Funding · Rural Health Transformation Program
The One Big Beautiful Bill Act created the Rural Health Transformation Program: $50 billion distributed to all 50 states over five years, with cybersecurity, IT modernization, and AI named as allowable uses. The work your hospital already needs is the work the program was built to fund. We are not grant writers, but we give your CFO and grant team the scope, the pricing, and the use-of-funds mapping a state application expects.
What it is
The Rural Health Transformation Program (RHTP) was authorized by the One Big Beautiful Bill Act (Public Law 119-21) and is administered by the Centers for Medicare & Medicaid Services. CMS distributes $10 billion a year to approved states across fiscal years 2026 through 2030 ($50 billion in total). All 50 states were approved in late 2025, with first-year awards averaging roughly $200 million each, and the money is now flowing to the states and out to rural providers.
$50B
Total program funding across fiscal years 2026 through 2030, at $10 billion a year.
50
States approved by CMS, with first-year awards averaging roughly $200 million each.
5 yrs
A defined, five-year window. The structure rewards hospitals with a shovel-ready plan, not a wish list.
Does your hospital fit
Rural and critical-access hospitals, Rural Emergency Hospitals, FQHCs, and rural community health systems are the intended recipients. Exact eligibility is defined state by state, but if you are a rural provider facing the threat curve and the compliance curve with an IT team of one to three, you are squarely who this program was written for.
The honest read. This is real money, and the categories that fund security and AI are live in most states, but it is not guaranteed money, and in most states there is no open cybersecurity application to submit today. The play is to get on your state agency’s contact list and get a scoped, audit-ready project in hand now, so you can move the day your state’s technology or security window opens.
What it funds
CMS names technical assistance, software, and hardware for significant IT advances that improve efficiency, enhance cybersecurity capability development, and improve patient outcomes, alongside data sharing, interoperability, and emerging technology. That maps, almost line for line, onto the work we already deliver for rural hospitals.
The CIS-aligned baseline, MFA and Conditional Access, EDR coverage, and a 24/7 SOC, delivered through M365 InstantOn, CompleteCare Foundations, and Shield. “Enhance cybersecurity capability development” is a named use of funds.
Technical assistance, software, and hardware for significant IT advances are allowable: tenant stand-up, email migration off a legacy on-prem server, and identity modernization. Retiring a legacy mail server is textbook removal of high-risk exposure.
Microsoft Purview operated as a HIPAA program (PHI labeling, DLP, and audit retention) through CompleteCare Govern. Protecting and sharing patient data sits at the center of the program’s data-sharing and interoperability goals.
Governed Microsoft 365 Copilot, ambient clinical documentation, and revenue-cycle agents, deployed with HIPAA-aligned governance through Healthcare AI Readiness. “Invest in emerging technologies” is an allowable use.
Most hospitals fund the front door first (an InstantOn security baseline), then grow into the managed platform as the funding and the maturity allow. One scoped project to stand the capability up; a managed service to keep it running and evidenced across the life of the grant.
The play
Because the funds flow through the states on rolling timelines, the constraint is rarely eligibility; it is readiness. The hospitals that win are the ones holding a defined, defensible project the day the application opens. Three moves worth making now, none of which wait on a posted RFP.
Move 1
See the technology and cybersecurity windows the day they post. Your state hospital association’s rural improvement group is usually tracking this closely too.
Move 2
A documented, audit-ready security baseline plus an AI-readiness foundation, with a defined start, finish, and deliverables: the shape reviewers fund.
Move 3
A use-of-funds mapping that ties each line to an allowable category and outcome metric, framed as a security and compliance initiative rather than a routine IT upgrade.
How it works in your state
Every state runs its own implementation, with its own initiatives, application mechanism, and deadlines. The shape is consistent (funds flow from CMS to the state health agency, then out to rural providers through state-run applications), but the specifics differ. Two live examples:
Georgia
Georgia runs its implementation as the GREAT Health Program, organized around five initiatives (one of them squarely about technology, cybersecurity, and data sharing), distributed to rural providers through the state.
Utah
Utah was awarded roughly $195 million in first-year funding, distributed through the state health agency via provider applications, with cybersecurity risk assessments, threat detection, and technical assistance named in the state’s plan.
Two things to confirm with your state before you budget. First, the procurement pathway: whether your hospital can direct grant dollars to a vendor of choice for the cyber and IT work, or whether that work routes through a state-designated program. Second, the deadline for the specific window you are targeting. Both decide whether a quote is even usable in your application, and both are answerable with a single call to your state agency.
How we help
The constraint on a strong application is rarely the narrative; it is having a defensible scope, a credible price, and a use-of-funds story that ties each engagement to the program’s allowable categories, ready before the window opens. That is the part we own.
A documented, audit-ready InstantOn or CompleteCare engagement with defined deliverables: the kind of project a reviewer can fund and a grant officer can defend.
Clear one-time and ongoing costs your CFO can drop into a budget line, with licensing broken out separately and the nonprofit and rural-hospital discounts noted.
Each engagement tied to a named allowable category and the program’s own outcome metrics, in the language a state application expects: the same package we build for the hospitals we already work with.
This is separate from the Microsoft Rural Hospital Resiliency Program, and the two stack. RHTP is government grant money your state distributes; the Microsoft Rural Hospital Resiliency Program is Microsoft’s philanthropic licensing and tooling. A hospital can fund the managed-service and project work through RHTP while taking the Microsoft discounts on the licenses underneath. We help you map each piece of work to the right funding source. For the full rural-hospital practice (HIPAA-aligned managed services, the 24/7 SOC, and governed AI), see rural hospitals.
Questions
RHTP is a $50 billion federal program authorized by the One Big Beautiful Bill Act (Public Law 119-21) and administered by CMS. It distributes $10 billion a year to approved states across fiscal years 2026 through 2030. All 50 states were approved, with first-year awards averaging roughly $200 million each. States, not individual hospitals, are the grantees, and they distribute the funds to rural providers under approved plans.
Rural and critical-access hospitals, Rural Emergency Hospitals, FQHCs, and rural community health systems are the intended recipients, though exact eligibility is defined state by state. CMS names technical assistance, software, and hardware for significant IT advances that improve efficiency, enhance cybersecurity capability development, and improve patient outcomes among the allowable uses, alongside data sharing, interoperability, and emerging technology including AI.
Not directly from the federal government. CMS awards the funds to states, and each state distributes them to rural providers through its own application process: typically requests for proposals or grant applications run by the state health agency, on rolling windows. The hospitals that win are usually the ones with a scoped, shovel-ready project already in hand when their state’s technology or cybersecurity window opens.
No. Centered Networks is not a grant writer. We give your CFO and grant team what they need to build the technology and security portion of the application: a defensible scope, indicative pricing, and a use-of-funds mapping that ties each engagement to the program’s allowable categories and outcome metrics, in the language a state application expects.
Tell us where your hospital is today and we will map the work to the program’s allowable categories with indicative pricing your grant team can use, and flag the two questions to confirm with your state. No grant-writing fee, no obligation.
Prefer to read first? The field note on what the program funds walks the whole picture, and the rural hospital practice shows the managed services underneath.
A senior member of our team will reply within one business day to help you scope a fundable project and map it to your state’s program.
This page is general information about a public funding program, not legal, tax, or grant-compliance advice. Confirm allowable uses, eligibility, and procurement rules with your state’s administering agency before relying on them.