Rural hospitals in South Carolina are to receive free cybersecurity help under a new federal pilot. On 26 October 2026, the White House Office of the National Cyber Director (ONCD) and the U.S. Department of Health and Human Services (HHS) launched Project Lifeline 250 at Newberry Health in Newberry, South Carolina, a six-month programme through which technology and cybersecurity firms will offer hardware and services to rural hospitals at no cost to the participating facilities. South Carolina Governor Henry McMaster said: “Project Lifeline 250 is another important step toward ensuring South Carolina's rural hospitals have the resources they need to defend against cyberattacks and continue providing critical care.”
What Project Lifeline 250 Is
The pilot is the ONCD's second regional programme connecting critical infrastructure operators with free security resources. The first, Project Watershed 250, focused on water utilities in Texas and was announced in August 2026. Lifeline 250 applies the same model to healthcare, beginning in South Carolina, where ONCD and HHS are working with the South Carolina Law Enforcement Division's critical infrastructure cybersecurity initiative, the state's Critical Infrastructure Cybersecurity programme, federal agencies and local governments. National Cyber Director Sean Cairncross has described the initiative as scalable: the point of a six-month pilot in one state is to test which solutions work in small, resource-constrained hospitals and could then be extended more widely. The programme is not a grant to hospitals and not a procurement exercise. It is a public-private arrangement in which participating companies supply their own hardware, software and expertise.
The Three Jobs the Pilot Is Meant to Do
Coverage of the launch agrees on three practical aims. The first is to strengthen hospital network defences, the basic protections that keep attackers out of clinical and administrative systems. The second is to deploy physical backup devices after an initial incident, so that a hospital whose network is disrupted can still provide critical care rather than diverting patients or reverting entirely to paper. The third is to identify high-risk and legacy devices, older medical and information technology equipment that may no longer receive security updates, and replace them. That third aim addresses a problem peculiar to healthcare: a hospital's network contains not only computers and servers but thousands of connected medical devices, each with its own software lifecycle. At the launch event, HHS Chief Counselor Chris Klomp said the average hospital has more than 26,000 internet-exposed devices on its network, a figure that illustrates why inventorying what is connected is itself a security task.
Who Is Involved, and What Each Side Brings
The companies named across coverage of the launch include Cisco, Cyera, Microsoft, Trellix and Zscaler, with CyberScoop also reporting Abnormal AI and Rilian Partners as participants. Their contributions differ by speciality. Cyera said it would help hospitals inventory their databases so they understand which sensitive systems need protection. Trellix said it would deliver threat detection and response services powered by agentic AI, intended to automate cyberthreat detection and response. Microsoft drew on its experience supporting more than 870 rural hospitals nationwide, according to Becker's Hospital Review. Cisco and Zscaler were named as participants without a detailed public description of their specific services in the coverage reviewed. On the public side, the South Carolina Law Enforcement Division's critical infrastructure cybersecurity initiative is arranging the free services with hospitals, while ONCD and HHS provide the federal coordination and the pilot's national framing.
What Is Not Yet Known
Several basic facts have not been published. Officials did not specify how many South Carolina hospitals will participate in the pilot or identify the facilities selected, according to Becker's Hospital Review. No funding figure for the pilot has been published, since the model relies on in-kind company contributions rather than a federal payment to hospitals. And, as CyberScoop noted, ONCD has not said what will happen at the end of the six-month pilots, whether successful elements will be extended, funded differently, or rolled out to other states. Those gaps do not undermine the launch itself, but they limit what other hospitals can plan around: a facility outside South Carolina cannot yet apply, budget for a successor programme, or know which of the pilot's services will remain available once the six months expire.
What This Means for Small Hospitals
The context for the pilot is a sector under sustained attack. CyberScoop's coverage noted a record year for breaches, with 804 large breaches reported to the HHS Office for Civil Rights last year affecting more than 140 million people, and the FBI identifying healthcare as a top target for ransomware and other hackers in 2025. Rural hospitals face that threat with thinner resources than large systems: smaller IT teams, older equipment and less bargaining power with vendors. For hospitals that are not in the pilot, the three aims still offer a usable checklist, know what is connected to your network, have a tested backup that keeps critical care running when systems fail, and replace equipment that can no longer be secured, and the pilot's results, when published, should show which of those steps proved hardest to deliver in practice. For clinics and small hospitals everywhere, the immediate lesson is less about any single vendor than about inventory: an organisation cannot protect devices it has not counted.
Analysis: A Pilot That Tests Delivery, Not Just Tools
Project Lifeline 250 is best understood as a delivery experiment rather than a technology announcement. The tools involved, network defence, backup hardware, device inventory, are established. The open question is whether a short, company-supplied, state-coordinated intervention can reach hospitals that have historically been hard for both vendors and federal programmes to serve. Six months is a short window for replacing legacy equipment and changing operational habits, and the absence of a published plan for what follows means the pilot's legacy will depend on evaluation as much as on installation. If ONCD publishes participation numbers, services delivered and incident outcomes, other states and hospital associations will have something concrete to copy. If it does not, Lifeline 250 risks joining a long list of well-intentioned pilots whose lessons stayed local. The next reporting milestone to watch is therefore not another launch event, but the first account of what the pilot actually delivered in South Carolina.
Healthcare organisations reviewing their cybersecurity posture, incident response and patient communication workflows can explore MedClinicX's services and request a demonstration via https://medclinicx.com/demo.
Sources and References
- Becker's Hospital Review, White House, South Carolina launch free cybersecurity pilot for rural hospitals, 26 October 2026: https://www.beckershospitalreview.com/healthcare-information-technology/cybersecurity/white-house-south-carolina-launch-free-cybersecurity-pilot-for-rural-hospitals/
- Cybersecurity Dive, US launches program to deliver free cybersecurity help to rural hospitals, 27 October 2026: https://www.cybersecuritydive.com/news/healthcare-cybersecurity-white-house-pilot-program-launch/872872/
- CyberScoop (via Cybernoz), National cyber director rolls out latest pilot in South Carolina, this time for rural hospitals, 28 October 2026: https://cybernoz.com/national-cyber-director-rolls-out-latest-pilot-in-south-carolina-this-time-for-rural-hospitals/
Reporting based on the sources above, accessed 28 October 2026. The Becker's Hospital Review, Cybersecurity Dive and CyberScoop reports were read directly in full and cross-checked against each other. The governor's release is cited as reported by Becker's and Cybersecurity Dive, which both link to and quote it. MedClinicX did not conduct original reporting or interviews for this article. Corrections: contact us via https://medclinicx.com/contact