He US Department of Health and Human Services (HHS; Washington, DC) published a concept paper, “Healthcare Cybersecurity: An Introduction to the U.S. Department of Health and Human Services Strategy.The resource outlines four new ongoing steps HHS plans to take to improve cybersecurity for the healthcare sector.
Cyberattacks in the healthcare sector are increasing, according to the HHS Office of Civil Rights (OCR). Between 2018 and 2022, there was a 93 percent increase in large breaches reported to OCR, with a 278 percent increase in large ransomware-related breaches.
To help address these risks, HHS introduced four pillars of action:
- Publish voluntary cybersecurity performance objectives (CPG HPH) for the health and public health sector. HHS will publish HPH CPGs to help healthcare institutions plan and prioritize implementation of high-impact cybersecurity practices.
- Provide resources to encourage and implement cybersecurity practices.. HHS will work with Congress [first reference correct?] obtain new authority and funding to administer financial support and incentives for national hospitals to implement high-impact cybersecurity practices.
- Implement an HHS-wide strategy to support increased law enforcement and accountability. HHS will propose new applicable cybersecurity standards, informed by HPH CPGs. These standards will be incorporated into existing programs, including Medicare and Medicaid and the Health Insurance Portability and Accountability Act Security Rule.
- Expand and develop a one-stop-shop for cybersecurity for the healthcare sector within the Administration for Strategic Preparedness and Response (ASPR). This entity will improve coordination between HHS, the federal government and the healthcare industry; improve access and acceptance of government support and services; and increase HHS incident response capabilities.
The concept paper is based on National Cybersecurity Strategy that President Biden released last year, specifically focusing on strengthening the resilience of hospitals, patients, and communities threatened by cyberattacks.
For more information go here.
