Community Hospital in McCook, Neb., has only nine information systems staffers, several of whom share cybersecurity duties. But the hospital, located in a community of 7,400 people, must defend against many of the same threats as larger health systems in major cities. “Even though we’re a small organization, we’re protecting the same assets,” says Community Hospital CIO and Vice President of Support Services Lori Beeby. “We have to protect our users, our patients and our community.”
The hospital operates with limited resources, making it important to find innovative approaches to cybersecurity. Similar to many rural communities, McCook doesn’t have the deep talent pool of a city with larger healthcare and technology labor markets, but the hospital makes up for these staff recruitment challenges with proactive retention and development efforts. This approach reflects a broad reality for rural healthcare.
Rural Healthcare Cybersecurity Challenges
A May 2025 report on cybersecurity in resource-constrained health systems, published by the Health Sector Coordinating Council, found that leaders at these organizations know what they need to do to secure their environments but often lack the required staff. To compensate, many rural hospitals build their cybersecurity teams around shared responsibilities, internal training, outside partners and technologies that help monitor environments and respond to threats more efficiently. Jennifer Stoll, chief external affairs officer at OCHIN, a healthcare innovation nonprofit group, and co-lead of the cybersecurity working group behind the report, says, “So, we constantly have to create a pool of new learners to sustain operational and clinical excellence.”
Community Hospital has a stable, long-tenured information systems team. The hospital sends its staff to vendor-specific training and general security and networking training, and they also attend conferences. The team watches for email compromise, suspicious network and device activity and risks tied to remote access. The organization has deployed Palo Alto firewalls, and the hospital uses Arctic Wolf to monitor network traffic.
The hospital has also begun developing an AI governance process to evaluate new tools, educate staff on appropriate use and assess emerging features from vendors. If that happened, Beeby says, remaining staffers would work together to pick up the slack, while also temporarily increasing the use of third-party contractors.
Recruitment and Retention Strategies
Community Hospital has used hybrid and remote work to make IS roles more sustainable, including alternating onsite and remote schedules and, in one case, keeping an employee on a full-time remote schedule after he moved out of state during a transition. However, Beeby notes that salary expectations can present a problem when coastal professionals apply to work remotely for a rural midwestern organization. “Definitely, pay is a factor,” Beeby says. “But we’ve been pretty fortunate in recruiting, and we promote people after they come here too. We may bring them in as a technical analyst and then grow them into more of a system administrator role, or maybe even networking, and help them expand their knowledge set.”
Another rural healthcare organization, Lakewood Health System in Staples, Minn., also faces cybersecurity hiring challenges. Vice President of IT Jim Roeder notes that the organization can’t compete with larger health systems in terms of pay. Instead, Lakewood Health System competes on lifestyle, attracting candidates who value flexibility, rural life and ready access to dozens of the state’s 10,000-plus lakes. “We try to entice a little bit with a hybrid working arrangement, so you work from home 40% of the time,” Roeder says. “In the middle of the day, if you have to go to your kid’s event at school, we’re good with that.
But the players in bigger areas can do that too. A lot of times, it ends up being someone who wants to live in lake country and have a cabin and go fishing. We have to try and highlight those things that are going to draw people here.”
Lakewood Health System serves 30,000 patients in a 30-mile radius and operates several rural health clinics, long-term care, assisted living, and cancer treatment centers. The organization’s top cybersecurity concern is ransomware, followed closely by phishing attacks that target employees. They use technologies from vendors such as Palo Alto Networks and Microsoft to support their cybersecurity efforts. The cybersecurity staffing model is lean, with Roeder effectively serving as both CIO and CISO, while his IT manager shares security responsibilities, and a systems administrator manages much of the server and security tooling work.
The organization worked with Microsoft and a third-party implementation partner to configure cybersecurity tools, build policies, and move to a hybrid cloud environment. However, Roeder notes that automation is important, although a routine update once led to 1,500 false alerts in a single day, creating a risk that real problems could get lost in the noise.
