Health Industry Needs Government Go-To for Cyber Threats, Expert Says

Congress is worried cybersecurity measures aren’t keeping up with technological advances in the health care industry and evolving medical devices, potentially putting millions of Americans at risk.

“The cost of inaction is too great,” said Rep. Frank Pallone, D-N.J., a member of the Energy and Commerce Committee’s Oversight and Investigations subcommittee. The subcommittee convened Tuesday to assess cybersecurity risks in health care and explore the use of more public-private partnerships to combat the problem.

Yet, much of the conversation revolved around just how much the cyber risk has increased in health care.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

“We’ve seen the headlines,” Pallone added, citing more than a dozen “ransomware” attacks on hospitals carried out last year.

In ransomware attacks, hackers exploit a security vulnerability to hold a hospital hostage in exchange for financial gain or other benefits. These attacks are becoming more frequent in part because rural hospitals, which sometimes lack funding of larger health care organizations in urban areas, are proving easier targets.

“The cyber threat surface has ballooned,” said Denise Anderson, president of the National Health Information Sharing and Analysis Center. NHISAC is a community of critical infrastructure owners and operators in the health care sector that shares information regarding cyber threats and mitigation strategies.

“The focus has traditionally been on data and privacy, but if organizations cannot deliver services—as seen in ransomware attacks—or if data is destroyed, the system is at risk,” Anderson said.

Subcommittee Chairman Tim Murphy, R-Pa., admitted government is unlikely to “stop every attack,” but sought solutions to reduce risks as the complexity of modern society grows. The influx and mass sharing of electronic health records and complexity of new internet-connected medical devices will only increase the attack vector further, he said.

Aside from simply promoting the existence of NHISAC and therefore further populating a forum whereby best practices and other relevant data can be exchanged, Anderson said the government would be wise to “establish cyber professionals as liaisons to industry.” In other words, the government and leading health care organizations ought to hire more cyber talent who understand the threats and how to mitigate them.

“Having an established go-to lead in this area is imperative,” said Anderson, adding automation of information sharing between appropriate parties could also improve security. In such a scenario, data regarding an attack—who, what and how of the attack—occurring on a member health care organization would be shared confidentially with other members so they could patch their systems.

Terry Rice, vice president of IT Risk Management at Merck & Co., also called for more cyber talent in government. Rice, who believes the number of attacks on health care organizations is significantly underrepresented, called on the Health and Human Services Department to “appoint a senior cyber executive” to engage as a government-lead in industry.

Rice also called upon HHS to work with federal partners to develop a cybersecurity protection plan for the health care industry. Each of the 16 critical infrastructures in the U.S. is tasked with developing sector-specific plans and updating them every few years, with federal agencies taking the lead role in coordinating those efforts. The health care sector plan, which includes how to deal with everything from “a pandemic flu to health care delivery in natural disasters,” Rice said, only dedicated two pages for its cybersecurity guidance.

“While the material in there is helpful, it needs to be significantly expanded, particularly for small entities that don’t have large security teams or professionals in their organizations,” Rice said.