Cybersecurity & Healthcare: Does Cybersecurity Act Help or Hurt?

February 12, 2016

Jay Trinckes

There’s been a lot of talk about the new Cybersecurity Act of 2015, but does Section 405: Improving Cybersecurity in the Healthcare Industry really do enough?  While the bill is a welcome start to help lower cybersecurity risks, the improvements do not do enough to protect us from the compromise of sensitive information.

Within 90 days of the bill’s passage, a healthcare industry task force will be established by the Secretary of the Department of Health and Human Services (HHS) in consultation with the Director of the National Institute of Science and Technology (NIST) and the Secretary of the Department of Homeland Security.  This task force of healthcare industry stakeholders, cybersecurity experts, and related federal agencies has six responsibilities:

  1. Analyze how other industries have implemented safeguards for protecting data. This is nothing new. There is a lot of information already available such as the safeguards found in the financial services industry (FFIEC/GLBA) and government (FedRAMP/FISMA).
     
  2. Analyze the challenges and barriers private healthcare organizations facewhen securing data.Rather than focusing only on the private sector, the Cybersecurity Act of 2015 should require that all entities within the healthcare industry are secured, especially government entities.  Two challenges/barriers that the task force can start with are the financial resources allocated to security and the lack of security experts within healthcare.
     
  3. Review challenges involvedwith securing networked medical devices and other software or systems that connect to an electronic health record. This should be expanded to include government oversight agencies such as the Food and Drug Administration (FDA), which is charged with overseeing voluntary – not mandatory – compliance to medical device security standards.
     
  4. Disseminate information to healthcare-industry stakeholders of all sizes about improving preparedness for, and response to, cybersecurity threats.
     
  5. Establish a plan for government and healthcare-industry stakeholders to share actionable cyber-threat indicators and defensive measures in real time.
     
  6. Report findings and recommendations to Congress.