Should Government Play a Bigger Role in Healthcare Cybersecurity?

According to a 2023 report by the US Cyber Threat Intelligence Integration Center, the number of cyberattacks on the healthcare sector doubled in 2023 from the year prior. So far in 2024 that accelerated trajectory shows no sign of slowing down.

The incident at Change Healthcare and the downstream impact it had on the entire healthcare sector was yet another wake-up call for the industry. We need to do more to protect the vital healthcare infrastructure and ecosystem. However, with healthcare revenues under pressure and operational costs rising, healthcare organizations are struggling to dedicate resources to cybersecurity.

In light of that, many have wondered whether the government has a role to play in healthcare cybersecurity.

To get an answer to that question, and to several other healthcare cybersecurity challenges, we asked Ty Greenhalgh, Industry Principal at Medigate by Claroty. Here are his responses.

What role does the government have, if any, when it comes to healthcare cybersecurity? 

The government maintains a balance in healthcare cybersecurity by enforcing regulations like the Health Insurance Portability and Accountability Act (HIPAA) to safeguard patient data, while also providing guidance, resources, and support to help organizations improve their security. They avoid over-regulation by promoting industry best practices and allowing flexibility in compliance, ensuring accountability through penalties and incident response coordination to prevent breaches without hindering innovation or overloading providers.

Recently, the U.S. Department of Health and Human Services (HHS) launched a $50 million program to enhance cybersecurity tools for hospitals, addressing the urgent need to counter digital threats in the healthcare sector. This initiative is part of a broader government effort to bolster healthcare cybersecurity through various means, including funding, regulation, prevention, and coordination. Agencies like HHS and the Cybersecurity and Infrastructure Security Agency (CISA) play crucial roles by providing guidelines and regulatory frameworks, such as the Healthcare and Public Health (HPH) Cybersecurity Performance Goals (CPGs). These guidelines help organizations improve their cybersecurity posture with actionable measures and best practices.

The government also supports cybersecurity advancements and research through programs like the Cybersecurity Grant Program. Efforts to prevent cyber threats include promoting best practices, conducting threat assessments and fostering public-private partnerships for intelligence sharing and coordinated responses. By establishing regulations and offering resources, the government aims to strengthen the cybersecurity defenses of healthcare organizations and protect sensitive patient information.

What other information would be helpful to disclose in a healthcare breach notification so that there is more knowledge shared that could lead to improvements across the healthcare industry? (For example, retailers share theft data to help curb losses across their industry)

Providing detailed information about the attack vector, including how the breach occurred—whether through phishing, ransomware, or vulnerabilities in devices or software—would be beneficial. This should encompass the initial point of entry, how the attacker moved laterally through the network, and a timeline that covers the breach, the response actions taken, and when the situation was resolved. It would also be important to address any delays in detection and their causes. Identifying which systems were compromised, such as EHRs, patient portals, financial systems, email, or IoT devices, is crucial.

In addition to notifying affected individuals, healthcare breach notifications could benefit from including detailed information on the nature and scope of the breach, such as the specific vulnerabilities exploited, and the types of data compromised.

Transparency about how the breach occurred, including the tactics and techniques used by attackers, would provide valuable insights for other healthcare providers to bolster their own security measures.

Including information on the response actions taken, lessons learned and the steps being implemented to prevent future breaches could also aid in improving industry-wide practices. Just as retailers analyze thefts to enhance security measures, sharing such comprehensive details can help other organizations identify and address similar vulnerabilities, strengthening overall cybersecurity resilience across the healthcare sector.

What are two signs that a healthcare organization may need a third party cybersecurity partner?

Two key signs that a healthcare organization may need a third party cybersecurity partner include a lack of in-house expertise and a high volume of security incidents. A major risk to the healthcare sector is the shortage of skilled cyber talent, which can leave organizations vulnerable to attacks. If an organization struggles to maintain a team with specialized skills in cybersecurity or if its existing staff is overwhelmed by the complexity and volume of cyber threats, engaging a third party partner can provide the necessary expertise and resources. Additionally, frequent security incidents or breaches may indicate inadequate internal security measures, making it prudent to seek external support to enhance defenses, manage incident responses, and implement robust security protocols.

Considering recent incidents, like the one at UnitedHealth Group’s Change Healthcare unit, what are the primary challenges healthcare providers face in managing breach notifications internally, and how might delegating this responsibility to third parties alleviate these burdens?

Healthcare providers face several primary challenges in managing breach notifications internally, including the administrative burden, resource constraints and the need for timely and accurate communication. The process of identifying affected individuals, preparing and sending notifications, and addressing follow-up inquiries can be both time-consuming and costly, diverting resources away from patient care and core functions. Additionally, the cost and resources necessary for breach notifications further strain already under-resourced organizations, impacting their ability to bolster security practices and defenses. Delegating this responsibility to the third parties who are the source of the breach can help alleviate these burdens. These third parties are often equipped with specialized expertise and streamlined processes for handling notifications efficiently. They can ensure compliance with regulatory requirements, reduce the administrative load on healthcare staff, and allow providers to focus on remediation and improving their cybersecurity posture.

Given the specialized expertise required for effective breach notifications and the strain on healthcare resources, what are the key advantages of having third party entities manage and coordinate breach notifications, particularly in terms of regulatory compliance and maintaining patient trust?

Having third party entities manage and coordinate breach notifications offers several key advantages, particularly in terms of regulatory compliance and maintaining patient trust. Third party experts bring specialized knowledge and experience to handle notifications in a manner that meets regulatory requirements and minimizes legal risks. They can efficiently manage the complex and time-sensitive aspects of breach communications, ensuring that notifications are accurate and timely. Moreover, third parties can provide clear and consistent communication, helping to maintain patient trust and transparency during the breach resolution process. By handling these responsibilities, third parties enable healthcare providers to focus on their primary mission of patient care while ensuring a professional and compliant response to security incidents.

Learn more about Claroty at https://claroty.com/

According to a 2023 report by the US Cyber Threat Intelligence Integration Center, the number of cyberattacks on the healthcare sector doubled in 2023 from the year prior. So far in 2024 that accelerated trajectory shows no sign of slowing down.

The incident at Change Healthcare and the downstream impact it had on the entire healthcare sector was yet another wake-up call for the industry. We need to do more to protect the vital healthcare infrastructure and ecosystem. However, with healthcare revenues under pressure and operational costs rising, healthcare organizations are struggling to dedicate resources to cybersecurity.

In light of that, many have wondered whether the government has a role to play in healthcare cybersecurity.

To get an answer to that question, and to several other healthcare cybersecurity challenges, we asked Ty Greenhalgh, Industry Principal at Medigate by Claroty. Here are his responses.

What role does the government have, if any, when it comes to healthcare cybersecurity? 

The government maintains a balance in healthcare cybersecurity by enforcing regulations like the Health Insurance Portability and Accountability Act (HIPAA) to safeguard patient data, while also providing guidance, resources, and support to help organizations improve their security. They avoid over-regulation by promoting industry best practices and allowing flexibility in compliance, ensuring accountability through penalties and incident response coordination to prevent breaches without hindering innovation or overloading providers.

Recently, the U.S. Department of Health and Human Services (HHS) launched a $50 million program to enhance cybersecurity tools for hospitals, addressing the urgent need to counter digital threats in the healthcare sector. This initiative is part of a broader government effort to bolster healthcare cybersecurity through various means, including funding, regulation, prevention, and coordination. Agencies like HHS and the Cybersecurity and Infrastructure Security Agency (CISA) play crucial roles by providing guidelines and regulatory frameworks, such as the Healthcare and Public Health (HPH) Cybersecurity Performance Goals (CPGs). These guidelines help organizations improve their cybersecurity posture with actionable measures and best practices.

The government also supports cybersecurity advancements and research through programs like the Cybersecurity Grant Program. Efforts to prevent cyber threats include promoting best practices, conducting threat assessments and fostering public-private partnerships for intelligence sharing and coordinated responses. By establishing regulations and offering resources, the government aims to strengthen the cybersecurity defenses of healthcare organizations and protect sensitive patient information.

What other information would be helpful to disclose in a healthcare breach notification so that there is more knowledge shared that could lead to improvements across the healthcare industry? (For example, retailers share theft data to help curb losses across their industry)

Providing detailed information about the attack vector, including how the breach occurred—whether through phishing, ransomware, or vulnerabilities in devices or software—would be beneficial. This should encompass the initial point of entry, how the attacker moved laterally through the network, and a timeline that covers the breach, the response actions taken, and when the situation was resolved. It would also be important to address any delays in detection and their causes. Identifying which systems were compromised, such as EHRs, patient portals, financial systems, email, or IoT devices, is crucial.

In addition to notifying affected individuals, healthcare breach notifications could benefit from including detailed information on the nature and scope of the breach, such as the specific vulnerabilities exploited, and the types of data compromised.

Transparency about how the breach occurred, including the tactics and techniques used by attackers, would provide valuable insights for other healthcare providers to bolster their own security measures.

Including information on the response actions taken, lessons learned and the steps being implemented to prevent future breaches could also aid in improving industry-wide practices. Just as retailers analyze thefts to enhance security measures, sharing such comprehensive details can help other organizations identify and address similar vulnerabilities, strengthening overall cybersecurity resilience across the healthcare sector.

What are two signs that a healthcare organization may need a third party cybersecurity partner?

Two key signs that a healthcare organization may need a third party cybersecurity partner include a lack of in-house expertise and a high volume of security incidents. A major risk to the healthcare sector is the shortage of skilled cyber talent, which can leave organizations vulnerable to attacks. If an organization struggles to maintain a team with specialized skills in cybersecurity or if its existing staff is overwhelmed by the complexity and volume of cyber threats, engaging a third party partner can provide the necessary expertise and resources. Additionally, frequent security incidents or breaches may indicate inadequate internal security measures, making it prudent to seek external support to enhance defenses, manage incident responses, and implement robust security protocols.

Considering recent incidents, like the one at UnitedHealth Group’s Change Healthcare unit, what are the primary challenges healthcare providers face in managing breach notifications internally, and how might delegating this responsibility to third parties alleviate these burdens?

Healthcare providers face several primary challenges in managing breach notifications internally, including the administrative burden, resource constraints and the need for timely and accurate communication. The process of identifying affected individuals, preparing and sending notifications, and addressing follow-up inquiries can be both time-consuming and costly, diverting resources away from patient care and core functions. Additionally, the cost and resources necessary for breach notifications further strain already under-resourced organizations, impacting their ability to bolster security practices and defenses. Delegating this responsibility to the third parties who are the source of the breach can help alleviate these burdens. These third parties are often equipped with specialized expertise and streamlined processes for handling notifications efficiently. They can ensure compliance with regulatory requirements, reduce the administrative load on healthcare staff, and allow providers to focus on remediation and improving their cybersecurity posture.

Given the specialized expertise required for effective breach notifications and the strain on healthcare resources, what are the key advantages of having third party entities manage and coordinate breach notifications, particularly in terms of regulatory compliance and maintaining patient trust?

Having third party entities manage and coordinate breach notifications offers several key advantages, particularly in terms of regulatory compliance and maintaining patient trust. Third party experts bring specialized knowledge and experience to handle notifications in a manner that meets regulatory requirements and minimizes legal risks. They can efficiently manage the complex and time-sensitive aspects of breach communications, ensuring that notifications are accurate and timely. Moreover, third parties can provide clear and consistent communication, helping to maintain patient trust and transparency during the breach resolution process. By handling these responsibilities, third parties enable healthcare providers to focus on their primary mission of patient care while ensuring a professional and compliant response to security incidents.

Learn more about Claroty at https://claroty.com/