In the Cybersecurity Act of 2015, Congress established the Health Care Industry Cybersecurity (HCIC) Task Force to address the challenges the health care industry faces when securing and protecting itself against cybersecurity incidents, whether intentional or unintentional.
It counts representatives from both private sector and public sector organizations as members, including the Chief Information Security Officer for the Centers for Medicare and Medicaid Services at the U.S. Department of Health and Human Services, the CIO of Cook Children’s Health Care System, the Chief Technology Risk Officer of insurer Kaiser Permanente and representatives from testing organization Underwriters Lab and security companies including Symantec and FireEye.
The report released to members of both the U.S. Senate and House of Representatives on Friday features more than 30 pages of recommendations and “imperatives,” some of which are bound to be the source of controversy. It concludes that the U.S. healthcare system is plagued by weaknesses, from the leadership and governance of information security within healthcare organizations, to the security of medical devices and medical laboratories to hiring and user awareness.
Many of the risks directly affect patient safety, the group found. It comes amid growing threats to healthcare organizations, including a ransomware outbreak that affected scores of hospitals in the United Kingdom.
The Task Force’s discussions resulted in the development of six imperatives along with cascading recommendations and action items. All of these reflect the need for a unified effort – among public and private sector organizations of all sizes and across all sub-sectors – to work together to meet an urgent challenge.
On the controversial issue of medical device security, the report suggests that the Federal government and industry might use incentives akin to the “cash for clunkers” car buyback program to encourage healthcare organizations to jettison insecure, legacy medical equipment. Medical device makers need to do a far better job designing products in line with accepted secure development practices and should be urged to publish a “bill of materials” with medical devices that accounts for all hardware and software used in a device, including open source software components.
FDA approval of medical devices can take six years or more, while devices have useful lives that may be measured in decades. Still, support by vendors like Microsoft, whose software is used to manage medical equipment, ends at around the eight year mark after initial release, resulting in products that are unsupported for much of their useful life..
Incidents like the WannaCry outbreak, which disrupted the delivery of medical care at scores of UK National Health Service facilities are shots over the bow, warning of what could be far more disruptive and widespread attacks said Joshua Corman, the Director of the Cyber Statecraft Initiative at The Atlantic Council and a founder of the group I Am The Cavalry.
Healthcare organizations rely heavily on connected medical devices, but most are small and cash strapped organizations that lack expertise in information security.