The American Hospital Association is urging Congress to address cybersecurity gaps involving AI vendors and other third parties that handle patient information, warning that hospitals cannot defend against threats across the healthcare sector alone.
In a Sept. 30 statement submitted ahead of a Senate subcommittee hearing titled “Rogue AI: Securing the Homeland Against AI Agent Attacks,” the AHA called for entities that hold or process protected health information but fall outside HIPAA to face similarly rigorous privacy and security standards.
The association said those gaps could include certain AI vendors that do not meet the law’s definition of covered entities or business associates. While AI offers opportunities to improve efficiency and care quality, the large data sets that support the technology may also pose cybersecurity risks, according to the statement.
“We believe third parties handling health information should be held to the same privacy and security standards as covered entities and business associates,” the AHA said.
The association also warned that nation-states and criminal hackers are beginning to use AI to identify software vulnerabilities and rapidly develop and deploy malware. Citing FBI figures, the AHA said healthcare experienced 460 reported ransomware attacks in 2025, more than any other critical infrastructure sector.
The AHA urged Congress to call on federal agencies to deploy a sustained offensive cyber strategy to protect hospitals and patients. It pointed to the FBI’s Operation Riptide as an example, saying the campaign has dismantled hackers’ technical infrastructure, seized illicit proceeds and led to arrests and extraditions.
Rural hospitals face additional challenges, including limited funding, aging technology and difficulty recruiting cybersecurity professionals, the association said. Ransomware attacks that force rural hospitals to divert patients and ambulances can also delay critical care.
The AHA expressed support for legislation to strengthen the rural hospital cybersecurity workforce through training and partnerships, along with workforce grants and retention efforts, particularly those focused on retraining veterans.
