Rural Hospitals Strengthen Defenses with Microsoft’s Cybersecurity Lifeline

Key facts

• Microsoft offers free and discounted security help to rural hospitals in the U.S. that have few resources of their own.
• The program targets hospitals that often lack basics such as email security and multi-factor authentication.
• More than 550 rural hospitals, nearly a third of the U.S. total, now take part, Microsoft said on March 5, 2025.
• Participants get free security assessments, staff training and discounts on Microsoft security products.
• The program was launched in June 2024 alongside a White House push on health care cybersecurity.

Why rural hospitals need help

Rural hospitals run on thin margins and small staffs, and their IT teams are usually tiny. That makes them easy targets. Microsoft says a ransomware attack can push a struggling rural hospital toward closure, and for many communities it is the only hospital within 50 miles.

What Microsoft’s program provides

Microsoft launched its Cybersecurity Program for Rural Hospitals in June 2024, funded as a philanthropic investment. In a March 5, 2025 update, the company said more than 550 rural hospitals were participating, nearly one-third of all rural hospitals in the U.S.

Independent Critical Access Hospitals and Rural Emergency Hospitals get nonprofit pricing on Microsoft security products. Eligible larger rural hospitals already using Microsoft tools can get its advanced security suite free for a year. Everyone in the program gets a free assessment and curated training for employees.

What the package covers

Participants receive:

A free cybersecurity assessment. Training pathways for staff. Discounted or free Microsoft security products, depending on eligibility. AI tools meant to make hospital operations more resilient.

Ransomware’s toll on health care

Health care reported more ransomware attacks to the FBI in 2023 than any other critical infrastructure sector. Larger hospital systems can sometimes absorb an attack. A rural hospital whose systems go down may have to divert patients to facilities hours away, which is dangerous for time-sensitive conditions like strokes and heart attacks.

What Microsoft found

Microsoft says that early in the program it found most rural hospitals had not put basic protections in place, such as email security and multi-factor authentication. That is why the assessments and training sit alongside the product discounts.

The White House connection

The program was announced in June 2024 as part of a White House effort with Microsoft and Google to improve cybersecurity at rural hospitals, coordinated with the American Hospital Association.

It reflects a broader policy view that private companies can help protect sectors with small security budgets.

What hospital leaders should do

For a rural hospital, the first steps are cheap: turn on multi-factor authentication, lock down email and take the free assessment if eligible. Those basics close the doors attackers use most.

For the technology industry, Microsoft’s program is a test case. Its white paper on what it learned is a useful read for any company considering similar support for under-resourced public services.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.