Rural health transformation money runs on three clocks, and only two of them come with funding

The week

In early October 2026, states were hurrying to commit the first year of a multibillion-dollar federal fund for rural health, with technology named as one of the things it may pay for. Take a 25-bed hospital in a farming county, two hours from the nearest city. It runs an aging electronic records system, depends on a single outside IT firm and has never been able to hire a dedicated security specialist. Almost overnight, its state has been handed a share of that fund. For a hospital like this, the question has moved from whether there is money to whether the money can be spent well, and fast enough.

The fund is the Rural Health Transformation Program. The July 2025 budget reconciliation law created it: $10 billion a year for five federal fiscal years, 2026 through 2030. Budget reconciliation is a fast-track procedure Congress uses for tax and spending legislation. CMS, the Centers for Medicare & Medicaid Services, which runs the program, announced first-year awards on December 29, 2025, approving all 50 states. Amounts ranged from about $147 million for New Jersey to $281 million for Texas, according to KFF, the health policy research organization.

The money is divided in two ways. Half of each year's funding is split equally among the states. The other half is allocated using factors CMS sets, including how rural a state is and the policy commitments it has made.

The calendar is what made early October tense. Fiscal 2027, the program's second year, began on October 1, 2026. According to KFF's summary of the CMS timeline, states had until October 30 to obligate their first-year funds and until September 30, 2027 to spend them. To obligate money is to commit it formally, by signing a contract or making an award, even if the cash has not yet left the account. CMS was due to announce second-year allocations by October 31.

Technology, including telehealth, remote monitoring, data exchange and cybersecurity, was one of the program's permitted uses. Telehealth means care delivered over video or phone. Remote monitoring means devices at home, such as blood pressure cuffs or glucose meters, that send readings back to a care team. Data exchange means moving patient records safely between hospitals, clinics and labs. For a small rural hospital, any of these could change how care is delivered. Each also comes with a running cost that does not stop when the grant does.

Rural hospitals and clinics are among the least resourced health care organizations in technology and security. Many run older EHRs, rely on one managed service provider and cannot recruit security staff. The program is a large, fast infusion of money with technology as an explicit use. Its timing rules are unusually tight.

Each award runs on three clocks: an obligation clock, a spending clock and a sustainment clock. The first two are set by CMS and come with money attached. The third starts when the money stops, and nothing in the program funds it. Decisions made to beat the first clock largely determine what happens on the third. States and providers should confirm allowable uses and deadlines with CMS and their state program offices.

The technology a rural provider actually runs

The clocks make more sense once the systems this money might pay for are clear, along with what keeping each one alive involves.

An EHR, or electronic health record, is the hospital's central clinical system. It holds patient histories, medication lists, test results and clinicians' notes, and it usually connects to billing. It sits at the center: almost every other tool plugs into it. Changing or upgrading one is slow because clinicians have to learn new screens and every connection has to be retested.

A managed service provider is an outside firm that runs a small organization's IT for a monthly fee: the network, the email, the laptops, sometimes the backups. For a small hospital this is often the only IT expertise it has, which makes it efficient and also a single point of failure.

A health information exchange is a shared service, often run regionally or at state level, that lets hospitals, clinics, labs and pharmacies send and look up patient information securely. Rather than each hospital wiring itself to every other, all connect to the exchange.

On the security side, three tools come up again and again. Managed detection and response is a monitoring service in which an outside team watches an organization's computers and network around the clock for signs of an attack and acts quickly to contain one. Phishing-resistant authentication is a way of logging in, often with a physical key or a device-based passkey, that cannot be defeated simply by tricking a staff member into typing a password into a fake website. Tested offline backups are copies of critical data kept disconnected from the main network, so that ransomware, malicious software that locks files and demands payment, cannot reach them, and which have actually been restored in practice so the hospital knows they work.

Every one of these has a purchase price and a running cost. That distinction is the thread through everything that follows.

The obligation clock

Obligation means a binding commitment: an executed contract, a sub-award or an order. Funds not obligated in time can be deducted from later awards or redistributed, according to state summaries of CMS guidance. States approached the October 30 deadline at very different speeds. Some had issued competitive sub-awards to providers. Others, according to advisory firm analyses, planned to meet it by committing money to other state agencies for later distribution.

Deadline pressure favors certain kinds of purchase. Off-the-shelf subscriptions sold provider by provider are quick to contract. Shared platforms, which need governance, an operator and agreements among many participants, are slow. A state that obligates fast through dozens of small, separate technology purchases may meet the date and leave each rural hospital with another system to run alone.

Suppose a state has 40 rural hospitals. Under deadline pressure, its program office approves 40 separate grants, and each hospital buys its own remote monitoring software from whichever vendor reaches it first. On October 30 the state has met its date. But it now has 40 contracts, perhaps a dozen different products, 40 sets of staff to train and no common way to see whether any of it is working. Each hospital will face the renewal bill on its own.

There are ways to keep speed without that fragmentation. A state can obligate funds to an entity able to run a shared service, such as a health information exchange, a hospital association or a rural health cooperative. Conditions can follow: a service catalog, a governance board that includes participating providers and published service levels. A service catalog is simply a menu of what the shared service will provide; service levels are the promises about how well, such as how quickly problems will be answered. A cooperative purchasing agreement that participants join over time also counts as one contract. The aim is to make the binding commitment early while keeping the design choices open.

In that same state, the money could instead be obligated by October 30 to a rural health cooperative, with conditions requiring a catalog, a provider-led board and published service levels. Hospitals would then join over the following months as they are ready. The deadline is met just the same, but the state ends up with one service to manage instead of forty.

The spending clock

First-year money must be spent by September 30, 2027. That is a short window for technology that touches clinical workflow. Telehealth, remote monitoring and EHR changes need configuration, training and integration with billing before they deliver anything. A remote monitoring program, for example, is only useful once someone has decided which patients qualify, who reviews the readings, what happens when a reading is alarming and how the work is recorded so the hospital can be paid for it.

CMS also limits some uses. Under the funding notice as KFF summarizes it, replacing an EHR that already met federal certification standards is capped at 5 percent of an award, provider payments at 15 percent and administration at 10 percent. Federal certification here means the system has been tested against government standards for what an electronic record must be able to do. The cap reflects a judgment that swapping one compliant system for another is rarely the best use of transformation money.

Implementation capacity is therefore the binding constraint, not funding. Rural hospitals have few staff to absorb new projects while running the old systems. Grants that pay for software but not for implementation time will be spent on licenses that sit partly unused. Budgets should fund project management, training and backfill for clinical staff during go-live, and states should ask for milestone reporting that measures use as well as spending. Backfill means paying for temporary cover so that nurses and doctors can step away from patients long enough to learn the new system. Go-live is the day the new system switches on for real use.

Cybersecurity fits this clock unusually well. Services such as managed detection and response, phishing-resistant authentication and tested offline backups can be stood up within months and benefit from regional scale. One monitoring team watching 40 hospitals is far more affordable, per hospital, than 40 hospitals each trying to hire their own.

HHS's voluntary Cybersecurity Performance Goals, published in January 2024, give states a ready baseline. They set out the practices the Department of Health and Human Services considers most important for health care organizations, split into essential goals and enhanced goals. A state can define the essential goals as the minimum for every participating provider and fund a shared service to meet them. Adoption against the goals is also a measure CMS reporting can use, which gives the state a clear way to show progress.

The sustainment clock

The last annual award is for fiscal 2030. After the money runs out, recurring costs fall on providers or states. These include licenses, cloud subscriptions, managed services and the staff hired to use them. Rural hospitals with thin margins are poorly placed to absorb them.

Buying a car and owning one are different costs. The grant pays for the car. Insurance, fuel, servicing and the driver's wages keep coming long after the purchase. A hospital that accepts a car it cannot afford to run has not been helped.

Contracts signed now can soften that cliff. Post-grant pricing can be fixed for a period after the program ends, with the price stated in the contract, not left to renegotiation. Participants should have the right to leave a shared service without penalty and take their data in a usable format. Pricing for shared platforms can be set per participant, so costs fall as more providers join.

Business cases should name the source of post-grant funding for each service. Candidates include reimbursement for remote monitoring or telehealth, measured operating savings, or a line in the state budget. A service with no named source should be redesigned before it is bought.

People need the same test as software. Telehealth coordinators, care managers who respond to remote monitoring alerts and the analysts who run a shared data service are often hired with grant money. If their salaries have no successor funding, the technology they support will outlast its usefulness. Each staffing line should carry the same post-grant plan as each license, reviewed yearly by the state program office.

Ownership is the sustainment question in another form. A shared platform needs an owner with the authority, staff and funding to run it after 2030, as well as the money to buy it now. States that fund the operator's running costs during the grant years, and require a plan to recover them later, have the best chance of a service that outlasts the program.

How a funded project plays out inside a hospital

Following one purchase from start to finish shows how differently the three clocks feel inside a small hospital and in a state capital.

Take a critical access hospital whose state program office offers to fund a remote monitoring service for patients with heart failure. On paper the case is strong: fewer avoidable trips to the emergency department and better follow-up for patients who live far away.

In the first months, the work is mostly decisions rather than technology. Someone has to decide which patients qualify, who on the nursing staff reviews the readings each morning and who covers weekends, what reading should prompt a phone call and what should prompt a visit, and how each contact is recorded so the hospital can bill for it. The software vendor answers none of these, and all of them take staff time that a small hospital is already short of.

Then comes the build. The monitoring platform has to connect to the EHR so readings appear where clinicians already look. The managed service provider has to set up accounts, devices and security settings. Staff have to be trained, and while they are in training someone else has to look after patients. If the grant paid only for the software, each of those steps is either squeezed or skipped.

By the end of the spending window, the hospital may have a working service with a few dozen patients enrolled, or it may have a paid-up license and a handful of unused devices in a cupboard. The difference rarely comes down to the product. It comes down to whether time, people and workflow were funded alongside it.

And after 2030, the hospital receives its first unsubsidized invoice. If remote monitoring reimbursement has been flowing because the billing workflow was set up properly, that invoice may be covered. If not, the board faces a choice between finding the money elsewhere and switching off a service patients now rely on. The sustainment clock, in effect, is set by decisions made in the first few months.

What gets left behind

For a rural hospital board, the program looks like a rare windfall, and in part it is. But the risks lie less in the spending than in what is left behind. A new system with no budget to run it becomes a liability: a license bill the hospital cannot pay, software nobody has time to use or, worse, a system that falls out of support and becomes a security weakness.

The security point deserves emphasis. Small hospitals hold the same kinds of sensitive patient information as large ones, and an attack that locks their systems can force them to divert ambulances or revert to paper. Grant-funded security that lapses in 2031 can do worse than stop helping: it can leave staff relying on protections that no longer exist.

For state leaders, the reputational stakes run the other way. A program judged only on whether money went out on time may look successful in 2027 and troubled in 2031. Measuring use and planning for sustainment from the start is how a state avoids that story.

A state that gets it right

The strongest position belongs to a state that met its obligation deadline through a small number of well-governed commitments, with shared services for the things that benefit from scale, such as security and data exchange. Each funded service has a catalog, published service levels, fixed post-grant pricing, a no-penalty exit and a named source of funding after 2030. Each hospital's budget includes implementation time and clinical backfill, and the state reports use as well as spending.

The failures are predictable:

• Treating the obligation date as the finish line. Meeting October 30 says nothing about whether anything will work in 2031.
• Buying licenses without people. Software without implementation time and trained staff sits partly unused.
• Fragmenting by default. Many small, separate purchases leave each hospital to run another system alone.
• Leaving post-grant pricing to renegotiation. A vendor's bargaining position is strongest when the grant has ended and the hospital depends on the product.
• Funding grant staff without a successor plan. Technology outlasts its usefulness when the people who run it leave.

Where the third clock gets set

1. How are we meeting the October 30 obligation deadline: through many separate purchases, or through commitments to entities that can run shared services?
2. For each funded service, what does it cost to run each year, and who pays that cost after fiscal 2030?
3. Do our contracts fix post-grant pricing, allow exit without penalty and let us take our data in a usable format?
4. Have we budgeted project management, training and clinical backfill alongside every license?
5. Who will own and operate each shared platform after 2030, and do they have the authority and staff to do it?

The program's first two clocks are loud: deadlines, announcements, allocations. The third is silent until it arrives. The organizations that do best will be the ones that listen for it now.

With hindsight

CMS has yet to announce second-year allocations, which it said would come by the end of October. For states, that means planning year two without knowing exactly how much money year two will bring, even as they work to commit year one's funds.

Reporting through the summer and early autumn described states moving at very different speeds. Some were still in planning or budget negotiations, while others had issued sub-awards. That spread is not surprising in a program that asked 50 states, with very different health systems and administrative capacity, to stand up large new spending in under a year.

Advisory firms noted that some states planned to meet the October 30 obligation deadline by committing funds to other state agencies for later distribution. That approach meets the date but defers the design questions set out here. It can be a sensible holding move if the receiving agency then builds shared services with proper governance. It can also simply postpone the fragmentation problem by a few months, with less time left on the spending clock to solve it.

It is too early to judge results. No one yet knows which states' approaches will produce services that are used, secure and sustainable, and it would be a mistake to grade them on speed alone.

The sustainment problem has not gone away, because the statute provides no funding after fiscal 2030. That fact belongs in front of every decision a hospital board or state health office makes: each license, platform and grant-funded role needs an answer to who pays for it in 2031. Asking that question now costs little; discovering the answer later can cost a service. States and providers should follow CMS guidance on allowable uses and reporting, and confirm deadlines with their state program offices.