Klomp noted at the launch. Almost one-third of U.S. rural hospitals are already at risk of closure because of financial problems, according to a Center for Healthcare Quality and Payment Reform analysis that HIPAA Journal cites.

Most rural healthcare IT leaders (85%) in the same Paubox report said their current infrastructure limits their ability to deploy secure communication tools.

The pilot's focus areas line up with what the proposed Security Rule would require

The proposed Security Rule update that OCR issued in December 2024 would require regulated entities to:

  • Keep a technology asset inventory and a network map, updated at least every 12 months
  • Write procedures to restore certain systems and data within 72 hours
  • Keep separate technical controls for backup and recovery
  • Encrypt electronic protected health information (ePHI) at rest and in transit, with limited exceptions
  • Use multi-factor authentication, with limited exceptions

The pilot's work on legacy devices and backup technology maps to the inventory and restoration requirements. The inventory alone is a large job: Klomp said the average hospital has more than 26,000 internet-connected devices. The announcement doesn't mention encryption, multi-factor authentication, or email, so hospitals in the pilot will still need their own plan for those.

Rural providers can close some gaps without waiting for the pilot

A hospital outside South Carolina has no date for when help arrives. Three steps cost staff time more than money:

  • Start the asset inventory. List every device and system that stores or sends ePHI, and flag the ones that no longer get security updates.
  • Write and test a restore plan. Decide which systems come back first, and practice getting them back inside 72 hours.
  • Turn on multi-factor authentication for email and remote access wherever your current tools already support it.

Encrypting email is the step that needs a tool. Staff share patient information by email every day, and the proposed rule would require ePHI to be encrypted in transit. HIPAA compliant email from Paubox encrypts every message by default, so a busy employee has no step to forget.

Project Lifeline 250 may grow into the national model its organizers describe. Until a start date and funding exist, rural providers outside South Carolina are still working with their own budgets and staff.