This webinar was originally recorded on Becker's Healthcare "Beyond Survival: How Rural Hospitals Can Build Future-Ready IT."
Rural hospitals serve roughly 20% of the U.S. population, yet they face a disproportionate share of healthcare's most pressing challenges. In a recent Becker's Healthcare webinar, Phil Sobol, CCO at CereCore, and Chris Riha, Principal Consultant at CereCore, offered an honest, experience-driven look at how rural health organizations can overcome their most persistent IT obstacles and build a foundation for long-term resilience.
The challenges facing rural hospitals aren't new, but they're intensifying. Limited broadband, understaffed IT teams, aging legacy systems, financial constraints, and growing cybersecurity threats all compound one another. What makes rural health different isn't just the list of challenges, it's the depth of them and the limited resources available to address them.
The webinar opened with a candid story about a rural Texas hospital that illustrates just how dire things can get. With just over 40 beds, an average daily census of only 10%, and an IT environment that could generously be described as a server closet with a cardboard box of spare retail networking gear, the organization needed more than a technology refresh, it needed a complete transformation. New executive leadership came in and made the necessary decision to bring in outside IT expertise. What followed was a disciplined, five-year modernization plan built around budget realities, board buy-in, and a phased approach that started with the basics: network stabilization, proper governance, policy development, and moving workloads to the cloud. Only after that foundation was in place could the organization tackle its fragmented EHR landscape, ultimately consolidating onto a single platform.
As Phil noted, "The transformation took strong and visionary leadership." It also took a partner willing to go the distance, not just deliver a project and move on.
Chris Riha brings over 40 years of healthcare IT experience to the conversation, including two decades focused on cybersecurity. His message was direct: rural hospitals are actively being targeted by cyber criminals who view them as soft targets, aware of their limited defenses and stretched staff.
The good news is that meaningful progress doesn't require a massive budget. Chris outlined a practical cybersecurity roadmap (see image below) that starts with an honest assessment of where an organization stands against established frameworks like NIST, followed by policy development, staff training, and monitoring. One of the most cost-effective investments an organization can make? Building what Chris calls the "human firewall", educating staff to recognize phishing attacks before they click.
Other foundational priorities include patch management (often deprioritized but critically important), multifactor authentication for remote access, and tabletop exercises that give teams the muscle memory to respond confidently when a real incident occurs.
Here’s what Chris said about tabletop exercises:
“A key component that we bring to organizations is tabletop exercises. Tabletop exercises allow an organization to find out where their gaps may be across certain scenarios in a very safe manner. It does two things; it provides an opportunity for them to learn where their gaps are and identify action steps to improve them. It also gives them what I call ‘muscle memory’. So, in the event there is a real cyber incident, they have the confidence, to say ‘we've done this before in tabletop exercises, we know where to find the documentation, and we know how to respond’.”
Common cybersecurity gaps CereCore uncovers in rural hospitals:
And as the threat landscape continues to evolve, one emerging risk is rising fast on the radar for rural and urban hospitals alike. Artificial intelligence is creating new cybersecurity and privacy challenges that many organizations aren't yet prepared to govern, and Chris addressed it directly:
“AI seems to be a buzzword that a lot of organizations are looking at which creates its own challenges from a cybersecurity and privacy perspective. We work with organizations to develop governance for AI to make sure that it's done properly and that it's done in a manner that will protect privacy for the organization.”
On that last point, Chris shared a creative solution deployed for a hospital in rural Montana that had two internet lines from the same carrier running through the same conduit, effectively zero redundancy. By layering in Starlink as a backup connection, the team achieved true redundancy at roughly a third of the cost of the existing setup.
Resource constraints are real, but so are the funding opportunities available to rural hospitals. During the webinar, the audience was walked through several programs worth exploring, including the Rural Healthcare Transformation Program ($50 billion administered at the state level over five years), HRSA grants, Rural Health Information Hub, USAC telecom funds (historically underutilized), and ARPA-H; a federal program modeled after DARPA designed to seed high-impact, innovative health solutions. CereCore recently submitted an ARPA-H grant focused on making tabletop cybersecurity exercises more accessible and affordable for rural organizations.
When asked where a rural hospital should begin if budget is tight, Chris kept it simple:
"You really have to be able to know where you're going. That's where some outside expertise can come in very helpful; for identifying not only the gaps, but the particular funding sources you could use to help fill those gaps."
Perhaps the clearest theme across the entire webinar was this: rural hospitals don't need to solve these problems alone, and they don't need full-time, in-house experts for every discipline. What they need is the right fractional expertise; a CISO-level perspective, network support, EHR guidance, board communication support, available when and how they need it.
As Chris put it, "It's really nice when we can go into an organization and say, here's where we can help you fill the gaps, and here's how you can pay for that."
At CereCore, we work as long-term partners with rural health organizations, not as a one-time vendor engagement, but as an extension of the team, invested in the mission of keeping care accessible in the communities that need it most.