HHS Publishes New Cyber Security Guidelines for Healthcare Industry

Noting that cyber security is “the responsibility of every health care professional, from data entry specialists to physicians to board members,” the U.S. Department of Health and Human Services (HHS) has published Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP). The four-volume publication, which was mandated by the Cybersecurity Act of 2015, is aimed at hospital executives and cyber security professionals in healthcare organizations of all sizes and leverages the NIST Cybersecurity Framework.

Email phishing & ransomware among top cyber threats to healthcare organizations

The HHS guide focuses on what the agency considers to be the current top cyber security threats to the healthcare industry: email phishing; ransomware; loss or theft of hardware; insider, accidental, or intentional data loss; and attacks against smart medical devices that put patient safety at risk. The publication’s two Technical Volumes outline 10 best practice areas to mitigate cyber security threats:

* Email protection systems
* Endpoint protection systems
* Access management
* Data protection and loss prevention
* Asset management
* Network management
* Vulnerability management
* Incident response
* Medical device security
* Cybersecurity policies

Rather than introducing a new framework, HHS instead maps its best practice and sub practice recommendations to those in the NIST CSF. Recognizing the fundamental differences and concerns that organizations of different sizes encounter, separate recommendations are given for small, medium, and large organizations.

The financial impact of healthcare breaches can be devastating, especially to small organizations. The HHS points out that the healthcare industry has the highest data breach cost of any industry, at an average of $408 per record and $2.2 million per organization. In 2016, the healthcare industry as a whole lost $6.2 billion to data breaches.

HHS urges proactive healthcare cyber security, comparing cyber hygiene to hand-washing

Healthcare cyber security has been a vexing issue for quite some time, and many issues stem from a lack of employee cyber security training. Unlike many industries, which made the switch from paper and typewriters to digital files and computers over a period of years, the healthcare industry digitized practically overnight. Employee training on cyber security best practices is notoriously spotty; healthcare organizations tend to focus on HIPAA compliance, with cyber security awareness an afterthought at best. The HHS notes that healthcare facilities often “deploy technologies without cybersecurity safeguards or use them (intentionally or unintentionally) without proper protections” and points out that four out of five U.S. physicians have experienced some form of cyber attack.

Employee buy-in presents another problem. Many front-line healthcare workers feel that their only job is to care for patients and that cyber security is the IT department’s problem. The HHS publication points out that in modern healthcare, cyber security is a function of patient care. Cyber attacks on electronic health records systems and smart medical devices don’t just disrupt business operations; they put patients’ health and even lives at risk. As such, the HHS states, healthcare workers must be taught to see cyber security hygiene the way they are taught to see hand hygiene; just as they wash their hands to prevent the spread of infections, they need to practice cyber hygiene to protect electronic patient records, IoT devices, and other healthcare systems from malware infections and other cyber attacks.