Rural health transformation money runs on three clocks, and only two of them come with funding

The week

The July 2025 budget reconciliation law created the Rural Health Transformation Program: $10 billion a year for five federal fiscal years, 2026 through 2030. CMS announced first-year awards on December 29, 2025, approving all 50 states, with amounts from about $147 million for New Jersey to $281 million for Texas, according to KFF. Half of each year’s money is split equally and half is allocated using factors CMS sets, including rurality and state policy commitments. Fiscal 2027, the program’s second year, began on October 1, 2026. According to KFF’s summary of the CMS timeline, states had until October 30 to obligate their first-year funds and until September 30, 2027 to spend them. CMS was due to announce second-year allocations by October 31. Technology, including telehealth, remote monitoring, data exchange and cybersecurity, was one of the program’s permitted uses.

Rural hospitals and clinics are among the least resourced health care organizations in technology and security. Many run older EHRs, rely on one managed service provider and cannot recruit security staff. The program is a large, fast infusion of money with technology as an explicit use. Its timing rules are unusually tight. Each award runs on three clocks: an obligation clock, a spending clock and a sustainment clock. The first two are set by CMS and come with money attached. The third starts when the money stops, and nothing in the program funds it. Decisions made to beat the first clock largely determine what happens on the third. States and providers should confirm allowable uses and deadlines with CMS and their state program offices.

The obligation clock

Obligation means a binding commitment: an executed contract, a sub-award or an order. Funds not obligated in time can be deducted from later awards or redistributed, according to state summaries of CMS guidance. States reached the October deadline at very different speeds. Some issued competitive sub-awards to providers. Others met it by committing money to other state agencies for later distribution.

Deadline pressure favors certain kinds of purchase. Off-the-shelf subscriptions sold provider by provider are quick to contract. Shared platforms, which need governance, an operator and agreements among many participants, are slow. A state that obligates fast through dozens of small, separate technology purchases may meet the date and leave each rural hospital with another system to run alone.

There are ways to keep speed without that fragmentation. A state can obligate funds to an entity able to run a shared service, such as a health information exchange, a hospital association or a rural health cooperative. Conditions can follow: a service catalog, a governance board that includes participating providers and published service levels. A cooperative purchasing agreement that participants join over time also counts as one contract. The aim is to make the binding commitment early while keeping the design choices open.

The spending clock

First-year money must be spent by September 30, 2027. That is a short window for technology that touches clinical workflow. Telehealth, remote monitoring and EHR changes need configuration, training and integration with billing before they deliver anything. CMS also limits some uses. Under the funding notice as KFF summarizes it, replacing an EHR that already met federal certification standards is capped at 5 percent of an award, provider payments at 15 percent and administration at 10 percent.

Implementation capacity is therefore the binding constraint, not funding. Rural hospitals have few staff to absorb new projects while running the old systems. Grants that pay for software but not for implementation time will be spent on licenses that sit partly unused. Budgets should fund project management, training and backfill for clinical staff during go-live, and states should ask for milestone reporting that measures use as well as spending.

Cybersecurity fits this clock unusually well. Services such as managed detection and response, phishing-resistant authentication and tested offline backups can be stood up within months and benefit from regional scale. HHS’s voluntary Cybersecurity Performance Goals, published in January 2024, give states a ready baseline. A state can define the essential goals as the minimum for every participating provider and fund a shared service to meet them. Adoption against the goals is also a measure CMS reporting can use.

The sustainment clock

The last annual award is for fiscal 2030. After the money runs out, recurring costs fall on providers or states. These include licenses, cloud subscriptions, managed services and the staff hired to use them. Rural hospitals with thin margins are poorly placed to absorb them.

Contracts signed now can soften that cliff. Post-grant pricing can be fixed for a period after the program ends, with the price stated in the contract, not left to renegotiation. Participants should have the right to leave a shared service without penalty and take their data in a usable format. Pricing for shared platforms can be set per participant, so costs fall as more providers join. Business cases should name the source of post-grant funding for each service. Candidates include reimbursement for remote monitoring or telehealth, measured operating savings, or a line in the state budget. A service with no named source should be redesigned before it is bought.

People need the same test as software. Telehealth coordinators, care managers who respond to remote monitoring alerts and the analysts who run a shared data service are often hired with grant money. If their salaries have no successor funding, the technology they support will outlast its usefulness. Each staffing line should carry the same post-grant plan as each license, reviewed yearly by the state program office.

Ownership is the sustainment question in another form. A shared platform needs an owner with the authority, staff and funding to run it after 2030, as well as the money to buy it now. States that fund the operator’s running costs during the grant years, and require a plan to recover them later, have the best chance of a service that outlasts the program.

With hindsight

As of mid-October 2026, CMS has not yet announced second-year allocations, which it said would come by the end of the month. Reporting through the summer and early autumn described states moving at very different speeds. Some were still in planning or budget negotiations, while others had issued sub-awards. Advisory firms noted that some states met the obligation deadline by committing funds to other state agencies for later distribution. That approach meets the date but defers the design questions set out here. It is too early to judge results. The sustainment problem has not gone away, because the statute provides no funding after fiscal 2030. States and providers should follow CMS guidance on allowable uses and reporting, and confirm deadlines with their state program offices.