In an Oct. 31 letter to the Workplace of the Nationwide Cyber Director, the School of Healthcare Data Administration Executives (CHIME) and the Affiliation for Executives in Healthcare Data Safety (AEHIS) known as for better coordination amongst Division of Well being & Human Companies businesses and advisable that the Facilities for Medicare & Medicaid Companies (CMS) develop a cybersecurity incentive program.
CHIME and AEHIS have been responding to a request for info on “alternatives for and obstacles to harmonizing cybersecurity laws.”
Launched by CHIME in 2014, AEHIS represents greater than 950 healthcare safety leaders and gives training and networking for senior IT safety leaders in healthcare.
Setting the stage for suggestions, the letter notes that the Healthcare and Public Well being (HPH) Sector has the unlucky distinction of being the sector with essentially the most knowledge breaches in response to quite a few research. “Healthcare knowledge and data stay profitable targets for theft and exploitation, notably by means of ransomware assaults,” they wrote. “Theft of information skyrocketed through the previous few years as legal teams and adversarial nation states capitalized on the COVID-19 pandemic through the use of social engineering, the exact same methods which were efficiently used in opposition to giant, publicly traded firms with far better assets than nearly all of America’s healthcare supply organizations (HDOs). Well being knowledge breaches reported to the Division of Well being and Human Companies’ (HHS) Workplace for Civil Rights (OCR) dramatically elevated in 2023, on tempo to double final 12 months’s whole, in response to a Politico evaluation of the newest company knowledge.”
CHIME and AEHIS additionally level out the dire monetary scenario some supplier organizations are dealing with. “Many are being compelled to scale back their finances beneath benchmarks, and cybersecurity tasks will seemingly find yourself not surviving these cuts,” the letter states. “Whereas the variety of sufferers that our hospitals and healthcare methods look after has remained regular, if not elevated, they’re now experiencing grievous monetary circumstances. With out a answer, help, and modifications in coverage on the federal degree – we worry and consider that there are numerous extra HDOs which are susceptible to closure throughout the nation.”
Responding to questions on how cybersecurity is coordinated and controlled, the letter famous that there are a number of areas of HHS which are chargeable for cybersecurity – together with interfacing with the non-public sector. “This has created fragmentation and coordination challenges each inside HHS in addition to outdoors of the Division.”
The letter recommends that HHS ought to have interaction in additional training efforts, leverage CMS as an outreach channel to assist enhance publicity, and additional educate suppliers – particularly the small, rural, and under-resourced – with details about: 1) The 405(d) Program’s finest practices; 2) The instruments which are already obtainable for gratis from the federal authorities together with these from CISA on threat evaluation and their cybersecurity hub; and three) NIST’s assets for small companies and their Nationwide Cybersecurity Middle of Excellence (NCCoE).
CHIME and AEHIS level out that almost all suppliers invoice Medicare and that CMS has an extended historical past of working the EHR Selling Interoperability (PI) Program (previously known as the Significant Use Program). “Due to this fact, we consider CMS is uniquely suited to assist oversee a brand new cybersecurity incentive program. Nevertheless, not like the EHR PI Program, which started as an incentive program and graduated to a penalty construction, we consider the cybersecurity wants in our sector are so dire and our sector’s monetary wants and workforce considerably depleted from combating the COVID-19 pandemic, that there must be no draw back threat to participation.”
Calling themselves robust supporters of the Nationwide Institute of Requirements and Expertise (NIST) Cybersecurity Framework (CSF), CHIME and AEHIS say they perceive that NIST is making an attempt to string the needle in as far as the CSF has been developed as a software for use by a wide range of organizations, throughout completely different sectors with completely different wants.
“Whereas we admire the stability NIST goals to strike, we consider smaller, rural and under-resourced healthcare organizations will want extra prescriptive steps that they’ll take if we’re to allow them to enhance their cybersecurity posture,” they wrote.
“For instance, throughout the continuum of healthcare, one phase that continues to current a considerable quantity of threat for our members are smaller doctor practices. They’ve a excessive want for training and assets given their cybersecurity posture stays immature. Once more, we’re not suggesting a lot that NIST modify the CSF to accommodate completely different sectors and to be clear, that would create a further set of issues. An excellent place to begin for cybersecurity resource-challenged organizations is to teach them; for instance, directing them to the 405(d) Program’s HICP software, which may be a method measurement may happen in our sector, and may help in addressing a few of these challenges. Lastly, we consider the main target should shift away from the mindset of how one healthcare supplier stacks up in opposition to one other supplier – and focus extra on the person supplier’s personal maturity journey.”
