[{"innerBlocks":[],"name":"core\/freeform","postId":126425,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Federal attention has been rising to the high risks of cybersecurity threats facing the healthcare industry, showing rising government concern about\u2014and attention being paid to\u2014vulnerabilities that providers and payers face.

As awareness grows of these vulnerabilities, it will become increasingly important for the healthcare industry to step up its game\u2014given the centrality of cyber to healthcare, healthcare entities must ensure that their systems are up to date and that proper cybersecurity measures are in place.

Earlier this month, the House of Representatives Committee on Energy and Commerce Subcommittee on Oversight and Investigations held a hearing to discuss strategies for addressing cybersecurity. Steve Curren, director for the division of resilience within the Department of Health and Human Services testified that, \u201cin the past five years, few infrastructure issues have challenged the healthcare and public health sector. . . more than cybersecurity.\u201d

Noting that cybersecurity is both \u201ca direct and a secondary threat\u201d since it \u201ccan impact everyday patients and healthcare delivery by locking down access to power, important medical information and life-saving equipment,\u201d Curren stated that cybercrime can also \u201cexacerbate an existing emergency when hospitals, EMS, and emergency first responders are already working at a frantic pace to save lives and cannot afford to lose access to communications or risk further delays in their response.\u201d

The House Subcommittee hearing came on the heels of the release of the long-awaited HHS Health care Industry Cybersecurity Task Force report, which established six high-level imperatives by which to organize its recommendations and action items to increase security within the healthcare industry:

Define and streamline leadership, governance, and expectations for health care industry cybersecurity.<\/li>
Increase the security and resilience of medical devices and health IT.<\/li>
Develop the health care workforce capacity necessary to prioritize and ensure cybersecurity awareness and technical capabilities.<\/li>
Increase health care industry readiness through improved cybersecurity awareness and education.<\/li>
Identify mechanisms to protect R&D efforts and intellectual property from attacks or exposure.<\/li>
Improve information sharing of industry threats, risks and mitigations. <\/li><\/ol>
Also See:<\/b> Panel urges quick, decisive action on cybersecurity<\/a>

The timing of both the House hearing and the release of the HHS Task Force Report was particularly important, as they came on the heels of the unprecedented WannaCry global ransomware attack, which infected more than 200,000 computer systems in 150 countries. While U.S. healthcare entities largely escaped unscathed, the WannaCry attack temporarily crippled the National Health Service in Great Britain, impacting patient care by locking doctors and nurses out of patient records, requiring providers to cancel surgeries, X-ray sessions and other nonemergency services, as well as hospitals to divert ambulances to other nearby hospitals.

Additionally, over the past few months, the FBI has stepped up its messaging. For instance, in March, the FBI issued guidance specifically applicable to medical and dental facilities regarding cybercriminals targeting File Transfer Protocol (FTP) services operating in \u201canonymous mode\u201d to compromise protected health information.

Also See:<\/b> FBI warns healthcare organizations to check FTP servers<\/a>

Similarly, in May, then-FBI Director James Comey spoke before the American Hospital Association regarding the FBI\u2019s ability to combat cyber-attacks. He cited ransomware as the top cyber threat confronting health systems today and urged hospital leaders and health systems to report attacks to FBI and government officials, instead of automatically paying ransoms, noting that \u201cPaying up is ultimately harmful because it encourages cybercriminals to keep targeting healthcare organizations.\u201d Comey also encouraged hospital leaders and health systems to maintain backup systems to protect valuable patient data.

While all industries face an increasing threat of attacks on their information systems, healthcare systems are prime targets for computer hacking and ransomware, and the attacks on healthcare systems are rapidly accelerating. Healthcare systems are vulnerable to hacking because of the value of multiple kinds of information held within those systems, and healthcare organizations\u2019 obligation to protect that data.

Under U.S. law, protected health information can be any information about an individual\u2019s health status, the provision of healthcare or payment for healthcare that is created or collected by a \u201ccovered entity,\u201d and that can be linked to a specific individual, including a patient\u2019s medical record or payment history. Therefore, a covered entity\u2019s inability to access a patient\u2019s PHI because of a ransomware attack is not only a financial inconvenience for the covered entity, but is also a matter of life or death for patients. Additionally, by obtaining PHI, cybercriminals not only jeopardize patient care, but also may use PHI to commit a wide variety of complex financial crimes. For example, in one case investigated by the FBI, cybercriminals opened health savings accounts and used that money to purchase a variety of goods.

The lasting impact of WannaCry remains a heightened awareness to the prevalence and destructive capability of these attacks, and serves as a strong reminder to the healthcare industry of the necessity of prioritizing the security of their computer systems. Indeed, experts on the issue have stated that the WannaCry attack provides an example of how unprepared healthcare is to defend itself.

HHS also has recently released a useful quick-response cyber-checklist to assist and provide advice on how to best respond to cyberattacks.

Also See: Hit by a data breach? 5 steps you must take<\/a>

This guidance recommends taking the following steps:
Execute response and mitigation procedures so as to stop the incident from occurring.<\/li>
Report the crime to law enforcement agencies.<\/li>
Report \u201ccyber threat indicators\u201d to federal and information-sharing and analysis organizations.<\/li>
If the breach affects 500 or more individuals report the breach to OCR no later than 60 days following discovery of the breach in accordance with HIPAA breach notification requirements.<\/li><\/ul>
Rising federal attention will place an increased spotlight on the healthcare industry to protect PHI more carefully and take steps that show data security is being handled in a thorough and responsible manner.","saveContent":"Federal attention has been rising to the high risks of cybersecurity threats facing the healthcare industry, showing rising government concern about\u2014and attention being paid to\u2014vulnerabilities that providers and payers face.

As awareness grows of these vulnerabilities, it will become increasingly important for the healthcare industry to step up its game\u2014given the centrality of cyber to healthcare, healthcare entities must ensure that their systems are up to date and that proper cybersecurity measures are in place.

Earlier this month, the House of Representatives Committee on Energy and Commerce Subcommittee on Oversight and Investigations held a hearing to discuss strategies for addressing cybersecurity. Steve Curren, director for the division of resilience within the Department of Health and Human Services testified that, \u201cin the past five years, few infrastructure issues have challenged the healthcare and public health sector. . . more than cybersecurity.\u201d

Noting that cybersecurity is both \u201ca direct and a secondary threat\u201d since it \u201ccan impact everyday patients and healthcare delivery by locking down access to power, important medical information and life-saving equipment,\u201d Curren stated that cybercrime can also \u201cexacerbate an existing emergency when hospitals, EMS, and emergency first responders are already working at a frantic pace to save lives and cannot afford to lose access to communications or risk further delays in their response.\u201d

The House Subcommittee hearing came on the heels of the release of the long-awaited HHS Health care Industry Cybersecurity Task Force report, which established six high-level imperatives by which to organize its recommendations and action items to increase security within the healthcare industry:
Define and streamline leadership, governance, and expectations for health care industry cybersecurity.<\/li>
Increase the security and resilience of medical devices and health IT.<\/li>
Develop the health care workforce capacity necessary to prioritize and ensure cybersecurity awareness and technical capabilities.<\/li>
Increase health care industry readiness through improved cybersecurity awareness and education.<\/li>
Identify mechanisms to protect R&D efforts and intellectual property from attacks or exposure.<\/li>
Improve information sharing of industry threats, risks and mitigations. <\/li><\/ol>
Also See:<\/b> Panel urges quick, decisive action on cybersecurity<\/a>

The timing of both the House hearing and the release of the HHS Task Force Report was particularly important, as they came on the heels of the unprecedented WannaCry global ransomware attack, which infected more than 200,000 computer systems in 150 countries. While U.S. healthcare entities largely escaped unscathed, the WannaCry attack temporarily crippled the National Health Service in Great Britain, impacting patient care by locking doctors and nurses out of patient records, requiring providers to cancel surgeries, X-ray sessions and other nonemergency services, as well as hospitals to divert ambulances to other nearby hospitals.

Additionally, over the past few months, the FBI has stepped up its messaging. For instance, in March, the FBI issued guidance specifically applicable to medical and dental facilities regarding cybercriminals targeting File Transfer Protocol (FTP) services operating in \u201canonymous mode\u201d to compromise protected health information.

Also See:<\/b> FBI warns healthcare organizations to check FTP servers<\/a>

Similarly, in May, then-FBI Director James Comey spoke before the American Hospital Association regarding the FBI\u2019s ability to combat cyber-attacks. He cited ransomware as the top cyber threat confronting health systems today and urged hospital leaders and health systems to report attacks to FBI and government officials, instead of automatically paying ransoms, noting that \u201cPaying up is ultimately harmful because it encourages cybercriminals to keep targeting healthcare organizations.\u201d Comey also encouraged hospital leaders and health systems to maintain backup systems to protect valuable patient data.

While all industries face an increasing threat of attacks on their information systems, healthcare systems are prime targets for computer hacking and ransomware, and the attacks on healthcare systems are rapidly accelerating. Healthcare systems are vulnerable to hacking because of the value of multiple kinds of information held within those systems, and healthcare organizations\u2019 obligation to protect that data.

Under U.S. law, protected health information can be any information about an individual\u2019s health status, the provision of healthcare or payment for healthcare that is created or collected by a \u201ccovered entity,\u201d and that can be linked to a specific individual, including a patient\u2019s medical record or payment history. Therefore, a covered entity\u2019s inability to access a patient\u2019s PHI because of a ransomware attack is not only a financial inconvenience for the covered entity, but is also a matter of life or death for patients. Additionally, by obtaining PHI, cybercriminals not only jeopardize patient care, but also may use PHI to commit a wide variety of complex financial crimes. For example, in one case investigated by the FBI, cybercriminals opened health savings accounts and used that money to purchase a variety of goods.

The lasting impact of WannaCry remains a heightened awareness to the prevalence and destructive capability of these attacks, and serves as a strong reminder to the healthcare industry of the necessity of prioritizing the security of their computer systems. Indeed, experts on the issue have stated that the WannaCry attack provides an example of how unprepared healthcare is to defend itself.

HHS also has recently released a useful quick-response cyber-checklist to assist and provide advice on how to best respond to cyberattacks.

Also See: Hit by a data breach? 5 steps you must take<\/a>

This guidance recommends taking the following steps:
Execute response and mitigation procedures so as to stop the incident from occurring.<\/li>
Report the crime to law enforcement agencies.<\/li>
Report \u201ccyber threat indicators\u201d to federal and information-sharing and analysis organizations.<\/li>
If the breach affects 500 or more individuals report the breach to OCR no later than 60 days following discovery of the breach in accordance with HIPAA breach notification requirements.<\/li><\/ul>
Rising federal attention will place an increased spotlight on the healthcare industry to protect PHI more carefully and take steps that show data security is being handled in a thorough and responsible manner.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

Why federal worry over cyberattacks puts pressure on providers

More for you