White House takes Texas water cybersecurity model to rural hospitals

The White House and South Carolina officials launched a six-month cybersecurity pilot Monday to help rural hospitals defend against hackers and keep treating patients during attacks, extending an approach first tested with water utilities in Texas.

The initiative, Project Lifeline 250, will connect participating hospitals with technology companies offering assistance at no cost. National Cyber Director Sean Cairncross and South Carolina Gov. Henry McMaster announced the effort at Newberry Health Hospital.

The program will focus on strengthening hospital networks, providing backup technology to maintain critical services after an attack and identifying and replacing high-risk or outdated devices. It brings together the Office of the National Cyber Director, South Carolina’s Critical Infrastructure Cybersecurity program, the State Law Enforcement Division and industry partners, including Cisco, Cyera, Microsoft, Trellix and Zscaler.

“Project Lifeline 250 connects the world-leading American industry with rural hospitals and uses the greatest American tools and capabilities to defend hospital networks; deploy physical back up devices after an initial incident to ensure an impacted hospital can still provide critical care; and identify high-risk and legacy devices and replace them,” Cairncross said.

The launch follows Project Watershed 250, a six-month pilot announced Aug. 31 in San Antonio, Texas. That effort pairs Texas water and wastewater providers with government and private-sector specialists to find security weaknesses and help fix them using cybersecurity and artificial intelligence tools. 

Both projects seek to bring technical assistance to organizations that provide essential services but often lack the money and staff to adequately secure their systems. Officials did not specify when the six-month period would begin or how assistance would be maintained and financed if the program expands.

Cairncross had previously previewed plans to expand beyond the water sector at September’s Billington Cybersecurity Summit, saying the administration wanted to test specific solutions before applying them more broadly.

Hospital cyberattacks can interfere with the systems clinicians use to retrieve medical records, review test results and coordinate care. Rural providers typically have fewer financial resources than larger health systems to protect those functions.

Other incidents present even greater risks. Critical patients were diverted from the University of New Mexico Health System on Monday following a cyberattack that severely disrupted operations.

And in South Carolina, the state’s AnMed health system experienced weeks of disruption after a July cyberattack, including limited access to medical records. Its emergency and urgent care locations remained open, but normal operations did not resume until mid-September. 

The major 2024 hack of UnitedHealth’s Change Healthcare subsidiary delayed prescriptions and disrupted insurance payments across the country, leaving rural clinics and hospitals struggling to cover expenses. It impacted roughly 193 million people, according to an analysis from the Department of Health and Human Services posted last year.