Healthcare cybersecurity is no walk in the park! Today, we explore the release of the “Health Industry Cybersecurity Recommendations for Government Policy and Programs” by HSCC. It provides suggestions and ideas on how government policy and programs can support the health sector in beefing up their cybersecurity defenses to help keep our health systems safe from cyber threats.
In this episode:
Where do we go from here? – Ep 413
Today’s Episode is brought to you by:
Kardon
and
HIPAA for MSPs with Security First IT
Subscribe on Apple Podcast. Share us on Social Media. Rate us wherever you find the opportunity.
Great idea! Share Help Me With HIPAA with one person this week!
Learn about offerings from the Kardon Club
and HIPAA for MSPs!
Thanks to our donors. We appreciate your support!
If you would like to donate to the cause you can do that at HelpMeWithHIPAA.com
Like us and leave a review on our Facebook page: www.Facebook.com/HelpMeWithHIPAA
If you see a couple of numbers on the left side you can click that and go directly to that part of the audio. Get the best of both worlds from the show notes to the audio and back!
Thanks to our donors.
HIPAA Say What!?!
[03:41]Snooping in Medical Records by Hospital Security Guards Leads to $240,000 HIPAA Settlement | HHS.gov
Yakima Valley Memorial Hospital Resolution Agreement and Corrective Action Plan | HHS.gov
— OCR Director, Melanie Fontes Rainer
- Conduct an accurate and thorough risk analysis to determine risks and vulnerabilities to electronic protected health information;
- Develop and implement a risk management plan to address and mitigate identified security risks and vulnerabilities identified in the risk analysis;
- Develop, maintain, and revise, as necessary, its written HIPAA policies and procedures;
- Enhance its existing HIPAA and Security Training Program to provide workforce training on the updated HIPAA policies and procedures;
- Review all relationships with vendors and third-party service providers to identify business associates and obtain business associate agreements with business associates if not already in place.
Where do we go from here?
[19:21]An Illinois hospital is the first health care facility to link its closing to a ransomware attack
With the news of closings like this hospital and others who struggle to survive still today, we have to reflect on the landscape report we just reviewed a few episodes ago. The report focused on hospitals, which we do not claim to have the same depth of knowledge as we do the rest of the sector. However, this hospital closure impacts all the other health sector entities tied to it. This is exactly why we worry about the impacts of a single cyber attack on the entire community.
HSCC published a document of recommendations in April based on the findings of the analysis and input from plenty of stakeholders.
Health Industry Cybersecurity Recommendations for Government Policy and Programs – April 2023
This imperative is addressed through both cybersecurity regulation and policy, and voluntary practices implemented across the healthcare ecosystem. It is clear that, given the increasing number and techniques of cyber incidents inflicted on the health system, neither voluntary practices nor government policy have been sufficient to reduce cyber risk and incidents across the sector.
The Health Sector Coordinating Council Cybersecurity Working Group assesses that enhanced governmental programs and policy could offset the cost of existing cybersecurity regulatory requirements with a coordinated and coherent approach to the reduction of cybersecurity risk in the health sector. Particular attention should be paid to smaller health institutions that remain vulnerable targets but do not have the resources or expertise to comply with existing or proposed cybersecurity regulations, or to implement voluntary practices to shore up up their cyber defenses, because of increasing financial, workforce and compliance costs associated with clinical priorities.
- Preparedness Support and Information Sharing
- Financial Support and Incentives
- Incident Response and Recovery
- Workforce
- Regulatory Reform
We are going to run through some of the points that got our attention in each of those categories.
Preparedness Support and Information Sharing
They mention the use of the resources published on the 405d website and the HSCC, Health-ISAC and HSCC as additional resources to coordinate together in an outreach campaign. Yes we have to increase awareness of what is available and continue to educate.
This would be very helpful to allocate resources specifically for collecting and evaluating impacts specifically around the health sector and coordinate with CISA.
So many assume that this sector is just like all the others. Having been in this for so long and talked to so many who join the sector after being in others, I assure you that there are deep rooted differences that you do not notice until you look under the hood.
There are so many fingers in the pie and so many moving parts to coordinate along the way just to meet the requirements for patient care. It is broad and deep. Data rich and cyber poor too. A filter is very necessary to organize all of the different threats in ways that apply to the environment.
Favorite idea here! Until the conversations are raised regularly to leadership in all organizations we know we will never get the attention and funding needed until things fall apart. That goes for HHS just like any other. We would love to gather more data on the performance of the sectors dealing with cyber security. Just like anything else without funding no data will be found.
Very interesting approach here to help deal with supporting the organizations when they are attacked. This is a community crisis as we have started to document well. One case in OKC with the allergy clinic’s impact on other clinics in the area. We have confirmed stats that show one hospital impacted by an attack may contain the blast radius of the cyber attack within their organization. However, the residual fallout from that blast hits all the surrounding systems to catch the overflow created.
This calls for being able to activate FEMA and other government support services to help. PLUS, funding agencies to actually help enhance the resilience of organizations. We discuss all of the time the need to have detailed response and recovery plans.
It also calls for funding responses including human, technical and financial support to the victim orgs in high impact attacks.
There’s a lot of discussion about approaches to cyber insurance. That is a whole other mess
Financial Support and Incentives
[44:39]This has to be part of the mix somewhere but not sure how.
This would be a big help when some new zero day or actively attacked vulnerabilities require a lot of time, people and/or tools to mitigate as quickly as needed.
Incident Response and Recovery
[47:42]We know well how complicated it can be to meet all the requirements of checks and balances to publish anything from government resources. The suggestions here are trying to find a way we can speed it up with involvement of designated.
Dealing with cyber coverage issues and the pricing explosion for that coverage from private carriers is definitely touched on by several points in this section too.
Workforce
[52:56]Consider authorizing a funded, subsidized “civilian cyber health corp”. This could take the form of loan forgiveness; i.e. a Federal program pays / helps pay for a cyber education in exchange for a minimum number of years served, modeled after a uniformed health corp.
There are some other ideas in the section too. Definitely need to encourage going into these fields but so many people see cyber security jobs as just technical nerds should apply. They are so far from the reality of the situation. Just like everything else we need to educate people to get cyber security education and encourage others to seek out cyber security careers.
Regulatory Reform
[56:53]This brings us back to where we started. The healthcare environment is very interconnected yet subject to all these different rules and regulations based on the structure of the organizations and where they are located.
The last one in the section – great idea but I have no idea how it could be done.
As we have said for years – there is no doubt we are and have been under attack in healthcare. Also, we have so many areas where the gaps are very wide, making it so hard to solve the problems that could mitigate the damages we see. We have to make a plan going forward with some new approaches because what we have been doing is clearly not working. However, we also need to address why those things haven’t worked in order to prevent more efforts that only gain inroads a little at a time.
One key reason we are where we are, IMHO, is the original security rule implementation had zero enforcement. No incentives to get things in order. Had we done that back then we would definitely have a whole different landscape today. Unless the business is forced to invest or seriously incentivised to invest it really doesn’t seem to work no matter how many ideas are in place.
These suggestions may work well in larger organizations which we absolutely need. However, the smaller entities have even more limitations on resources and are spread even thinner than the larger ones. Rural ones without access to talent are only exacerbating the problems they face. We may need to take a whole different approach for those entities with their own subset of resources and tools.
Remember to follow us and share us on your favorite social media site. Rate us on your podcasting apps, we need your help to keep spreading the word. As always, send in your questions and ideas!
HIPAA is not about compliance,
it’s about patient care.TM
Special thanks to our sponsors Security First IT and Kardon.
