Why is aging network equipment a liability?
Aging network equipment is a liability because, once it passes the vendor’s end-of-support date, known security flaws stay open permanently. Attackers actively look for these devices. The same equipment also fails more often, can’t be repaired quickly, and can’t run the security features modern threats require.
In many rural facilities, the routers, firewalls, switches and Wi-Fi access points were installed years ago and have kept working, so replacing them never rose to the top of the budget. Working is not the same as safe.
| Equipment | Risk when it is aging or out of support | What a current replacement provides |
|---|---|---|
| Firewalls | Outdated threat protection; unpatched flaws exposed to the internet | Current threat prevention, secure remote access, regular updates |
| Routers and site links | Single points of failure between clinics; unpatched remote-access features | Redundant, encrypted connections and central monitoring |
| Switches | No segmentation, so one infected device can reach everything | Segmentation that isolates clinical systems, medical devices and guests |
| Wi-Fi access points | Weak encryption, poor coverage, rogue devices hard to spot | Current encryption, device identification, coverage for clinical use |
| Management tools | Problems found only when users complain; no audit trail | Central visibility, alerts, configuration history for audits |
What cybersecurity gaps are common in rural hospitals?
Rural hospitals tend to have the same few gaps, usually because small IT teams are stretched, not because anyone ignored the risk. Microsoft’s rural hospital cybersecurity program assessed more than 250 rural hospitals and found:
- 69% struggled with multi-factor authentication.
- 65% struggled with email security.
- 62% had challenges with network segmentation.
- 33% needed stronger security requirements for vendors and partners.
Network segmentation stands out for infrastructure planning. On a flat network, an attacker who compromises one laptop, medical device or guest connection can move toward the EHR and other critical systems. Segmentation limits how far an attack can spread.
What does an attack cost a rural hospital?
An attack costs a rural hospital in downtime, recovery and patient care. Microsoft reported that hospitals lose an average of $1.9 million for each day of downtime after a ransomware attack, and that attacks can cut off key electronic systems for up to 18 days.
Sky Lakes Medical Center, a 90-bed rural hospital in Oregon, refused to pay a ransom in 2020. Its networks were down for 28 days, and it had to repair or replace 2,500 computers. Across all industries, healthcare has the highest average breach cost: $7.42 million, according to IBM’s 2025 report.
For a hospital with thin margins, one serious incident can erase years of savings (see Part 7 for the financial case).
What do HHS and HIPAA expect for network security?
Federal expectations are rising, and they point in the same direction.
HHS Cybersecurity Performance Goals. HHS published voluntary goals for healthcare in 2024. The essential goals include addressing known vulnerabilities, multi-factor authentication, encrypting data in transit and managing vendor risk. The enhanced goals include maintaining asset inventories, segmenting networks to limit attacker movement, centralizing logs and keeping consistent device configurations. HHS has said it intends to develop enforceable standards informed by these goals.
Proposed HIPAA Security Rule update.HHS’s Office for Civil Rights proposed a major update in January 2025. As proposed, it would make network segmentation, multi-factor authentication and encryption mandatory in most cases, and would require a written technology asset inventory and network map, vulnerability scans every six months, annual penetration testing and the ability to restore critical systems within 72 hours. The final rule has been delayed to at least July 2027 and could change. The current Security Rule remains in force.
Whatever the final rule says, the direction is clear. Facilities that inventory their network, replace unsupported equipment and segment their systems now will be ready, and safer in the meantime.
What should a hospital board ask about network risk?
Boards don’t need technical detail, but they should ask for clear answers to six questions:
- Do we have a current inventory of every router, firewall, switch and access point, with its end-of-support date?
- Is any of it past end-of-support or due to reach it within two years?
- Is our network segmented so medical devices, guests and clinical systems are separated?
- Do we use multi-factor authentication for remote access and administrator accounts?
- How long would it take to restore clinical systems if the network went down tomorrow?
- Who monitors the network after hours, and how would we know about an attack?
If the answers are uncertain, that uncertainty is itself the risk. An infrastructure and security assessment provides the facts.
Can RHTP funds pay to fix it?
Yes, within each state’s plan. One of RHTP’s approved uses covers software, hardware and technical assistance for IT that improves efficiency, cybersecurity and patient outcomes, and CMS guidance names cybersecurity and interoperability infrastructure as eligible areas. Equipment counts toward each state’s 20% cap on equipment and infrastructure (see Part 3).
Several states in our region make cybersecurity an explicit priority. New York’s plan includes $79.5 million for technology innovation and cybersecurity resilience, and New Hampshire’s technology area includes data security and cybersecurity. Other programs can help too, such as the FCC Healthcare Connect Fund for network security and state cyber grants (see Part 4).
Turn risk into a funded plan
An aging network is a risk the board can measure and fix. Start with an inventory and assessment, prioritize equipment past end-of-support and the gaps that matter most, and match the work to RHTP and other funding.
CoreDefense is a vendor-neutral network and security partner for rural healthcare organizations across New England and New York. We assess aging infrastructure, design segmented and secure networks sized for lean IT teams, and help turn the findings into funding-ready plans.
Frequently asked questions
What does end-of-support mean for network equipment?
End-of-support is the date after which the manufacturer stops providing security patches, software updates and, often, replacement parts. Equipment past that date keeps running, but newly discovered flaws are never fixed.
Why are rural hospitals targeted by cyberattacks?
Rural hospitals hold valuable patient data and depend on systems that must stay running, while often having small IT teams, older equipment and gaps such as missing multi-factor authentication or network segmentation. Attackers look for those openings.
What is network segmentation in a hospital?
Network segmentation divides a hospital's network into separate zones, such as clinical systems, medical devices, staff and guests, so that a compromise in one zone can't easily spread to others. HHS lists it among its enhanced cybersecurity performance goals.
Is the new HIPAA Security Rule in effect?
No. HHS proposed a major update in January 2025, but the final rule has been delayed to at least July 2027 and could change. The current HIPAA Security Rule remains in force.
Are the HHS cybersecurity performance goals mandatory?
Not currently. They are voluntary, but HHS has said it intends to develop enforceable standards informed by them, and they are a practical benchmark for any security plan.
Can RHTP funds pay for firewalls and cybersecurity upgrades?
Yes, within each state's plan. Cybersecurity is part of RHTP's approved IT uses, and equipment counts toward each state's 20% cap on equipment and infrastructure.
Sources
Figures checked against the sources below in October 2026. State programs change often; confirm current details with your state’s lead agency.
Threats and costs
Federal expectations and funding
RHTP approved uses and the 20% equipment cap: see the sources in Part 3.