This report examines how resource-constrained health care systems – small, rural, critical access, family clinics, skilled nursing facilities, FQHCs and many more across the country – are only marginally prepared for ongoing cyber threats to clinical care and operational liquidity, and recommends forms of support they would need against stiffer cybersecurity regulatory requirements.