Skip to main content
founders-corner

After the Midterms: Could We Finally Afford to Protect Our Hospitals?

As Congress debates Medicaid cuts and hospital funding after the midterms, security must be funded as patient safety. Here is what policymakers and hospital leaders should do now.

Pandian Gnanaprakasam

Wes Wright

November 4, 2026
7 min read

When the ambulance turns away

It pains me to see hospitals divert ambulances because their systems are down. Behind every diversion is a person having a stroke, a heart attack, or a trauma who now rides past the closest emergency room to one farther away.

We saw it in 2024, when a ransomware attack on Ascension forced some of its hospitals to divert ambulances while clinicians fell back to paper charts. We have seen it in smaller community hospitals that never make national headlines. Each time, the neighboring hospitals absorb the overflow, and the whole region gets less safe.

These are not IT outages. They are care outages. And for years, the honest answer to "why aren't hospitals better protected?" has been simple: they could not afford to be.

Many hospitals cannot afford even a simple tool that lists every piece of medical equipment along with its patch level and FDA recall status. Many still rely on aging firewalls that need automation to cut off hackers once they gain a foothold on endpoints inside the hospital.

What the election changed, and what it didn't

On November 3, Democrats won control of both chambers of Congress. Their stated first priorities are repealing the roughly $900 billion in Medicaid reductions in the One Big Beautiful Bill Act and restoring the expired ACA subsidies. Not all of their ideas help hospitals, including site-neutral payment and caps on hospital prices.

But control of Congress is not control of policy. The Senate filibuster and a presidential veto still block most changes, and the Medicaid work requirement starts January 1, before the new Congress is seated. Experts quoted by HFMA expect the cuts to proceed in early 2027, with major healthcare legislation unlikely before 2028. For hospital budgets, 2027 will be a year of uncertainty, not relief.

Why this budget fight is a patient safety fight

When hospital margins tighten, security is usually one of the first lines cut. RSM (an audit, tax, and consulting firm) warned before the vote that reimbursement pressure would hit staffing, capital plans, and long-term transformation projects first. That is where cybersecurity sits.

But in a hospital, a cyberattack is a clinical event. University of Minnesota researchers found that in-hospital mortality for admitted Medicare patients rises from about 3 in 100 to 4 in 100 during a ransomware attack. They estimate these attacks killed 42 to 67 Medicare patients from 2016 to 2021. A JAMA Network Open case study showed nearby emergency rooms filling up when one hospital went down.

The Joint Commission now treats long cyber outages as a patient safety risk. As Congress and the states decide how much to cut or restore, that should shape how every dollar of hospital funding is judged.

Washington has been here before

Mandatory hospital cybersecurity is not a new idea. Several efforts are already on the table, and segmentation keeps showing up in them.

  • The proposed HIPAA Security Rule update (January 2025). HHS proposed the biggest Security Rule overhaul since 2013. It would make network segmentation a required safeguard instead of an optional one, and require a written technology asset inventory and network map, MFA, encryption, and the ability to restore systems within 72 hours. The rule is still not final; its target has slipped from May 2026 to around July 2027.
  • Health Care Cybersecurity and Resiliency Act. A bipartisan bill from Senators Cassidy, Warner, Cornyn, and Hassan. It passed the Senate unanimously in early October 2026 and now sits with the House. It would require minimum practices such as MFA, encryption, and penetration testing, and create grants for nonprofit hospitals and clinics.
  • Health Infrastructure Security and Accountability Act. Senators Warner and Wyden reintroduced it in September 2026. It would set mandatory minimum standards with annual independent audits, and provide $1.3 billion to help hospitals comply, including $800 million for safety-net hospitals.
  • Rural Hospital Cybersecurity Enhancement Act. Directs HHS to build a national strategy for recruiting and training cybersecurity staff at rural hospitals, and to give those hospitals free cybersecurity training materials. It adds no new security mandates; it targets the staffing gap that leaves many rural hospitals with no one to run their defenses.
  • HHS Cybersecurity Performance Goals (2024). Voluntary today, but they already list asset inventory and network segmentation as enhanced goals.
  • FDA device cybersecurity requirements (2022). Congress gave FDA authority to require device makers to submit plans for monitoring and patching vulnerabilities, plus a software bill of materials, for new connected devices. It does not cover the older devices already in hospitals.
  • Countering Chinese Cyberthreats for Patients (Countering CCP) Act. Directs FDA and CISA to review Chinese-made networked medical devices already in use for cybersecurity risk, and gives HHS authority to recall any found to pose one. Unlike the FDA rules above, it reaches devices already installed in hospitals.

The pattern is clear. Every serious proposal asks hospitals to know their devices and segment their networks. What has been missing is a law that passes both chambers, and the money to help hospitals comply. The new Congress can finish that work.

Where cybersecurity fits in the next two years

The new Congress will have a few moments of real leverage: government funding deals, a likely debt-limit fight in 2027, and oversight of how CMS implements the Medicaid changes. Analysts also point to bipartisan interest in healthcare AI regulation and hospital price transparency. Hospital cybersecurity belongs on that list. It is not a partisan issue, and patient safety is common ground.

Three ideas for policymakers on both sides of the aisle:

  • Tie relief to resilience. Any delay or softening of Medicaid cuts could come with a simple condition: meet HHS's voluntary Cybersecurity Performance Goals, which already include asset inventory and network segmentation.
  • Pair standards with support. The Minnesota researchers recommend combining minimum security requirements with funding help for hospitals that cannot afford them. Requirements alone just shift cost to the hospitals least able to pay.
  • Use oversight hearings. As Congress examines HHS and CMS, it can ask how cyber resilience is built into hospital payment and emergency preparedness rules.

What hospital leaders should do now

Hospitals cannot wait for Washington to settle. The 2027 budgets being built this quarter will decide how protected patients are next year.

  • Plan for both outcomes. Model budgets with the Medicaid cuts in place and with partial relief. Decide now which security investments are protected in the worse case.
  • Fund security as patient safety. Put cyber risk on the patient safety committee agenda and review major incidents the way you review sentinel events.
  • Fix the basics first. Know every connected device, its patch level, and its FDA recall status, and make sure existing firewalls are actually segmenting them. ORDR's own findings show basic firewall management is often missing: in one sample, an outside IP opened a plaintext Telnet session into a CT scanner, and five blocklisted Chinese IPs swept 44 building controllers in a single automated event.
  • Segment the ER and OR first. These are the units where an outage turns into a diversion or a canceled surgery. Put their devices and workstations in their own protected zones before anything else.
  • Segment core clinical systems. Isolate the EHR/EMR and the systems that feed it, so an infected laptop or vendor connection cannot reach the record every clinician depends on.
  • Cut medical devices off from the internet. Detect every medical device talking to an outside site and block that access, allowing only the specific vendor connections that are approved and monitored.
  • Report what matters to patients. Give the board a few clear measures, such as hours to restore clinical systems and minutes to isolate a compromised device.
  • Practice downtime. Run outage drills with nursing, the ED, and local EMS so an attack becomes a slowdown, not a diversion.

So, can we afford it?

This election did not hand hospitals a windfall. It opened a two-year debate over how much to cut, restore, and protect. Whatever the outcome, the cost of an attack is measured in delayed care, and no hospital can afford that.

To policymakers in both parties: as you negotiate Medicaid and hospital funding, protect the basic defenses that keep emergency rooms open. To hospital leaders: treat security as patient safety in your 2027 budget, because it is.

I never want to read another story about an ambulance driving past a dark hospital. Security is patient safety. It is time we funded it that way.

Sources

Found this useful? Share it.

LinkedIn (opens in a new tab)X (opens in a new tab)